George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].
Ivanti Neurons for ITSM: Unauth Deserialization RCE Pair (CVE-2026-12744 / 12745)

Ivanti Neurons for ITSM: Unauth Deserialization RCE Pair (CVE-2026-12744 / 12745)

Two CVSS 9.8 unauth deserialization bugs on the ITSM brain. On-prem needs September updates or 2026.2+....
The 5-Minute Cyber Brief: September 21, 2026

The 5-Minute Cyber Brief: September 21, 2026

Monday reboot-and-revoke brief: Linux kernel KEV trio due today, Orkes Conductor RCE, SolarWinds ARM, CrowdSec offboarding....
Linux Kernel KEV Trio: kTLS, ebtables, AF_ALG — Federal Due September 21

Linux Kernel KEV Trio: kTLS, ebtables, AF_ALG — Federal Due September 21

CISA's three exploited Linux kernel bugs are due today. Patch, reboot, then triage....
Orkes Conductor CVE-2026-58138: Pre-Auth RCE via Unsandboxed Workflow Scripts

Orkes Conductor CVE-2026-58138: Pre-Auth RCE via Unsandboxed Workflow Scripts

Pre-auth INLINE scripts escape GraalVM. Fortinet is blocking thousands of attempts — upgrade to 3.30.2+....
CrowdSec: Departed Employee’s Live GitHub Access → ~170 Private Repos Cloned

CrowdSec: Departed Employee’s Live GitHub Access → ~170 Private Repos Cloned

TanStack credential theft plus retained ex-employee GitHub access cloned ~170 private repos....
SolarWinds Access Rights Manager CVE-2026-28326: Hard-Coded Key to Unauth RCE

SolarWinds Access Rights Manager CVE-2026-28326: Hard-Coded Key to Unauth RCE

Hard-coded static key yields unauthenticated RCE on ARM ≤2026.2. Ship 2026.2.1....
The 5-Minute Cyber Brief: September 18, 2026

The 5-Minute Cyber Brief: September 18, 2026

Friday clock stories: Cisco ISE root bypass due Saturday, Acronis hosting LPE, MikroTik MikroTrick, Check Point management root....
Check Point CVE-2026-91843: Unauth Stack Overflow to Root on Management Servers

Check Point CVE-2026-91843: Unauth Stack Overflow to Root on Management Servers

Pre-auth login overflow yields root on Security Management / Log servers. Apply LivePatch sk1000155; lock Trusted Clients....
MikroTik RouterOS MikroTrick: Unauth SSH Chain Hijacks Devices

MikroTik RouterOS MikroTrick: Unauth SSH Chain Hijacks Devices

CERT.pl MikroTrick chain: SSH auth bypass + privilege escalation. Two CVEs already on CISA KEV....
Acronis Backup CVE-2026-87886: Hosting Plugin LPE — KEV Due September 19

Acronis Backup CVE-2026-87886: Hosting Plugin LPE — KEV Due September 19

Default-permissions LPE on Acronis cPanel/Plesk backup agents under limited targeted exploitation. Same Saturday clock....
Cisco ISE CVE-2026-76460: Unauth Management Bypass to Root — KEV Due September 19

Cisco ISE CVE-2026-76460: Unauth Management Bypass to Root — KEV Due September 19

CVSS 10 ISE/ISE-PIC API auth bypass can land root. Active exploitation; federal due date Saturday September 19....
The 5-Minute Cyber Brief: September 17, 2026

The 5-Minute Cyber Brief: September 17, 2026

Thursday brief: N-able N-central CVSS 10, JFrog Artifactory admin chain, Citrix NetScaler bypass, Google Pixel KEV due September 19....
Google Pixel CVE-2026-58704: Modem Improper Auth — KEV Due September 19

Google Pixel CVE-2026-58704: Modem Improper Auth — KEV Due September 19

CISA added a Pixel cellular-modem improper-authorization bug on September 16. Federal due September 19 — verify MDM security patch levels....