Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

Nov 2, 2026

Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

Nov 2, 2026

Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

Nov 2, 2026

A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

Fortinet ships critical FortiGate fixes today and won’t say what they fix until November 10. Upgrade internet-facing firewalls first

Fortinet releases FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 plus FortiManager and FortiAnalyzer fixes on Oct 22; advisories follow Nov 10. Patch edge firewalls first.

Wednesday’s brief: PHP’s 10 AM security release, then Oracle’s October patches, Chrome 156 and Pillow

PHP’s critical release at 14:00 UTC, Oracle CPU CVE-2026-101809, Chrome 156 CVE-2026-113072 and Pillow CVE-2026-112398, with first steps for each.

Python apps that accept image uploads need Pillow 13. Two of its fixes stop code execution from a single file

CVE-2026-112398 and a 9.8 multi-frame bug let crafted images run code in Pillow 12.3.0 and older. Upgrade to 13.0.0 or limit Image.open formats.

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

Chrome 156 fixes six critical bugs. Make sure every laptop actually restarts the browser this week

CVE-2026-113072 and five more critical bugs are fixed in Chrome 156.0.8078.47/.48. Force a relaunch and check versions across your fleet.

Oracle’s October update fixes 1,295 flaws. Start with E-Business Suite and WebLogic servers that face the internet

CVE-2026-101809 (10.0) in E-Business Suite and WebLogic CVE-2026-91323 lead Oracle’s 1,295-patch October 2026 CPU. Patch internet-facing systems first.

PHP ships fixes for two critical flaws at 10 AM ET today. Find every server that runs it before then

PHP ships fixes for two critical CVSS 9.2 flaws on Oct 21 at 14:00 UTC (10 AM ET). Inventory PHP 8.2 to 8.5 servers and book the update now.

Tuesday’s brief: a backdoored Rank Math PRO update, hijacked Plex servers and a signed Siemens app used for malware

CVE-2026-111862 Rank Math PRO backdoor, CVE-2026-96656 Plex2Shell attacks and CVE-2026-110936 Siemens Software Center abuse, with fixes for each.

Criminals are using a signed Siemens app to load malware from fake CAPTCHA pages. Update it and hunt by folder

CVE-2026-110936 in Siemens Software Center is abused in Romulus ClickFix attacks. Update to 4.0.9.8, block the IoCs and hunt for the AppData folders.

Old Plex servers are being hijacked to mine crypto and relay traffic. Update to 1.43.3.10861 or newer

CVE-2026-96656 and three other Plex Media Server bugs (Plex2Shell) are exploited to drop miners and proxies. Update to 1.43.3.10861 or later.

Rank Math PRO shipped a backdoor through its own updates. Check when your copy arrived before you trust the fix

CVE-2026-111862: Rank Math PRO 3.0.123 copies from Oct 15-16 carried a backdoor. Restore from a clean backup, rotate secrets, then install 3.0.124.

Monday’s brief: BeyondTrust intruders and a FortiOS deadline today, then NGINX and WebSphere Liberty

CVE-2026-102764 BeyondTrust Remote Support and CVE-2025-61624 FortiOS are exploited and due Oct 19. Plus NGINX 1.31.7 and IBM WebSphere Liberty gRPC fixes.

IBM WebSphere Liberty apps with gRPC switched on can be called without a login. Apply the interim fix

CVE-2026-93895 in IBM WebSphere Liberty 20.0.0.12 to 26.0.0.10 lets unauthenticated callers reach protected gRPC methods. Apply the APAR DT502929 interim fix.

Your NGINX web servers have new overflow fixes. Upgrade before someone tests your config for you

NGINX 1.31.7 and 1.30.6 fix five bugs, two rated critical by F5: worker overflows in alias plus rewrite configs. Who is exposed and how to check yours.