Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

Stolen FortiGate admin passwords are turning into full firewall takeovers. Upgrade FortiOS and change them

Stolen FortiGate admin passwords are turning into full firewall takeovers. Upgrade FortiOS and change them

CVE-2025-61624 in Fortinet FortiOS lets admins write files as root; Unit 42 saw it used to plant PEERSTITCH. Upgrade to 7.4.10 or 7.6.5 and rotate admin passwords.
A China-linked spy group broke into BeyondTrust help desk appliances. Patch Remote Support today and check for intruders

A China-linked spy group broke into BeyondTrust help desk appliances. Patch Remote Support today and check for intruders

CVE-2026-102764 in BeyondTrust Remote Support (26.2.3 and earlier) was exploited by ARMORY CASTLE. Apply BT26-05-RS and check appliances for compromise.
Friday’s brief: Atlassian on CISA’s clock, then Juniper, Adobe Commerce and a Linux VM escape

Friday’s brief: Atlassian on CISA’s clock, then Juniper, Adobe Commerce and a Linux VM escape

One Atlassian deadline this weekend, a Junos upgrade plan, a store patch and a host kernel update....

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

A Linux kernel bug lets a virtual machine read its host’s memory. Patch the hosts, not just the guests

A Linux kernel bug lets a virtual machine read its host’s memory. Patch the hosts, not just the guests

A researcher leaked host memory from Vercel’s live sandboxes and reached a full host escape in a lab....
Online stores on Adobe Commerce and Magento have a no-login takeover bug. Install the October update

Online stores on Adobe Commerce and Magento have a no-login takeover bug. Install the October update

Adobe rates the worst bug 10.0. No attacks yet, and September’s separate hotfix still matters....
Juniper fixed dozens of critical router and firewall bugs. Close J-Web to the internet and plan Junos upgrades

Juniper fixed dozens of critical router and firewall bugs. Close J-Web to the internet and plan Junos upgrades

Two of the bugs let someone take over a device through J-Web with no login. Nobody is exploiting them yet....
Attackers are reading files off self-hosted Jira and Confluence. CISA wants them patched by Sunday

Attackers are reading files off self-hosted Jira and Confluence. CISA wants them patched by Sunday

The Atlassian bug we flagged on October 7 is now confirmed exploited. Data Center servers need a fixed build or…
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS

Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS

One mail gateway to check today, a firewall upgrade, a Nextcloud app to update and a backup hotfix to confirm....
The AhsayCBS backup bugs are now on CISA’s exploited list. Ask your MSP which hotfix they run

The AhsayCBS backup bugs are now on CISA’s exploited list. Ask your MSP which hotfix they run

Version 9 servers finally have a fix, and Ahsay has published what a compromised server looks like....
Nextcloud servers have been quietly backdoored through an office app since September. Update it or remove it

Nextcloud servers have been quietly backdoored through an office app since September. Update it or remove it

Turning the Collabora Built-in CODE Server app off does not help. It has to be updated or removed....
A Palo Alto firewall login is enough to own the firewall. Upgrade PAN-OS and lock down the admin page

A Palo Alto firewall login is enough to own the firewall. Upgrade PAN-OS and lock down the admin page

Palo Alto has seen limited attacks and published three IP addresses to look for....
Attackers are taking over Cisco email gateways with one booby-trapped attachment. Check your scanner version today

Attackers are taking over Cisco email gateways with one booby-trapped attachment. Check your scanner version today

The box that scans your mail for malware can be rooted by an email. Cisco says it is already happening....
Wednesday’s brief: a Windows bug already under attack, then Ivanti VPNs, SAP and Fortinet

Wednesday’s brief: a Windows bug already under attack, then Ivanti VPNs, SAP and Fortinet

One update to push today, one VPN to upgrade and check, and two patch lists for this week....