Cybersecurity

Support techs: a TeamViewer bug lets the computer you connect to attack yours. Update to 15.83

Support techs: a TeamViewer bug lets the computer you connect to attack yours. Update to 15.83

TeamViewer CVE-2026-111585 (CVSS 8.8) lets a malicious host attack the connecting viewer. Full Client, Portable and Android app before 15.83 affected, plus CVE-2026-92372 and CVE-2026-92374.
Linux servers: fixed kernels for the remote-root TCP bug are out, and they only count after a reboot

Linux servers: fixed kernels for the remote-root TCP bug are out, and they only count after a reboot

Linux kernel CVE-2026-98432 (CVSS 9.8) allows remote root via IPv4 TCP. Red Hat RHEL 8, Amazon Linux and stable kernels are fixed, Ubuntu is in -proposed. Versions, mitigations and checks.
CMMC After the Phase 2 Suspension: What Contractors Still Have to Do in 2026

CMMC After the Phase 2 Suspension: What Contractors Still Have to Do in 2026

CMMC Phase 2 was suspended July 13, 2026. See what contractors still need: Level 1 and Level 2 self-assessments, SPRS scores and annual affirmations.
Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores

Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores

Ivanti Connect Secure CVE-2026-111357 on CISA KEV due Nov 2, WordPress CVE-2026-119977 upgrade-window attacks, a backdoored Claude Code extension in Cursor and exploited Drupal Commerce Core.
Drupal stores: attackers are using a Commerce Core flaw that can cost you money. Update and audit your orders

Drupal stores: attackers are using a Commerce Core flaw that can cost you money. Update and audit your orders

Drupal Commerce Core CVE-2026-118539 (SA-CONTRIB-2026-254) is exploited in the wild. Update to 3.3.13 or 8.x-2.41 and audit store orders. Affected versions, checks and sources.
A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

Malicious Anthropic.claude-code 2.1.312 and 2.1.313 in the Cursor marketplace planted an svc-telemetry SSH key and reverse tunnel on Oct 29. How to check, clean up and rotate credentials.
Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

WordPress core CVE-2026-119977 (4.7 to 7.1.3) lets attackers run code during a core update. Wordfence logged tens of thousands of attempts. Fixed releases, wp-content/upgrade block and log checks.
Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

Ivanti Connect Secure CVE-2026-111357, the dsinvoked root escalation chained in October attacks, is on CISA KEV due Nov 2. Fixed builds 22.8R2.6, 25.1.1.3, 25.1.3.1 and hunt steps.
No Featured Image

Blue Team Certifications (2026): CySA+, GCIA, BTL1 and SC-200 Compared

Blue team certifications compared: CySA+ V4, GCIA, BTL1 and SC-200. Exam formats, experience, renewal, DoD 8140 notes, which to take first, who pays.
Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware

Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware

Cisco ASA and FTD CVE-2026-76418 VPN zero-day on CISA KEV, GitLab CVE-2026-97229 on KEV with an Alpine Linux incident, Synology C3RB3R ransomware and Cisco SD-WAN KeyDrift.
Spies sat inside Cisco SD-WAN controllers and copied the encryption keys. Check yours is patched and clean

Spies sat inside Cisco SD-WAN controllers and copied the encryption keys. Check yours is patched and clean

Cisco Talos reports UAT-11473 used SD-WAN bypass CVE-2026-20127 to plant KeyDrift, which copies IPsec key material. Fixed releases, files to check and what to rotate.
Ransomware is locking Synology NAS boxes that skipped September’s update. Check your DSM version today

Ransomware is locking Synology NAS boxes that skipped September’s update. Check your DSM version today

C3RB3R (Cerber) ransomware is encrypting Synology NAS devices via DSM flaws CVE-2026-13639 and CVE-2026-13684, fixed Sept 18. Fixed DSM versions, backups and hunt steps.
The GitLab bug we flagged is now on CISA’s exploited list, and Alpine Linux’s upgrade did not fix it

The GitLab bug we flagged is now on CISA’s exploited list, and Alpine Linux’s upgrade did not fix it

CISA added GitLab CVE-2026-97229 to KEV on Oct 29 (due Nov 1). Alpine Linux nearly lost its server because GitLab upgrades alone did not patch its Ruby. Versions, Ruby fixes and hunt steps.