Cybersecurity

Online stores on Adobe Commerce and Magento have a no-login takeover bug. Install the October update

Online stores on Adobe Commerce and Magento have a no-login takeover bug. Install the October update

Adobe rates the worst bug 10.0. No attacks yet, and September’s separate hotfix still matters....
Juniper fixed dozens of critical router and firewall bugs. Close J-Web to the internet and plan Junos upgrades

Juniper fixed dozens of critical router and firewall bugs. Close J-Web to the internet and plan Junos upgrades

Two of the bugs let someone take over a device through J-Web with no login. Nobody is exploiting them yet....
Attackers are reading files off self-hosted Jira and Confluence. CISA wants them patched by Sunday

Attackers are reading files off self-hosted Jira and Confluence. CISA wants them patched by Sunday

The Atlassian bug we flagged on October 7 is now confirmed exploited. Data Center servers need a fixed build or…
CISSP vs CISM (2026): Which Security Leadership Cert Is Right?

CISSP vs CISM (2026): Which Security Leadership Cert Is Right?

CISSP vs CISM in 2026: exam formats, domains, experience rules, current costs and annual fees, DoD 8140 work roles, salary data and which to choose.
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS

Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS

One mail gateway to check today, a firewall upgrade, a Nextcloud app to update and a backup hotfix to confirm....
The AhsayCBS backup bugs are now on CISA’s exploited list. Ask your MSP which hotfix they run

The AhsayCBS backup bugs are now on CISA’s exploited list. Ask your MSP which hotfix they run

Version 9 servers finally have a fix, and Ahsay has published what a compromised server looks like....
Nextcloud servers have been quietly backdoored through an office app since September. Update it or remove it

Nextcloud servers have been quietly backdoored through an office app since September. Update it or remove it

Turning the Collabora Built-in CODE Server app off does not help. It has to be updated or removed....
A Palo Alto firewall login is enough to own the firewall. Upgrade PAN-OS and lock down the admin page

A Palo Alto firewall login is enough to own the firewall. Upgrade PAN-OS and lock down the admin page

Palo Alto has seen limited attacks and published three IP addresses to look for....
Attackers are taking over Cisco email gateways with one booby-trapped attachment. Check your scanner version today

Attackers are taking over Cisco email gateways with one booby-trapped attachment. Check your scanner version today

The box that scans your mail for malware can be rooted by an email. Cisco says it is already happening....
CISSP vs CCSP (2026): Which ISC2 Certification Should You Take?

CISSP vs CCSP (2026): Which ISC2 Certification Should You Take?

CISSP vs CCSP in 2026: domains, experience requirements, exam difficulty, DoD 8140 work roles, salary data and which ISC2 certification to take first.
Wednesday’s brief: a Windows bug already under attack, then Ivanti VPNs, SAP and Fortinet

Wednesday’s brief: a Windows bug already under attack, then Ivanti VPNs, SAP and Fortinet

One update to push today, one VPN to upgrade and check, and two patch lists for this week....
Your FortiSIEM and FortiSandbox boxes have no-login bugs. Upgrade them before attackers go looking

Your FortiSIEM and FortiSandbox boxes have no-login bugs. Upgrade them before attackers go looking

The tools that watch your network can be taken over without an account. Fortinet says neither bug is exploited yet....
Two SAP fixes this month let an ordinary user take over the system. Book S/4HANA and Visual Composer patches this week

Two SAP fixes this month let an ordinary user take over the system. Book S/4HANA and Visual Composer patches this week

Four critical notes in SAP’s October patch day. None is exploited, and two of them rate 9.9....