Daily Brief

Chrome 156 fixes six critical bugs. Make sure every laptop actually restarts the browser this week

Chrome 156 fixes six critical bugs. Make sure every laptop actually restarts the browser this week

CVE-2026-113072 and five more critical bugs are fixed in Chrome 156.0.8078.47/.48. Force a relaunch and check versions across your fleet.
Oracle’s October update fixes 1,295 flaws. Start with E-Business Suite and WebLogic servers that face the internet

Oracle’s October update fixes 1,295 flaws. Start with E-Business Suite and WebLogic servers that face the internet

CVE-2026-101809 (10.0) in E-Business Suite and WebLogic CVE-2026-91323 lead Oracle’s 1,295-patch October 2026 CPU. Patch internet-facing systems first.
PHP ships fixes for two critical flaws at 10 AM ET today. Find every server that runs it before then

PHP ships fixes for two critical flaws at 10 AM ET today. Find every server that runs it before then

PHP ships fixes for two critical CVSS 9.2 flaws on Oct 21 at 14:00 UTC (10 AM ET). Inventory PHP 8.2 to 8.5 servers and book the update now.
Tuesday’s brief: a backdoored Rank Math PRO update, hijacked Plex servers and a signed Siemens app used for malware

Tuesday’s brief: a backdoored Rank Math PRO update, hijacked Plex servers and a signed Siemens app used for malware

CVE-2026-111862 Rank Math PRO backdoor, CVE-2026-96656 Plex2Shell attacks and CVE-2026-110936 Siemens Software Center abuse, with fixes for each.
Criminals are using a signed Siemens app to load malware from fake CAPTCHA pages. Update it and hunt by folder

Criminals are using a signed Siemens app to load malware from fake CAPTCHA pages. Update it and hunt by folder

CVE-2026-110936 in Siemens Software Center is abused in Romulus ClickFix attacks. Update to 4.0.9.8, block the IoCs and hunt for the AppData folders.
Old Plex servers are being hijacked to mine crypto and relay traffic. Update to 1.43.3.10861 or newer

Old Plex servers are being hijacked to mine crypto and relay traffic. Update to 1.43.3.10861 or newer

CVE-2026-96656 and three other Plex Media Server bugs (Plex2Shell) are exploited to drop miners and proxies. Update to 1.43.3.10861 or later.
Rank Math PRO shipped a backdoor through its own updates. Check when your copy arrived before you trust the fix

Rank Math PRO shipped a backdoor through its own updates. Check when your copy arrived before you trust the fix

CVE-2026-111862: Rank Math PRO 3.0.123 copies from Oct 15-16 carried a backdoor. Restore from a clean backup, rotate secrets, then install 3.0.124.
Monday’s brief: BeyondTrust intruders and a FortiOS deadline today, then NGINX and WebSphere Liberty

Monday’s brief: BeyondTrust intruders and a FortiOS deadline today, then NGINX and WebSphere Liberty

CVE-2026-102764 BeyondTrust Remote Support and CVE-2025-61624 FortiOS are exploited and due Oct 19. Plus NGINX 1.31.7 and IBM WebSphere Liberty gRPC fixes.
IBM WebSphere Liberty apps with gRPC switched on can be called without a login. Apply the interim fix

IBM WebSphere Liberty apps with gRPC switched on can be called without a login. Apply the interim fix

CVE-2026-93895 in IBM WebSphere Liberty 20.0.0.12 to 26.0.0.10 lets unauthenticated callers reach protected gRPC methods. Apply the APAR DT502929 interim fix.
Your NGINX web servers have new overflow fixes. Upgrade before someone tests your config for you

Your NGINX web servers have new overflow fixes. Upgrade before someone tests your config for you

NGINX 1.31.7 and 1.30.6 fix five bugs, two rated critical by F5: worker overflows in alias plus rewrite configs. Who is exposed and how to check yours.
Stolen FortiGate admin passwords are turning into full firewall takeovers. Upgrade FortiOS and change them

Stolen FortiGate admin passwords are turning into full firewall takeovers. Upgrade FortiOS and change them

CVE-2025-61624 in Fortinet FortiOS lets admins write files as root; Unit 42 saw it used to plant PEERSTITCH. Upgrade to 7.4.10 or 7.6.5 and rotate admin passwords.
A China-linked spy group broke into BeyondTrust help desk appliances. Patch Remote Support today and check for intruders

A China-linked spy group broke into BeyondTrust help desk appliances. Patch Remote Support today and check for intruders

CVE-2026-102764 in BeyondTrust Remote Support (26.2.3 and earlier) was exploited by ARMORY CASTLE. Apply BT26-05-RS and check appliances for compromise.
Friday’s brief: Atlassian on CISA’s clock, then Juniper, Adobe Commerce and a Linux VM escape

Friday’s brief: Atlassian on CISA’s clock, then Juniper, Adobe Commerce and a Linux VM escape

One Atlassian deadline this weekend, a Junos upgrade plan, a store patch and a host kernel update....