All news
Top stories
The security stories that mattered most in each period and in each category, for everyone in IT: security, infrastructure, engineering, sysadmin, CISO.
Top 3 of the week
The last 7 days.
- Exploited in attacksMicrosoft's November 2026 Patch Tuesday: Over 1,000 Vulnerabilities AddressedMicrosoft patched over 1,000 vulnerabilities including an actively exploited Outlook zero-day; prioritize Outlook and critical updates immediately.Critical severityPatch available
- Exploited in attacksExploits Target Barracuda ESG Vulnerabilities for Root AccessAttackers are exploiting two Barracuda ESG vulnerabilities to run commands with root privileges without authentication.Critical severityWidely deployed technology
- Exploited in attacksUrgent Chrome Update: Google Addresses Eighth Zero-Day Threat of the YearGoogle issued an emergency update patching the eighth Chrome zero-day exploited this year, urging immediate upgrades.Patch availableWidely deployed technology
Top 3 of the last 30 days
A rolling month, up to today.
- 7 stories, 6 outletsPHP2Shell Vulnerabilities Exploited in Global Cyber AttacksPHP2Shell exploitation observed against internet-exposed management interfaces, with attackers chaining Linux kernel bugs for full compromise.Exploited in attacksCritical severity
- 7 stories, 4 outletsGitLab Addresses Critical Security Flaw with Urgent PatchesGitLab released patches for a CVSS 10.0 unauthenticated RCE in CE/EE that allowed arbitrary server code execution.Critical severityPatch available
- 4 stories, 4 outletsUrgent Patch Required for Ivanti Connect Secure Zero-Day VulnerabilityCISA warns of actively exploited Ivanti Connect Secure zero-day enabling unauthenticated remote commands; immediate patching recommended.Exploited in attacksCritical severity
Top 3 of October 2026
Oct 1 to Oct 31.
- 9 stories, 6 outletsExploitation of Citrix NetScaler Vulnerability Leads to Security BreachesThreat actors exploit Citrix NetScaler pre-auth flaws to drop web shells, create superusers, and steal configs.Exploited in attacksCritical severity
- 7 stories, 6 outletsPHP2Shell Vulnerabilities Exploited in Global Cyber AttacksPHP2Shell exploitation observed against internet-exposed management interfaces, with attackers chaining Linux kernel bugs for full compromise.Exploited in attacksCritical severity
- 8 stories, 4 outletsCritical Security Update: GitLab Addresses Major Vulnerability in AI GatewayGitLab patched a critical AI Gateway RCE affecting self-hosted gateways; immediate upgrades to specified versions advised.Critical severityPatch available
Top 3 of Q3 2026
Jul 1 to Sep 30.
- 10 stories, 6 outletsCitrix NetScaler Faces Zero-Day Vulnerability CrisisTwo critical NetScaler RCE zero-days are being exploited; Citrix released emergency patches and CISA issued alerts.Exploited in attacksCritical severity
- 5 stories, 5 outletsCritical Security Flaw in Gitea Docker Image Under Active ExploitationCritical auth-bypass in official Gitea Docker image is actively exploited to impersonate any user, including administrators.Exploited in attacksCritical severity
- 5 stories, 4 outletsCrowdStrike FalconFlank Zero-Day Exploit Threatens Windows SystemsFalconFlank zero-day exploit targets CrowdStrike Falcon, enabling SYSTEM privilege escalation on updated Windows hosts.Exploited in attacksCritical severity
Top 3 of the first half of 2026
Apr 13 to Jun 30. Our archive starts in April 2026.
- 2 stories, 2 outletsIvanti Releases Critical Patch for Exploited Zero-Day VulnerabilityCVE-2026-6973 exploited in targeted attacks; patches released to mitigate. Immediate patching recommended.Exploited in attacksCritical severity
- 2 stories, 2 outletsCritical Backdoor Discovered in ShapedPlugin WordPress Pro PluginsSupply chain compromise injected backdoor code into official Pro plugin releases; warns on software supply chain risk.Critical severitySupply-chain risk
- 2 stories, 2 outletsCritical Flaw in Microsoft 365 Copilot Could Allow Data ExfiltrationA three-stage path (SearchLeak) enables exfiltration of emails and MFA data via trusted Copilot links. Restrict Copilot usage and tighten monitoring.Critical severityWidely deployed technology
Top 3 of 2026 so far
Apr 13 to Nov 13. Our archive starts in April 2026.
- 10 stories, 6 outletsCitrix NetScaler Faces Zero-Day Vulnerability CrisisTwo critical NetScaler RCE zero-days are being exploited; Citrix released emergency patches and CISA issued alerts.Exploited in attacksCritical severity
- 7 stories, 6 outletsPHP2Shell Vulnerabilities Exploited in Global Cyber AttacksPHP2Shell exploitation observed against internet-exposed management interfaces, with attackers chaining Linux kernel bugs for full compromise.Exploited in attacksCritical severity
- 8 stories, 4 outletsCritical Security Update: GitLab Addresses Major Vulnerability in AI GatewayGitLab patched a critical AI Gateway RCE affecting self-hosted gateways; immediate upgrades to specified versions advised.Critical severityPatch available
Top stories by category
The last 30 days. A story can lead more than one category.