grep -rl "patch-management" ./articles
Three Connect Secure zero-days were exploited as a chain. One was catalogued on 13 October, two more on the 30th with deadlines eleven days apart. The fixes from the 13th do not address the later two, and the records disagree on who can exploit them.
We counted the gap between the date added and the deadline for all 1,769 entries in the exploited vulnerabilities catalogue. Twenty-one days is the historic norm. Every three-day deadline ever issued was issued in 2026, and they are now the majority.
Attacks on about 1,000 Zyxel switches were blamed on a flaw patched in June. Binarly found the exploit uses a different one that still works on patched firmware. The wrong CVE is in the federal catalogue and the right one is not.
Microsoft published a network remote code execution flaw in Paint on 13 October with Official Fix in its own severity vector. The build that fixes it was announced on 6 November, and it ships only through the Microsoft Store.
The coverage said 1,000 GitLab servers were exposed. Shadowserver's same post counted 11,300 exposed to a different bug, a CVSS 10.0 in Ruby's regex engine, and the release everyone rushed to under the CISA deadline does not contain its fix.
Counted from CISA's own feed: 1,762 entries, 278 of them added in 2026, 94 carrying a forensic triage flag that did not exist before June. Arista's VeloCloud Orchestrator holds three of the 94.
CVE-2026-86950 went to iOS 26.7.1 and macOS Sequoia 15.8.1 in single-CVE emergency releases. The iPhone XS, XS Max and XR waited 28 days for the same fix, with the patch already public.
Chrome 155 went to Stable on 7 October with 247 security fixes, four of them critical use-after-free bugs. None were exploited. The interesting part is the attribution list: a visible share of the reports are credited to researchers working with AI assistants, which is the mechanism behind the CVE numbers everyone has been quoting.
Microsoft published an out-of-band advisory for CVE-2026-96940, an authorisation flaw scored 8.8. An attacker needs valid credentials for any mailbox in the organisation; from there they can read other people's messages and attachments. Exchange Online was mitigated server-side. On-premises stays exposed until an administrator installs the update.
On 3 October we wrote that Citrix customers were watching their gateways reboot after installing the emergency build, with no CVE and no root cause published. Citrix disclosed it on the 4th: CVE-2026-88779, a memory overflow reached through SAML, exploited in targeted attacks. Each attempt crashes the authentication service, and the sixth restarts the appliance.
Citrix shipped 14.1-73.37 for two actively exploited 9.5s. Customers who installed it are reporting repeated appliance reboots, traced to crafted SAML traffic crashing the authentication service until the watchdog restarts the box. Citrix says it is tracking a newly seen SAML issue. Bulletin CTX697096, last updated 27 September, still does not mention it.
The 2026 Digital Defense Report, covering July 2025 to June 2026, says attackers are collecting the benefits of AI first. Underneath that headline are three numbers that do not need AI to explain them: nearly 40,000 CVEs in six months, a weaponisation median well below 24 hours against 30 to 60 days to remediate, and a 2020 vulnerability still responsible for most detections among the top five.
Manifold Security found that an authenticated non-admin user of Odysseus could execute OS commands with the process's own privileges. What that account reached is the story: API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages.
Binarly found six vulnerabilities in U-Boot's FIT signature verification. Two allow code execution during verification itself. The code dates to U-Boot 2013.07, and the devices running it mostly update through vendors who may never ship a patch.
CVE-2026-8037 is a CVSS 9.6 command injection in Progress Kemp LoadMaster, traced to its escape_quotes() routine. 792 exploitation attempts over 41 days from 65 IPs across 18 countries — and the federal remediation deadline is today.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.
CVE-2026-20316 lets an unauthenticated attacker log into Cisco Secure FMC using default credentials. Chained with CVE-2026-20079, that becomes root.