grep -rl "exploited" ./articles
CISA added two more Ivanti Connect Secure flaws on 30 October. Ivanti's advisory says the exploitation it saw used all three chained, and the versions it shipped in October as the fix are listed as affected by the new pair.
CVE-2026-97229 is a 10.0 that CISA listed on 29 October, due 1 November. GitLab patched it on the 12th. The underlying Onigmo overflow produced four GitLab CVEs and no Ruby ones, so GitLab's numbers are the only ones a scanner can match.
Counted from CISA's own feed: 1,762 entries, 278 of them added in 2026, 94 carrying a forensic triage flag that did not exist before June. Arista's VeloCloud Orchestrator holds three of the 94.
CVE-2026-41709 lets an administrator run operations that are never logged. Broadcom rates it Low. It was added to the catalogue on 28 October, due 11 November, and the patch has been out since July.
CVE-2026-76418 lets an unauthenticated attacker reload an ASA or FTD device, but only where secondary authentication is configured on a tunnel group. Both of Cisco's mitigations work by removing that hardening.
Dream says an operation ran from 8 to 24 October, filtered 19,000 firewalls down to 240 targets and rooted 24 in a single batch. The AI part of the story is thinner than the headlines, by the researchers' own admission.
CVE-2026-86950 went to iOS 26.7.1 and macOS Sequoia 15.8.1 in single-CVE emergency releases. The iPhone XS, XS Max and XR waited 28 days for the same fix, with the patch already public.
CVE-2026-48356 went on the catalogue on 27 October, due 10 November. Adobe shipped the backport on 14 July with a line saying it was not aware of any exploits. Sansec had been logging mass attacks since March.
CVE-2026-102785 was patched on 21 October. Unit 42 watched automated webshell drops two days later, each validated in seconds and followed by a person. A mass-exploit tool is already public, and the flaw is not on CISA's catalogue.
CVE-2026-111497 was added on 27 October with a due date of 10 November. The catalogue lists Google Brotli, and the fix arrives separately in Node, .NET, Bun, Envoy, Istio, the PHP Windows builds and your distribution's own package.
Successful remote code execution was confirmed against honeypots on 24 October. CISA added both CVEs on the 26th, due the 29th. The sentence we published yesterday is now wrong, and this is the correction.
CVE-2026-110447 is an unauthenticated command injection in the built-in CODE server, scored 9.2 and exploited since September. Disabling the app does not fix it, and the federal deadline is today.
CVE-2026-76519 is a 9.8 that Cisco found in its own scanning and is now seeing exploited. There is no workaround, and the advisory warns that upgrading a compromised appliance destroys the evidence.
CVE-2026-114625 is a 9.9 SQL injection that Arista found itself and says is already being exploited. An Enterprise Read Only tenant account reaches local superuser on the orchestrator.
Four chained flaws give unauthenticated code execution on a Plex Media Server. The fix shipped on 3 August and the attacks began seventy-five days later, which tells you the patch was never the variable.
JPCERT says a completed update may delete the traces of compromise, so the vendor wants diagnostics collected first. And JVN's own CVSS vector describes a local attacker with low privileges, which is not the story the headlines tell.
An unauthenticated attacker sends an email to a Cisco Secure Email Gateway, and a path traversal in the malware-scanning path writes arbitrary files and executes commands as root. Scored 9.8, exploited, and there is a fix that needs no reboot.
CVE-2026-0322 is a code injection in the PAN-OS management interface that gives root. It needs valid credentials, which sounds like a barrier until you ask the question the requirement actually raises: who can reach that interface at all.