grep -rl "patch-management" ./articles
Chrome 155 went to Stable on 7 October with 247 security fixes, four of them critical use-after-free bugs. None were exploited. The interesting part is the attribution list: a visible share of the reports are credited to researchers working with AI assistants, which is the mechanism behind the CVE numbers everyone has been quoting.
Microsoft published an out-of-band advisory for CVE-2026-96940, an authorisation flaw scored 8.8. An attacker needs valid credentials for any mailbox in the organisation; from there they can read other people's messages and attachments. Exchange Online was mitigated server-side. On-premises stays exposed until an administrator installs the update.
On 3 October we wrote that Citrix customers were watching their gateways reboot after installing the emergency build, with no CVE and no root cause published. Citrix disclosed it on the 4th: CVE-2026-88779, a memory overflow reached through SAML, exploited in targeted attacks. Each attempt crashes the authentication service, and the sixth restarts the appliance.
Citrix shipped 14.1-73.37 for two actively exploited 9.5s. Customers who installed it are reporting repeated appliance reboots, traced to crafted SAML traffic crashing the authentication service until the watchdog restarts the box. Citrix says it is tracking a newly seen SAML issue. Bulletin CTX697096, last updated 27 September, still does not mention it.
The 2026 Digital Defense Report, covering July 2025 to June 2026, says attackers are collecting the benefits of AI first. Underneath that headline are three numbers that do not need AI to explain them: nearly 40,000 CVEs in six months, a weaponisation median well below 24 hours against 30 to 60 days to remediate, and a 2020 vulnerability still responsible for most detections among the top five.
Manifold Security found that an authenticated non-admin user of Odysseus could execute OS commands with the process's own privileges. What that account reached is the story: API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages.
Binarly found six vulnerabilities in U-Boot's FIT signature verification. Two allow code execution during verification itself. The code dates to U-Boot 2013.07, and the devices running it mostly update through vendors who may never ship a patch.
CVE-2026-8037 is a CVSS 9.6 command injection in Progress Kemp LoadMaster, traced to its escape_quotes() routine. 792 exploitation attempts over 41 days from 65 IPs across 18 countries — and the federal remediation deadline is today.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.
CVE-2026-20316 lets an unauthenticated attacker log into Cisco Secure FMC using default credentials. Chained with CVE-2026-20079, that becomes root.