Mobile devices have become critical components of modern business infrastructure. Employees use smartphones to access corporate email…

Daniel Knight, CEO at Vulnetic

Four security flaws in LG smart TVs could allow attackers to bypass authentication, create privileged accounts, and execute operating…

TL;DR Ivanti disclosed CVE-2026-104935 on October 13, 2026, and confirmed the flaw is already exploited in the wild. The Ivanti Connect Secure vulnerability lets a remote, unauthenticated attacker…

At a glance Actor UTA0576, an unknown threat actor tracked by Volexity Activity Zero-day exploitation of an Ivanti Connect Secure VPN, then credential theft and data exfiltration Targets One Volex…

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. 

TL;DR Microsoft’s October 2026 Patch Tuesday fixes 1,414 vulnerabilities, including 78 rated critical, making it the company’s largest release yet. Three zero-day vulnerabilities are a…

The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.

Palo Alto Networks recently disclosed a critical zero-day vulnerability actively exploited against enterprise firewalls. The security flaw allows authenticated adversaries to execute arbitrary com…

TL;DR BeyondTrust disclosed a critical BeyondTrust Remote Support vulnerability (CVE-2026-102764) on October 15, 2026, that is actively exploited in the wild. Suspected PRC-nexus espionage actors …

Google and major media publishers love to frame ad blockers as the villains of the internet. We’ve all seen the pop-ups: “Ad blockers hurt…

1. Incident Overview & Global Impact Timeline

TL;DR Trend Micro’s Zero Day Initiative (ZDI) posted details of several unpatched Linux kernel vulnerabilities to the public kernel mailing list on October 22, 2026. Two KSMBD flaws carry a …

I have a WordPress project running on PHP 8.3.6, and on Wednesday the version I need to be on became 8.3.36. That is the whole of my…

The Zero Day Initiative (ZDI) team at Trend Micro recently experienced an operational mishap. Specifically, researchers inadvertently copied several confidential vulnerability reports to the publi…

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

PHP2Shell is a vulnerability chain in PHP where an out-of-memory bailout can leave behind corrupted request state. Under the right server…

Why security teams should prioritize patching remote-support appliances and investigating suspicious file activity

One vulnerability we recently came across really highlights how dangerous memory corruption can become in a web application.