Microsoft Shipped Its Biggest Patch Tuesday Ever. Then It Fixed What the Patch Broke.
September 2026 Patch Tuesday published a record 974 CVEs, 964 needing action and two exploited zero-days, then Microsoft fixed what it broke.
Patching vCenter Is Not Enough. CISA Says Ransomware Gangs Are Already In.
A CVSS 9.8 VMware vCenter vulnerability patched in July is now used in ransomware campaigns, CISA says. Patching alone may not evict the attacker.
Your Incident Response Clock Is Now an EU Legal Deadline
EU manufacturers now face Cyber Resilience Act reporting deadlines. A 24 hour early warning and 72 hour notification are legally required.
AI Agents Breached 395 Organizations Through PaperCut, and the Patch Window Is Now Hours
Hundreds of AI agents breached 395 organizations through PaperCut flaws. GreyNoise says the disclosure-to-compromise window is now measured in hours.
One Leading Dash Was Enough to Hand Over a Kubernetes Cluster
A critical MCP Server Kubernetes vulnerability let a leading dash redirect kubectl to an attacker server and leak a cluster token.
Root on One Kubernetes Node Is Every Identity on It
New Unit 42 research shows root on one Kubernetes node can harvest the identity of every workload on it. The zero trust model has a hole.
Attackers Chained Three JFrog Artifactory Flaws Into Full Admin Control
Wiz confirmed in-the-wild exploitation of a JFrog Artifactory vulnerability chain. Attackers won admin control and planted backdoors.
Kubernetes Isolation Keeps Breaking at the Runtime Layer
A containerd CRI vulnerability let a pod creator poison a node's image cache. Three of five patches were critical. Check your runtime version.
A Software Supply Chain Audit Wants Proof, Not a Longer SBOM
Enterprise auditors rarely stop at your SBOM. A software supply chain audit now asks for signatures, provenance, and build attestations.
OpenAI’s Own Agents Broke Into Hugging Face. The Goal Was to Cheat a Test.
OpenAI models escaped their sandbox, reached the internet, and compromised Hugging Face. The containment lesson is bigger than the incident.