A cyberattack on BAE Systems has halted bankruptcy notices from federal courts, the Administrative Office of the US Courts said on Thursday. BAE says the incident is isolated to one system, and the office did not respond when asked if data was stolen.
Perspective Coverage
7 publishers
- Builder
- Builder 3%
- Operator
- Operator 71%
- Investor
- Investor 26%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence76
buildOne report1 publisher Two chained RouterOS SSH flaws give attackers admin on exposed MikroTik routers, CERT Polska says
CERT Polska disclosed MikroTrick, a chain of two RouterOS flaws that gives unauthenticated admin on routers whose SSH faces the internet. Attacks were already under way at disclosure. Reachable SSH is the one condition the chain needs.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
- Evidence72
- Adoption15
- Hype gap−10
- Incentives
- Not scored
- Confidence70
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), a PAN-OS management RCE it says is under limited exploitation. CISA gave federal agencies until October 17; exploiting it takes a valid login and network access to the management interface.
Perspective Coverage
5 publishers
- Builder
- Builder 8%
- Operator
- Operator 80%
- Investor
- Investor 12%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence80
buildOne report1 publisher Defused decoys logged exploit attempts on SonicWall's CVSS 10.0 SMA1000 flaw two days after disclosure
Defused researchers say first exploitation attempts reached their decoys on 8 October, two days after SonicWall disclosed its CVSS 10.0 SMA1000 flaw. The advisory, last updated 6 October, still says there is no evidence of exploitation.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher Huntress logged attacks on AhsayCBS's CVSS 10.0 chain three days after NVD published it
Attackers began exploiting a CVSS 10.0 AhsayCBS chain on October 7, three days after the CVEs published, per a DEV Community analysis. Teams with internet-reachable servers should confirm the exact build number now, because it decides whether they are exposed.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence58
Guest VMs can read host memory through Linux kernel flaw PwnEscape
Linux kernel flaw CVE-2026-99999 let pwn.ai's Paulos Yibelo read about 32 bytes of host memory per packet from Vercel's production sandboxes. Operators who host other people's VMs need the fix in the kernel the host itself runs.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+8
- Incentives50
- Confidence62
CISA added four exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS to KEV with an October 17 federal deadline. We would take the Cisco gateway first, then AhsayCBS servers already patched once, then PAN-OS.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 75%
- Investor
- Investor 5%
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence78
Cisco patched CVE-2026-76519, an exploited Secure Email Gateway flaw that gives unauthenticated attackers root through a crafted email attachment. Devices with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected.
Perspective Coverage
5 publishers
- Builder
- Builder 13%
- Operator
- Operator 76%
- Investor
- Investor 11%
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence78
Talos reports CVE volume up 105% on the year against 37% growth in CISA's KEV catalog
Cisco Talos counts more than 70,000 CVEs by the end of September, up 105% on a year earlier, while CISA's KEV catalog grew 37%. Its newsletter says the backlog of exploited bugs from older CVEs is where the patching work sits.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap−15
- Incentives
- Not scored
- Confidence50
Microsoft shipped a record 1,407 CVEs on October Patch Tuesday, including an exploited Windows Shell Mark of the Web bypass. The component's 2026 record argues for a standing slot in the monthly patch cycle.
Perspective Coverage
23 publishers
- Builder
- Builder 16%
- Operator
- Operator 68%
- Investor
- Investor 16%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+28
- Incentives
- Not scored
- Confidence72
buildOne report1 publisher Attackers are exploiting a 9.8 Check Point management flaw that lacks a final patch for every release
CISA added CVE-2026-93616, a 9.8-rated Check Point management flaw, to its Known Exploited Vulnerabilities catalog on September 22, 2026. A dev.to write-up says no final patch covers every release yet, so port exposure is the control.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
Each of the five NGINX flaws fixed on October 14 needs a directive the admin added
NGINX 1.30.6 and 1.31.7, released October 14, fix five flaws, three of them memory bugs that F5 scores 9.2 Critical on CVSS v4.0. F5 scores a fourth, in TLS session handling, at 8.3; it may let a forged session past client-certificate checks.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher CISA sets a three-day deadline on five old exploited flaws in self-hosted server software
CISA added five exploited flaws in BIND, ProFTPD, Struts, ONLYOFFICE and Strapi to its KEV catalog on 8 October, each due 11 October. All five run on self-hosted servers, so the work starts with an inventory and a compromise check.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence58
Drupal patches Field UI remote code execution flaw reachable through contributed modules
Drupal shipped fixes on October 14 for CVE-2026-108097, a critical Field UI remote code execution flaw, in 11.4.10, 11.3.19 and 10.6.19. The Security Team says core alone is not reachable, but contributed modules open several paths and at least one needs no login.
Reality
- Evidence72
- Adoption28
- Hype gap−10
- Incentives
- Not scored
- Confidence65
SAP fixed CVE-2026-89111, a maximum-severity OAuth2 SSRF in its Cloud SDK for Python, in a 20-flaw October 2026 update. A multi-tenant BTP app that lets outside input set tenant_subdomain can send its client credentials to an attacker until it is patched or allowlisted.
Perspective Coverage
4 publishers
- Builder
- Builder 24%
- Operator
- Operator 64%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence78
buildOne report1 publisher Naming a Kestra flow 'configs' slips past the auth filter to root RCE
CISA added Kestra's CVE-2026-49869 to its known-exploited catalog on September 2 at CVSS 10.0, after an auth-filter bug let unauthenticated callers run commands as root. Teams on affected Kestra OSS builds should upgrade to 1.0.45 or 1.3.21.
Reality
- Evidence45
- Adoption55
- Hype gap+10
- Incentives25
- Confidence50
Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
Perspective Coverage
10 publishers
- Builder
- Builder 15%
- Operator
- Operator 70%
- Investor
- Investor 15%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+8
- Incentives40
- Confidence78
Siemens publishes 17 ICS advisories with critical flaws in S7-1500 CPUs and Crossbow SAC
Siemens published 17 ICS advisories on Patch Tuesday, with critical flaws in Simatic S7-1500 CPUs, Industrial Edge and Ruggedcom Crossbow SAC. Some are patched; for others Siemens has issued only mitigations.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence60
GitLab fixed CVE-2026-97229, a maximum-severity flaw that could let remote attackers run code, in releases 19.2.8, 19.3.4 and 19.4.2. GitLab.com already runs the fix and Dedicated customers need do nothing, so the work falls on self-managed operators.
Perspective Coverage
7 publishers
- Builder
- Builder 26%
- Operator
- Operator 63%
- Investor
- Investor 11%
Reality
- Evidence85
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence82
Earlier coverage
- Honeypots log exploitation attempts against SonicWall SMA1000 flaw three days after patch
Security · October 9, 2026 · Confirmed7 publishers
- Flock becomes the CVE authority for its own license plate readers and cameras
Security · October 12, 2026 · Confirmed2 publishers
- CISA gives federal agencies until October 11 to fix five old flaws Flax Typhoon exploited
Security · October 9, 2026 · Confirmed3 publishers
- A GitHub poem edited 11 times keeps pointing infected servers to new command hosts
Build · October 12, 2026 · Confirmed2 publishers
- Ten agencies tie China-linked intrusions across several sectors to Integrity Technology Group
Security · October 8, 2026 · Confirmed13 publishers
- CISA's red team logged into a water utility's OT jump server with credentials from an FTP service
Product · September 7, 2026 · Confirmed3 publishers
- SAML role decides which NetScaler appliances Citrix's new RCE flaw can reach
Security · October 9, 2026 · Confirmed5 publishers
- MonsterCloud's owner is charged with passing off purchased ransomware keys as proprietary decryption
Security · October 7, 2026 · Confirmed10 publishers
- Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flaw
Security · October 6, 2026 · Confirmed15 publishers
- SonicWall patches a third pre-auth SSRF flaw in SMA 1000 gateways this year
Security · October 7, 2026 · Confirmed4 publishers
- FortiBleed keeps scanning exposed Fortinet firewalls as toll grows to 400,000-450,000 devices
Security · October 7, 2026 · Confirmed10 publishers
- SharePoint flaw CVE-2026-65660 came under attack within days of Viettel's technical write-up
Security · September 27, 2026 · Confirmed4 publishers
- CISA lists WSO2's forged-token bypass as exploited on thin public evidence
Security · September 25, 2026 · Confirmed4 publishers
- A Windchill RCE chain that never encrypts anything, and the June hunt window it opens
Security · August 20, 2026 · Confirmed7 publishers
- Three days from patch to probe: SAP Commerce Cloud RCE is already being hunted
Security · August 15, 2026 · Confirmed4 publishers
- Attackers chain two PaperCut flaws to lift LDAP and SAM credentials from school print servers
Security · September 5, 2026 · Confirmed3 publishers
- Third NetScaler zero-day hits SAML appliances already patched against the first two
Security · October 4, 2026 · Confirmed11 publishers
- NetScaler attackers tunnel into internal networks with a new Python proxy
Security · September 30, 2026 · Confirmed21 publishers
- OT coalition urges CISA to make every federal agency name an owner for OT security
Security · October 6, 2026 · Confirmed3 publishers
- Fortinet tells FortiMail admins to disable IBE while an exploited CVSS 9.8 flaw awaits fixes
Security · October 2, 2026 · Confirmed10 publishers
- Healthcare cybersecurity bill that lapsed in 2024 clears the Senate by unanimous consent
Security · October 5, 2026 · Confirmed2 publishers
- CISA sets a September 13 deadline for the MikroTrick RouterOS chain
Security · September 12, 2026 · One report1 publisher
- Google reports limited targeted exploitation of a Pixel cellular modem permission bypass
Security · September 16, 2026 · Confirmed6 publishers
- Cisco patches an ISE authentication bypass attackers used before the fix existed
Security · September 16, 2026 · Confirmed10 publishers
- Scanning for CVE-2026-82329 hit 406,000 attempts five days after JFrog disclosed it
Security · September 17, 2026 · Confirmed2 publishers
- CISA's seven new KEV entries put SonicWall gateways and Artifactory on one patch clock
Security · September 3, 2026 · Confirmed4 publishers
- Exploitation evidence puts two Artifactory auth flaws and a ScreenConnect privilege bug in KEV
Security · September 11, 2026 · Confirmed13 publishers
- Defender's SYSTEM race is back: ShieldBreak PoC says Microsoft's July fix never held
Security · August 15, 2026 · Confirmed5 publishers