The weekly patch briefing
Each week: what shipped, what broke, what to hold, and which AI attacks are being exploited, all with sources.
Weekly patch briefing
What shipped, what broke, what to hold
Coming soonNewsletter signup opens soon
Coming soonReader stats
Archive
Coming soonFirst issue
Recent coverage
- Cisco Secure Email Gateway: exploited critical arbitrary file write via email attachment (CVE-2026-76519)
- Citrix NetScaler ADC/Gateway: exploited DoS in SAML configs (CVE-2026-88779)
- Fortinet FortiMail: exploited critical path traversal in IBE (CVE-2026-104286, FG-IR-26-175)
- Microsoft October 2026 Patch Tuesday: exploited Windows Shell MotW bypass (CVE-2026-96951)
- Oracle October 2026 CPU: not yet released (scheduled Oct 20, 2026)
- Palo Alto PAN-OS: exploited authenticated RCE in management interface (CVE-2026-0322)
- SAP October 2026 Security Patch Day: four Critical notes
- VMware/Broadcom October 2026: no verified critical security release; vCenter 9.1.x upgrade data-loss advisory
- Windows 11: Remote Desktop fails for non-admin users (0xC000000D) on hosts with Administrator protection, still open after October 2026 updates
- Blind prompt injection against exposed AI agent frameworks, observed in the wild (Wiz honeypots)
- LiteLLM MCP auth bypass (CVE-2026-59822) exploited in the wild; on CISA KEV since Sept 2, 2026
- LiteLLM MCP test-endpoint command injection (CVE-2026-42271) exploited to drop cryptominers