Articles
Long-form writing on tech, culture, and the edges of the internet.
Three moderate CVEs chain to root
An Ivanti Connect Secure auth bypass, file upload, and privilege escalation chain to unauthenticated root. Patch the combined release, not just one CVE.
CISA flags exploited GitLab and Cisco flaws
CISA added a CVSS 10.0 GitLab RCE and a Cisco ASA/FTD firewall DoS to its KEV catalog after active exploitation, with a November 1 patch deadline.
CISA gives agencies until November 6 to patch WordPress
CISA added WordPress Core flaw CVE-2026-119977 to its KEV catalog after a TOCTOU race in the upgrade process enabled unauthenticated code execution.
Postman installs plugins nobody requested
Postman's desktop app auto-installed agent plugins, a CLI and an MCP connection into Codex and Claude Code, and self-approved a Codex hook trust record.
Unreleased Claude built five working exploits, all now patched
An unreleased Claude model chained bugs into five working exploits across Chrome, Safari, Android, Windows, and Linux; all vendors have since patched.
Attackers weaponize Siemens IoT2050 flaw to deploy botnet
Attackers are weaponizing CVE-2026-58115, a CVSS 10.0 missing-auth flaw in Node-RED on Siemens IoT2050 devices, to deploy Linux bots and persistent backdoors.
Barracuda patches two chainable root flaws in email gateways
Barracuda patched two ESG flaws, CVE-2026-116606 and CVE-2026-111560, that chain to root access; exploitation requires admin-interface access, so patch and lock it down.
CryptoPayment Gateway pulled in August, still no patch
CVE-2026-81648 is a CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin, under active exploitation with no patch; remove it and rotate wallet keys.
KeyDrift malware steals Cisco SD-WAN encryption keys
Cisco Talos details KeyDrift, malware that used the CVSS 10.0 CVE-2026-20127 flaw to copy SD-WAN encryption keys from compromised Catalyst controllers.
Ubuntu still has no patch for CVSS 9.8 kernel flaw
CVE-2026-98432 is a CVSS 9.8 remote root flaw in the Linux kernel's TCP code. Debian patched it October 16; Ubuntu still has no fix two weeks on.
Linux TCP Flaw Exposes MPTCP Listeners
CVE-2026-98432 is an IPv4 TCP use-after-free with a demonstrated root exploit against Linux servers using MPTCP listeners.
LXD Flaw Enables Keyless Client Impersonation
CVE-2026-112816 let remote attackers impersonate trusted LXD and MicroCloud clients without possessing their private keys.