13 articles
Apple's September 28, 2026 point releases patch CVE-2026-86950, a CoreGraphics out-of-bounds write that may have been exploited in a highly targeted attack. Install iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, or Sequoia 15.8.1.
WordPress 7.1.2 patches critical CVE-2026-87902. Attackers started probing within hours. How personal and small-site owners should update today and confirm the version.
Google's September 2026 Pixel Update Bulletin flags CVE-2026-58704, a High modem elevation-of-privilege issue with limited targeted exploitation. Install the update and confirm security patch level 2026-09-05.
Microsoft's September 8, 2026 updates include two exploited local privilege bugs plus Office Preview Pane risks. Check for updates, reboot, and confirm you are current.
MikroTik and CERT Polska warn that the MikroTrick RouterOS chain is being exploited when SSH is reachable from the internet. Update to a fixed build, then check Flagged status, logs, and unknown users.
Google patched an actively exploited V8 bug in Chrome 152.0.7977.82/.83. Update on your computer, relaunch, and confirm chrome://version before you assume you are done.
Public exploit code is circulating for CVE-2026-62911, Shadowserver still sees about 22k internet-facing unpatched servers, and Exchange 2016/2019 ESU ends in October 2026.
Ubiquiti's August 2026 advisory covers 22 UniFi vulnerabilities. Here are the affected products, fixed versions, real risks, and a practical update checklist.
CVE-2026-64531 is a local privilege escalation in the Linux Open vSwitch datapath with a public PoC. Who is exposed, which stables are fixed, and what to do today.
Critical unauthenticated RCE (wp2shell) hits WordPress 7.0.0–7.0.1 and 6.9.0–6.9.4. What the CVEs mean, which versions are fixed, and what SMBs should do today.
Microsoft's 663-CVE July 2026 release reflects AI-assisted vulnerability discovery. What MSPs and SMBs should change in triage without freezing from volume anxiety.
A practical way to rank vulnerability work using exposure, exploitation evidence, business impact, and change risk instead of CVSS alone.
CVE-2024-3094 hit rolling Linux distros hard. Here is what happened, who was exposed, and the checks SMB teams should run.
