Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
ShinyHunters Exploits PeopleSoft Zero-Day to Steal 454,600 Student Records from Nottingham’s Global Campuses
Over 450,000 Nottingham students had their records stolen because of a PeopleSoft exploit chain. Here is how legacy integrations create massive blind spots for enterprise cloud defense.
Beating the 38-Hour Exploit Window: The Fatal Risk of Lagging Vulnerability Metrics
With the median time to exploitation dropping to just 1.6 days, traditional database-driven vulnerability alerts are no longer fast enough. This article outlines why organizations must shift away from slow public registries toward real-time telemetry and automated asset inventory matching.
Analyzing the Tri-CVE Chain Permitting Full Administrative Hijacks on Ubiquiti Management Controllers
A detailed security analysis of the high-impact three-vulnerability exploit chain (CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910) affecting Ubiquiti UniFi OS Server, detailing how Nginx gateway routing mismatches enable unauthenticated remote code execution, active KEV exploitation trends, and mandatory post-compromise cleanup.
Seven Critical ColdFusion and Campaign Flaws Patched as Adobe Accelerates Release Cycles
Adobe has released security updates addressing multiple maximum-severity vulnerabilities in ColdFusion and Campaign Classic platforms, with high risks of exploitation, urging swift mitigation.
Beyond the Noise: Unpacking the HTTP/2 Bomb Vulnerability
A closer look at the high-severity CVE-2026-49975 flaw, its impact on large-scale web architecture, and the urgent need for consistent patching across vulnerable server environments.
When Disclosure Becomes a Death Sentence: The 24-Hour Exploit Clock Is Real
Cisco CUCM and Ivanti flaws weaponized within hours of disclosure. Microsoft's Patch Tuesday hit 206 CVEs. HTTP/2 bombs target telcos. SprySOCKS hides in kernel drivers. The exploit timeline has collapsed, and most security teams are not ready for what comes next.
The Campus That Got Hacked: How a Single Zero-Day Broke 450,000 Student Records
A forensic breakdown of the ShinyHunters attack on Oracle PeopleSoft — how a single unauthenticated flaw led to the largest education-sector breach of 2026.
Six Zero-Days Hit Patch Tuesday: Exchange Exploit, BitLocker Bypasses, and the HTTP/2 Bomb
Microsoft June 2026 Patch Tuesday fixes 200 vulnerabilities including six zero-days: an actively exploited Exchange Server spoofing flaw, two BitLocker physical-access bypasses (YellowKey and bitskrieg), the HTTP/2 Bomb DoS, and two Nightmare Eclipse privilege escalations.
New Path Traversal Vulnerability Discovered in Langflow AI Platform
CVE-2026-5027 is a critical path traversal vulnerability in Langflow (currently, active exploitation is observed). Immediate remediation (upgrade to 1.10.0 or isolate) is mandatory. The vulnerability highlights the urgent necessity for robust security practices in the fast-evolving AI development ecosystem.
The 24-Hour Pivot: How Ivanti's Sentry Appliances Became an Immediate Target
A critical Ivanti Sentry vulnerability, CVE-2026-10520, was exploited by threat actors within 24 hours of disclosure, demonstrating the extreme speed and risk of modern edge-infrastructure cyberattacks.
Federal Agencies Must Patch Check Point VPN Flaw Linked to Active Ransomware Campaign
CISA has issued an emergency directive requiring U.S. federal agencies to patch a critical vulnerability in Check Point Remote Access VPN and Mobile Access systems within three days. The flaw, tracked as CVE-2026-50751, allows unauthenticated attackers to bypass authentication and establish remote access connections. The vulnerability has been actively exploited in zero-day attacks since May 7, with at least one incident linked to the Qilin ransomware operation. Only systems using the deprecated IKEv1 key exchange protocol without machine certificate requirements are affected.
AI Accelerates Vulnerability Discovery: Record 206 CVEs on Patch Tuesday Signal New Normal
Artificial intelligence is transforming the cybersecurity landscape by dramatically accelerating the speed and scale of vulnerability discovery, as evidenced by Microsoft's June 2026 Patch Tuesday which addressed a record-breaking 206 vulnerabilities. This unprecedented volume signals that voluminous patch updates could soon become the norm.