New
What is your approach to managing thousands of edge devices?
Fleet management, updates, security patching and observability at the edge: what tools and practices have held up?
Topic
Vulnerabilities and patching
167 stories in the last 90 days · 1 community thread
In short
This topic tracks software vulnerabilities, including CVEs, zero-days and flaws being actively exploited, and the patches and advisories that follow. For buyers, the useful questions are how quickly a vendor discloses and fixes issues in its own products, and how well your tools help you decide which of many vulnerabilities to fix first.
Written by Techarda editors · Updated · How we work
Latest stories
The newest Vulnerabilities and patching stories from the last 90 days. Each one opens with our summary and a link to the original source.
Security
Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus . A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication ( CVSS: 8.6 High ). The most serious functions allow for full database read ( CVSS: 8.5 High ) and an insecure file…
Security
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments. The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound…
Security
Supply Chain Zero Days: Closing the Gap Between Publication and Detection
When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published
Security
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3 , the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction. Versions 26.2.3…
Security
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code.
Hybrid & Multicloud
When AI finds vulnerabilities faster than organizations can fix them
The gap between finding a flaw and using it is closing In April 2026, Anthropic’s Claude Mythos found a bug in OpenBSD that had gone undetected since 1998, in one of the most heavily audited codebases in the world. In a few weeks it found thousands of previously unknown vulnerabilities across major operating systems and browsers, wrote working exploits, and chained them together with little human…
Containers & Kubernetes
A patch only reduces risk when it runs in production
The patch was ready in days. It took months to ship. Why?I hear that question in nearly every customer conversation about vulnerability management. The honest answer is rarely “We didn’t know about it.” It’s “We knew, but getting it into production took longer than the exploit window.”That delay, the time between a patch’s release and it actually running in production across every exposed…
Security
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8 according to NVD and a CVSS v4.0 score of 9.5 according to the Citrix security bulletin CTX697096. The vulnerability allows unauthenticated…
Earlier in the last 90 days
- Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for KubernetesGoogle Cloud · 17 Oct 2026
- Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Rapid7 · 17 Oct 2026
- Friday Five: October 16, 2026 | Red HatRed Hat · 16 Oct 2026
- AI Coding Assistants: Trust Is the Attack SurfaceHarness · 16 Oct 2026
- Your Nexus images are already published. Now they're scanned too.CloudBees · 16 Oct 2026
- ARMORY CASTLE Exploits BeyondTrustGoogle Cloud · 16 Oct 2026
- VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?Snyk · 15 Oct 2026
- Introducing Evo Agentic AppSec: Security That Keeps Up With AI DevelopmentSnyk · 15 Oct 2026
- Open Source Security Signals | Q3 2026Red Hat · 15 Oct 2026
- AWS License Manager now supports license type conversions for Ubuntu Pro purchased through AWS MarketplaceAmazon Web Services · 15 Oct 2026
- From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)Rapid7 · 15 Oct 2026
- Unauthenticated SQL Injection In Channel Software WebAlliance eCommerceRapid7 · 14 Oct 2026
- TruConfidence: Why Your Patch Automation Can Finally Be AutonomousQualys · 14 Oct 2026
- How agencies manage tactical edge infrastructure at scale | Spectro CloudSpectro Cloud · 14 Oct 2026
- How Block is building AI-powered security with OpenAI technologyOpenAI · 14 Oct 2026
- How to patch application vulnerabilities without upgradingRed Hat · 14 Oct 2026
- Security Update: Next.js and React vulnerabilities (October 2026)Netlify · 14 Oct 2026
- Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)Tenable · 14 Oct 2026
- Patch Tuesday - October 2026Rapid7 · 14 Oct 2026
- Microsoft Patch Tuesday, October 2026 Security Update ReviewQualys · 14 Oct 2026
- Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)Rapid7 · 14 Oct 2026
- Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM GatewaysCheck Point Software · 13 Oct 2026
- CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabRapid7 · 13 Oct 2026
- October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical VulnerabilitiesCrowdStrike · 13 Oct 2026
- What’s old is new: Lightwell discovers novel zero-day vulnerability in core Java frameworkRed Hat · 13 Oct 2026
- Docker Hub security advisory: personal access tokens transferred during account-to-organization conversionsDocker · 13 Oct 2026
- Exploitability Needs Runtime Evidence: Understanding Runtime Vulnerability Reachability for ContainersQualys · 13 Oct 2026
- GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8GitLab · 12 Oct 2026
- AWS Security Hub now exports findings to S3 in CSV or JSON formatAmazon Web Services · 10 Oct 2026
- Friday Five: October 9, 2026 | Red HatRed Hat · 9 Oct 2026
- Why "secure by design" is the new standard for open sourceRed Hat · 9 Oct 2026
- Amazon RDS for Oracle now supports minor version upgrade prechecks and a new RDS event to help reduce patching downtimeAmazon Web Services · 9 Oct 2026
- The Zero-Day Blind Spot: Why Your Agentic SOC needs Retrospective Packet ReplayCisco · 9 Oct 2026
- Using on-premise Red Hat Lightspeed capabilities to monitor vulnerabilities and apply advisor remediationsRed Hat · 8 Oct 2026
- CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian ProductsAkamai · 8 Oct 2026
- CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian productsRapid7 · 7 Oct 2026
- Frontier models found the vulnerabilities. Only the attacker found the chains.Snyk · 7 Oct 2026
- Zero CVEs at delivery: Why container security belongs in the supply chainRed Hat · 7 Oct 2026
- How we replaced our host vulnerability scanner with the Datadog AgentDatadog · 7 Oct 2026
- Attackers Target AI Development Platform LangflowF5 · 7 Oct 2026
- Back to Basics: Insecure DeserializationFastly · 6 Oct 2026
- Elastic Stack 9.4.8 releasedElastic · 6 Oct 2026
- Elastic Stack 9.5.5 releasedElastic · 6 Oct 2026
- Elastic Stack 8.19.23 releasedElastic · 6 Oct 2026
- TeamCity 2026.2.1 and 2026.1.5 Are OutJetBrains · 5 Oct 2026
- How Nutanix Database Service Handles Oracle Database Patching: An Out-of-Place, Automated, and Reversible WorkflowNutanix · 5 Oct 2026
- Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitationSophos · 5 Oct 2026
- Security briefing: September 2026Sysdig · 5 Oct 2026
- Building zero trust networks with Red Hat AnsibleRed Hat · 5 Oct 2026
- What enterprises need to know about the Cyber Resilience Act and software supply chain riskRed Hat · 2 Oct 2026
- AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect itSysdig · 2 Oct 2026
- DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agentGitLab · 2 Oct 2026
Showing the newest 60 of 167. The feed archive lists every story by month.
What practitioners are discussing
Stories say what companies announced. These threads are where people who work with Vulnerabilities and patching compare notes.
Companies in these stories
The active companies with the most Vulnerabilities and patching stories in the last 90 days. It counts news coverage, not quality, market share or fit for your needs.
Related categories
Where Vulnerabilities and patching sits among the categories Techarda covers. Each hub shows who is active, and each guide sets out how to evaluate vendors.
Terms to know
Plain definitions of terms that come up in Vulnerabilities and patching stories, from the Techarda glossary.
Frequently asked questions
What is a CVE?
A Common Vulnerabilities and Exposures identifier is a public reference number for one known vulnerability, so vendors, researchers and tools can all refer to the same issue.
How should we decide what to patch first?
Severity scores alone produce too long a list. Combine them with evidence of active exploitation, whether the affected system faces the internet and how important it is to the business.
What is a zero-day?
A vulnerability that attackers know about or are exploiting before the vendor has a fix, so defenders have had no time to patch. Mitigations and detection carry the load until a patch arrives.
Stories are filed under topics automatically from their headline and summary, so the odd one may sit in the wrong place. Spotted one, or a topic we should add? Email engage@techarda.com. All topics.