Blog
What recent vulns mean on a real engagement.
Advisory impact, triage calls, and technical write-ups for authorized testing — grounded in public research, written for operators.
Showing 1–10 of 34.
KEV · Edge & VPN
Ivanti Connect Secure on KEV again: the second patch and the Integrity Checker trap
CISA added CVE-2026-111357 and CVE-2026-118527 to KEV on 30 Oct 2026 — the rest of the Ivanti Connect Secure chain with CVE-2026-104935. Operator triage for the 25.1.1.2 / 22.8R2.5 false finish, integrity-checker gaps, and factory-reset recovery.
KEV · Edge & VPN
Cisco ASA/FTD SSL VPN DoS on KEV: secondary auth, reload, and what not to claim
CISA added CVE-2026-76418 to KEV on 29 Oct 2026: unauthenticated DoS against Cisco Secure Firewall ASA/FTD Remote Access SSL VPN when secondary authentication is configured. Operator triage for edge VPN — patch trains, config checks, and no invented RCE.
KEV · Runtimes
Fragnesia on KEV: Linux CVE-2026-46300 after PHP2Shell, not instead of it
CISA added CVE-2026-46300 (Linux kernel Fragnesia) to KEV on 28 Oct 2026 and flags chaining with PHP2Shell CVE-2026-109618/109619 to implant webshells and run as root. Operator triage when PHP is patched but the kernel is not — and the reverse.
KEV · Web apps
Magento PolyShell on KEV: guest-cart uploads and post-patch hunt notes
CISA added CVE-2026-48356 (Adobe Commerce / Magento unrestricted file upload, PolyShell) to KEV on 27 Oct 2026. APSB26-73 shipped the -2026-jul trains in July. Operator triage for guest-cart REST uploads, media execution, and planted-file hunts.
KEV · Runtimes
Node2Shell / Brotli CVE-2026-111497: runtime triage beyond the PHP2Shell headline
CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder bundled with Node.js and other stacks. Fixed Node trains: 22.23.4 / 24.22.1 / 26.12.1. Operator triage for fetch clients, Express 5 body inflate, and EOL runtimes — without inventing RCE.
Web apps · Operator triage
GitLab CVE-2026-110264: unauthenticated regex RCE and self-managed triage
GitLab’s 21 Oct 2026 critical patch fixes CVE-2026-110264 — CVSS 10 unauthenticated RCE via integer overflow in the regular expression compiler. Self-managed instances must upgrade; GitLab.com is already patched. Operator triage plus compromise-assessment cues.
KEV · Edge & VPN
BeyondTrust Remote Support on KEV: self-hosted appliances vs already-patched SaaS
CISA urged patching CVE-2026-102764 in BeyondTrust Remote Support on 16 Oct 2026 and added it to KEV. Self-hosted appliances need BT26-05-RS; SaaS was patched earlier. Operator triage for Bomgar-era remote support on the edge.
Edge & VPN · Operator triage
SafePay #StopRansomware mid-engagement: edge CVEs, LOTL, and what not to attribute
CISA/FBI joint #StopRansomware advisory AA26-293A (20 Oct 2026) details SafePay initial access via edge CVEs and living-off-the-land tooling. Operator triage when the advisory drops mid-assessment — without inventing attribution.
KEV · Web apps
Collabora built-in CODE on KEV: Nextcloud office apps and the restart window
CISA added CVE-2026-110447 to KEV on 23 Oct 2026: OS command injection in Collabora Online Built-in CODE Server (richdocumentscode) when the bundled server is not running. Operator triage for Nextcloud document stacks — and why disabling the app is not enough.
KEV · Edge & VPN
VeloCloud Orchestrator on KEV: SD-WAN control-plane SQLi and pre-patch hunt notes
CISA added CVE-2026-114625 (Arista VeloCloud Orchestrator SQL injection) to KEV on 23 Oct 2026. Authenticated low-priv portal access can reach privileged internal functionality on on-prem VCO. Operator triage for SD-WAN control planes plus BOD 26-04 forensic cues.