Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 1 / 51
Desks: 9

Data graphic: Ivanti Connect Secure 22.8R2.5 is no longer enough: CISA now lists 22.8R2.5 and prior as affected, and on 30 October it added CVE-2026-111357 CVSS 3.1, 7.0 High and CVE-2026-118527 no NVD or CVE.org record to KEV. The diagram shows the chain per Volexity: welcome.cgi path bypass CVE-2026-104935 , wu.cgi upload race, dsinvoked trusts cache CVE-2026-111357 , then root.

highExploits Cve 2026 111357

CISA Adds Two More Ivanti Connect Secure Flaws to KEV as Links in the CVE-2026-104935 Exploitation Chain

CVE-2026-111357 (root via dsinvoked) and CVE-2026-118527 join KEV on 30 Oct. CISA now lists 22.8R2.5 as affected, so the earlier patch is not enough.

Oct 31 · 4 min

Data graphic: dot plot of word error rate lower is better from NVIDIA's own model card, Nemotron 3.5 Transcribe against its closest rival on three separate tracks: 4.71 vs 4.94 for Qwen3-ASR-1.7B in English a near tie, 0.23 points , 4.62 vs 6.49 for Qwen3-ASR-1.7B in multilingual 1.87 points , and 10.98 vs 13.37 for Parakeet-TDT-0.6B-v3 in long-form 2.39 points . A callout notes the BF16 weights are 67.5 GB.

watchResearch Nvidia Nemotron 3 5

Nemotron 3.5 Transcribe Posts 4.71% English WER in Open Weights, and Fits a 32 GB GPU Only in 4-Bit

NVIDIA's open-weight speech model beats Qwen3-ASR and Parakeet on its own card, but BF16 weights are 67.5 GB. Which formats fit 16, 24 and 32 GB cards.

Oct 31 · 4 min

Data graphic: LFM3-1.7B vs Qwen3.5-9B. By Liquid AI's own figures, the 1.7B model wins three of six benchmarks against a roughly five-times-larger model, but trails by 17 points on GPQA Diamond 63.37 vs 80.40 and on RULER 128K long context 65.56 vs 87.11 .

watchResearch Liquid Ai

LFM3-1.7B vs Qwen3.5-9B: The 1.7B Model Wins on Tool Calls, Then Loses on Reasoning and Long Context

Liquid AI's own table shows LFM3-1.7B ahead on IFEval, BFCL and LiveCodeBench but 17 points behind on GPQA. Ollama 0.40.13 runs it on every desktop.

Oct 31 · 3 min

Data graphic: the EMBRACE attack path in the built-in browsers of AI coding tools, from a clickable file:// link through the embedded browser and a web worker to any local path. One click starts the read; Cursor was patched silently on 1 October, Copilot was fixed in 1.1.29, and Codex and VS Code remain unpatched.

highAI Security Agent Security

EMBRACE: Embedded Browsers in Cursor, Copilot, Claude Desktop, Codex and VS Code Leak Files and Run Code

Forever Security found the built-in browsers in five AI coding tools give pages powers a normal browser withholds. Codex and VS Code remain unpatched.

Oct 31 · 4 min

Data graphic: timeline of three Ollama releases. v0.40.11 on 24 Oct added speech on macOS and d3 models, v0.40.12 on 27 Oct added LFM3 and d1 on Apple and DFlash2, and the latest, v0.40.13 on 28 Oct, brought LFM3 to Linux and Windows, three days and then one day apart. Speech uses phonon, a 31M-parameter English model, and LFM3 is a 1.7B text model with a 256K-token context.

stableResearch Ollama

Ollama 0.40.11 to 0.40.13: An OpenAI-Compatible Speech Endpoint, d3 Decision Models, LFM3 and DFlash2

Ollama releases between 24 and 28 October add macOS speech over /v1/audio/speech, d3 decision models, LFM3 on Linux and Windows and DFlash2 drafts on MLX.

Oct 31 · 4 min

Data graphic: Magento PolyShell lands on CISA KEV, with a huge "471" for the stores Sansec says were compromised in one hour on 30 March. A stamp says ON KEV, added 27 October; the federal deadline is 10 Nov, CVSS is 9.3 critical, and Adobe fix APSB26-73 shipped 14 July.

criticalExploits Cve 2026 48356

CISA Adds Magento PolyShell Upload Flaw CVE-2026-48356 to KEV: Fixed Builds and How to Hunt for Webshells

The unauthenticated guest-cart upload flaw Sansec tied to 471 stores hacked in one hour in March is now on KEV, due 10 Nov. Fixed builds and checks.

Oct 31 · 4 min

Data graphic: a dark poster headed "Low score, exploited anyway", with a giant CVSS 2.7 score and a red "Exploited, on CISA KEV" stamp for the VMware ESX logging flaw CVE-2026-41709. Below are the KEV due date of 11 November and the fix, VMSA-2026-0006.

elevatedExploits Cve 2026 41709

CISA Adds a Low-Severity VMware ESX Logging Flaw to KEV, a Gap That Lets Admin Actions Go Unrecorded

CVE-2026-41709 scores only 2.7, yet CISA lists it as exploited: it lets an ESX admin act without leaving logs. Fixed builds, due 11 November.

Oct 31 · 3 min

Data graphic: editorial cover for CVE-2026-109437 in the Cognition agent server from CognicellAI: a huge 9.8 CVSS 3.1 Critical score beside a NO AUTH stamp, with stats of 9.2 under CVSS 4.0, no API authentication, and the fix in 0.13.0.

highAI Security Cve 2026 109437

Cognition Agent Server Before 0.13.0 Lets Anyone on the Network Run Shell Commands (CVE-2026-109437)

CognicellAI's self-hosted agent server shipped an unauthenticated API and a host-local shell backend by default. CVSS 9.8; upgrade to 0.13.0 and add auth.

Oct 31 · 3 min