Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 11 / 51
Desks: 9

CVSS 10.0 stamp poster for GitLab CVE-2026-97229 with a No workaround stamp

criticalExploits Cve 2026 97229

GitLab CVE-2026-97229: CVSS 10.0 Remote Code Execution in the CI/CD Regex Compiler

GitLab CVE-2026-97229 is a CVSS 10.0 integer overflow in the CI/CD regex compiler. Rapid7 got code execution on 19.4.1. Upgrade to 19.2.8, 19.3.5 or 19.4.2.

Oct 15 · 5 min

Data graphic: a dark cover with a large 8.8 for the CVSS 3.1 score, rated Important. CVE-2026-103572: a trailing dot on .mcp.json. slipped past Copilot's protected-file check in Visual Studio. Fixed in 17.14.42 and 18.10.4; MSRC lists it as not exploited.

elevatedAI Security Cve 2026 103572

Microsoft Patches Copilot Prompt-Injection RCE in Visual Studio and SSMS (CVE-2026-103572)

Microsoft's October 13 patch fixes CVE-2026-103572: a trailing-dot filename let Copilot prompt injection overwrite .mcp.json in Visual Studio. CVSS 8.8, not exploited.

Oct 15 · 6 min

Poster: forged admin token via default JWT key in IBM MCP Context Forge, CVE-2026-53709, CVSS 9.8

highAI Security Cve 2026 53709

IBM MCP Context Forge's Default JWT Key Let Anyone Forge Admin Tokens (CVE-2026-53709)

MCP Context Forge up to 1.0.1 shipped a known default JWT signing key. With default admin settings, an unauthenticated attacker could gain platform admin. CVSS 9.8; fixed in 1.0.2.

Oct 14 · 7 min

Data graphic: OpenAI retires GPT-4o and GPT-4.1 API models on 2027-01-14, shown as a giant date. Five snapshots are retiring, the replacement is gpt-6-luna, and fine-tuning on gpt-6-luna is not supported.

elevatedResearch Gpt 6 Luna

OpenAI Retires GPT-4o and GPT-4.1 API Models on January 14, 2027: What to Do

OpenAI will shut down five GPT-4o and GPT-4.1 API snapshots on 2027-01-14. Here is the gpt-6-luna price table, what breaks, and the dates to hit.

Oct 14 · 6 min

Data graphic: PAN-OS CVE-2026-0322 root remote code execution, CVSS 4.0 High 8.6, stamped Exploited, on CISA KEV with a due date of 2026-10-17. No workaround is known.

highExploits Cve 2026 0322

PAN-OS CVE-2026-0322: Root RCE on Firewalls Now on CISA KEV

Palo Alto says CVE-2026-0322, an authenticated root RCE in the PAN-OS management interface, is under limited attack. CISA's KEV deadline is 17 October.

Oct 14 · 6 min

Data graphic: Cisco Secure Email Gateway flaw CVE-2026-76519, rated CVSS 9.8 Critical, stamped "Exploited, in CISA KEV". It is unauthenticated, needs File Reputation enabled, and has no workarounds.

criticalExploits Cisco

Cisco Secure Email Gateway Flaw Gives Attackers Root, and It Is Being Exploited

CVE-2026-76519 lets a crafted email attachment run commands as root on Cisco Secure Email Gateways with File Reputation on. Cisco confirms exploitation; no fixed 16.0 build.

Oct 14 · 6 min

Data graphic: dot plot of Gemini usage multipliers by plan, 1x with no plan, 2x AI Plus, 4x AI Pro

elevatedResearch Gemini Ai Ultra Pricing

Gemini App Limits Cut: Free Users Get Flash-Lite Only, and AI Plus Loses Gemini Pro

From 9 October Google limits free Gemini users to Flash-Lite and takes Pro from AI Plus. Here is what each plan keeps, and where Deep Think is still unclear.

Oct 14 · 4 min

Data graphic: a CVSS 9.8 stamp for two unauthenticated Langflow code-execution flaws among 25 fixed in 1.12.3

criticalAI Security Langflow

Langflow 1.12.3 Fixes 25 Flaws, Including Two Unauthenticated CVSS 9.8 Code-Execution Bugs

IBM's 2 October bulletin covers 25 Langflow CVEs, two of them unauthenticated 9.8 RCEs. Every release through 1.12.2 is affected; there is no workaround.

Oct 14 · 3 min