Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 15 / 51
Desks: 9

Bricksforge CVE-2026-85097 poster: CVSS 9.8, exploited since 7 October 2026

highExploits Cve 2026 85097

Bricksforge CVE-2026-85097: Unauthenticated PHP Upload Under Attack Since 7 October

Bricksforge before 4.0.1 lets anyone upload PHP without logging in. Patchstack saw attacks from 7 October; CVSS 9.8. Who is exposed and what to check.

Oct 12 · 5 min

CVSS 10 poster: SonicWall SMA1000 pre-auth SSRF CVE-2026-102255, exploit attempts not confirmed compromise

criticalExploits Cve 2026 102255

SonicWall SMA1000 CVSS 10 Pre-Auth SSRF CVE-2026-102255 Draws Exploit Attempts Within Two Days

SonicWall SMA1000 flaw CVE-2026-102255 (CVSS 10) saw exploit attempts two days after disclosure. Attempts, not confirmed compromise; here is who must patch.

Oct 12 · 4 min

Data graphic: editorial cover for the FloorGen review, headlined "A free floor-plan editor AI agents can drive", with a large 149 for its MCP tools and three stats: $0 with no account to draw, 27 starting plans, 43 tools in the default core set.

stableResearch Floorgen

FloorGen Review: A Free Floor Plan Maker With No Sign-Up and an MCP Server

FloorGen is a free floor plan maker with no sign-up: 2D, 3D, code checks and exports, plus an MCP server that lets Claude or ChatGPT edit plans safely.

Oct 12 · 7 min

Dark poster: a Google ad leads through Bing and a compromised site to a fake Claude installer whose Copy button swaps the install command.

highAI Security Claude Code

Google ad that points to Bing leads to a fake Claude installer that swaps the command you copy

A Google ad listing bing.com led to a fake Claude download page whose Copy button pasted a hidden base64 URL piped to zsh, not the install command shown.

Oct 11 · 6 min

Data graphic: Ahsay ships hotfixes 10.3.4.45 and 9.15.2.70 after earlier patches fell short; attack chain from exposed AhsayCBS web app through auth bypass and command injection to SYSTEM.

highExploits Cve 2026 105133

Attackers chain two AhsayCBS flaws for SYSTEM webshells and a hidden Monero miner; Ahsay ships hotfix

Attackers chain AhsayCBS CVE-2026-105133 and CVE-2026-105134 for SYSTEM webshells and an XMRig miner. Ahsay shipped hotfixes 10.3.4.45 and 9.15.2.70 on 12 Oct after earlier patches fell short.

Oct 11 · 10 min

Data graphic: A timeline from 2015 to October 2026 showing four years-old flaws ProFTPD, BIND, Struts and Strapi added to CISA's KEV list on 2026-10-08, more than 11 years after the ProFTPD fix was merged on 2015-04-07. The federal due date is 2026-10-11.

highExploits Cisa Kev

CISA adds four old Struts, ProFTPD, BIND and Strapi flaws to KEV, tied to China-linked intrusions

CISA added Struts, ProFTPD, BIND and Strapi bugs to KEV on 8 Oct, due 11 Oct. Advisory AA26-281A ties them to China-linked actors; here is what to patch.

Oct 11 · 6 min