Data & infrastructure
-
Three Linux kernel flaws enter CISA KEV
CISA has added three Linux kernel vulnerabilities to its exploited-vulnerability catalogue, bringing evidence of real-world attacks into infrastructure patching decisions.
-
Orkes Conductor RCE flagged as exploited
A pre-authentication remote-code-execution flaw in Orkes Conductor is being exploited, exposing infrastructure used to coordinate microservices, workflows, and AI agents.
-
Softcat buys GDT in $1.05bn deal
Softcat has agreed to acquire US infrastructure provider GDT for $1.05bn, expanding its multinational capability across networking, data centres, AI infrastructure, cybersecurity, and technology procurement.
-
Check Point patches root-level management flaw
Check Point has patched a critical stack overflow that can allow an unauthenticated remote attacker to run arbitrary code as root on security-management and logging systems.
-
Nextcloud patches preview route to code execution
Nextcloud has patched a high-severity preview-processing flaw that can trigger a vulnerable ImageMagick component and create a route to arbitrary file writes and further server compromise.
-
BIND update fixes 14 DNS flaws
Internet Systems Consortium has disclosed 14 BIND vulnerabilities spanning resolver crashes, resource exhaustion, DNSSEC processing, cache integrity, and zone-transfer authentication.
-
Brevo breach spread malicious code downstream
A stolen Cloudflare credential allowed attackers to modify Brevo-hosted content at the CDN edge and push malicious code through JavaScript components embedded on customer websites.
-
Oracle ships 673 enterprise security patches
Oracle’s September Critical Security Patch Update contains 673 new patches spanning databases, middleware, business applications, analytics, Java, and other enterprise technology.
-
WSO2 API flaw faces active exploitation
A critical WSO2 authentication-bypass vulnerability patched in May is now being actively targeted with forged administrator tokens against exposed API-management systems.
-
Acronis patches exploited backup plugin flaw
Acronis has patched a privilege-escalation vulnerability affecting cPanel and Plesk backup integrations after detecting limited exploitation against cPanel deployments.