Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
October 19, 2026
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is
Application Security
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is still pending.
Drupal Patches Two Critical RCE Flaws, Warns Exploits Could Follow
Drupal patched critical RCE flaws CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List, warning exploits may be built within just hours or days.
Trojanized Rank Math SEO PRO 3.0.123 Backdoors WordPress Sites
Attackers tampered with Rank Math SEO PRO 3.0.123 packages, tracked as CVE-2026-111862, planting backdoors and stealing credentials from WordPress sites.
Apache Fixes 12 Kylin Flaws, Including Critical SQL Injection
Apache disclosed 12 Kylin flaws, led by critical SQL injection CVE-2026-64959, and separately fixed Airflow SSH and SFTP providers that skipped host-key checks.
Chrome 155 Patches 10 Flaws, Including Critical Prerender Bug
Google released Chrome 155.0.8059.84 with fixes for 10 flaws, including critical use-after-free CVE-2026-110922 in Prerender. No exploitation reported.
Progress Patches 12 High-Severity MOVEit Transfer Vulnerabilities
Progress fixed 12 high-severity MOVEit Transfer flaws, including authentication bypasses, in releases 2025.1.6 and 2026.0.4. No exploitation has been seen.
Backuply WordPress Plugin SQL Injection Enables Site Takeover
Wordfence disclosed CVE-2026-93953, a SQL injection in the Backuply WordPress plugin, with 600,000 installs, that can lead to rogue administrator accounts.
Vercel Ships Next.js 16.4.1 Fixing Two Critical RCE Flaws
Vercel released Next.js 16.4.1 and 15.5.28 to fix two critical unauthenticated remote code execution flaws and a high-severity denial-of-service bug in apps.
Ahsay Issues New AhsayCBS Hotfixes After Earlier Patches Failed
Ahsay released new AhsayCBS hotfixes after its August patches did not fully close CVE-2026-105133 and CVE-2026-105134, and CISA added both flaws to KEV.
curl 8.23.0 Fixes High-Severity HTTP/2 Flaw CVE-2026-92392
curl 8.23.0 fixes CVE-2026-92392, a High-severity HTTP/2 upload use-after-free that a researcher turned into code execution, plus 23 Low-severity CVEs.
Drupal Patches Two Critical RCE Flaws, Warns Exploits Could Follow
October 19, 2026
Drupal patched critical RCE flaws CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List, warning exploits may be built within
Trojanized Rank Math SEO PRO 3.0.123 Backdoors WordPress Sites
October 19, 2026
Attackers tampered with Rank Math SEO PRO 3.0.123 packages, tracked as CVE-2026-111862, planting backdoors and stealing credentials from WordPress sites.
Apache Fixes 12 Kylin Flaws, Including Critical SQL Injection
October 19, 2026
Apache disclosed 12 Kylin flaws, led by critical SQL injection CVE-2026-64959, and separately fixed Airflow SSH and SFTP providers that
Chrome 155 Patches 10 Flaws, Including Critical Prerender Bug
October 16, 2026
Google released Chrome 155.0.8059.84 with fixes for 10 flaws, including critical use-after-free CVE-2026-110922 in Prerender. No exploitation reported.
Progress Patches 12 High-Severity MOVEit Transfer Vulnerabilities
October 16, 2026
Progress fixed 12 high-severity MOVEit Transfer flaws, including authentication bypasses, in releases 2025.1.6 and 2026.0.4. No exploitation has been seen.
Backuply WordPress Plugin SQL Injection Enables Site Takeover
October 16, 2026
Wordfence disclosed CVE-2026-93953, a SQL injection in the Backuply WordPress plugin, with 600,000 installs, that can lead to rogue administrator
Vercel Ships Next.js 16.4.1 Fixing Two Critical RCE Flaws
October 15, 2026
Vercel released Next.js 16.4.1 and 15.5.28 to fix two critical unauthenticated remote code execution flaws and a high-severity denial-of-service bug
Ahsay Issues New AhsayCBS Hotfixes After Earlier Patches Failed
October 15, 2026
Ahsay released new AhsayCBS hotfixes after its August patches did not fully close CVE-2026-105133 and CVE-2026-105134, and CISA added both
curl 8.23.0 Fixes High-Severity HTTP/2 Flaw CVE-2026-92392
October 15, 2026
curl 8.23.0 fixes CVE-2026-92392, a High-severity HTTP/2 upload use-after-free that a researcher turned into code execution, plus 23 Low-severity CVEs.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.