Security Feed
Curated advisories, threat briefs & field intel — attributed, dated & severity-tagged. Kept deliberately separate from my own writing.
1. Executive summary A credential-harvesting campaign tracked as FortiBleed has extracted configuration files from internet-facing Fortinet FortiGate firewalls and cracked the stored
1. Executive summary HPE Aruba published two security bulletins on 22 October 2026 covering multiple vulnerabilities in ArubaOS (AOS) and ClearPass Policy Manager (CPPM)
1. Executive summary A high-severity vulnerability in PHP has been patched by PHP.net and by multiple downstream vendors in a coordinated disclosure,
1. Executive summary Symantec has attributed attacks on a law enforcement agency, a naval shipbuilder and a military aircraft engine manufacturer in two NATO
1. Executive summary PHP2Shell covers two critical PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and both
1. Executive summary ESET documented an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access on 16 July 2025
1. Executive summary Atlassian's October 2026 security bulletin covers 75 unique CVEs across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and
1. Executive summary Two remote code execution flaws in KSMBD, the SMB server built into the Linux kernel, were disclosed on public mailing lists
1. Executive summary eMudhra, one of the few Indian certificate authorities whose root is trusted by major browsers, is withdrawing from the global SSL/
1. Executive summary On 2026-10-22 the Everest ransomware group listed "PWC" (country GB) as a victim on its leak site,
1. Executive summary GitLab patched CVE-2026-110264, an integer overflow in regular-expression compilation that allows an unauthenticated attacker to execute arbitrary code
1. Executive summary Unit 42 has published an analysis of OAuth-based phishing in which attackers obtain access and refresh tokens after a victim