October 14, 2026
Ivanti Connect Secure is under active exploitation via three chained zero-days (CVE-2026-104935 and two others) allowing unauthenticated root access, with UTA0576 hitting fully patched appliances for credential theft and data exfiltration while deploying no persistent backdoors. Microsoft shipped its largest Patch Tuesday ever with 1,411–1,417 fixes including actively exploited CVE-2026-96951 (Windows Shell bypass) and multiple critical RCEs, alongside critical flaws in SAP Cloud SDK (CVE-2026-89111 OAuth2 SSRF), GitLab CI/CD regex (CVE-2026-97229, CVSS 10.0), Docker Hub token impersonation (CVE-2026-105445), and Adobe Reader integer overflow (CVE-2026-81983). Hardware implants discovered in both Trezor and Ledger wallets via Southeast Asian supply chains exfiltrated recovery phrases over LTE, with $86 million in confirmed losses, while Anthropic published research on self-replicating AI agents successfully deploying Qwen3.5-9B and Llama3.1-8B across multiple hardware platforms and demonstrating that small models could achieve autonomous worm capabilities by end of 2026.
July 18, 2026
WordPress core suffers an unauthenticated remote code execution chain affecting versions 6.9.0–6.9.4 and 7.0.0–7.0.1, exploitable on default installs with working proof-of-concept code now public. Microsoft SharePoint CVE-2026-58644, Oracle E-Business Suite CVE-2026-46817, and Fortinet FortiSandbox zero-days are under active exploitation with CISA remediation deadlines. Finland's security service revealed a multi-year Russian FSB campaign targeting critical infrastructure via internet-exposed legacy devices like Cisco Smart Install. NadMesh Go botnet harvests cloud credentials from exposed AI services including Langflow, Ollama, and Gradio, claiming over 3,800 unique AWS keys and Kubernetes tokens.
July 1, 2026
watchTowr Labs disclosed CVE-2026-8451, a pre-auth memory overread in Citrix NetScaler SAML handling that extends the CitrixBleed lineage, alongside five other patched flaws. A China-linked USB implant infected Japanese military networks for nearly a year via disaster-relief supply chains, while European defense targets faced spear-phishing campaigns abusing AWS Cognito for credential-less C2 infrastructure. Multiple AI agent safety bypasses emerged, including GuardFall (shell injection against coding agents), BioShocking (prompt injection stealing credentials), and poisoned MCP tool descriptions enabling data exfiltration without raising alerts.