6 articles tagged
Amazon shipped six Corretto lines on 18 August 2026, four weeks after the July release. On five of them the OpenJDK update digits never move, so version-based inventory cannot tell patched from unpatched.
CVE-2026-9198 chains two Langflow API endpoints into unauthenticated remote code execution on default deployments. IBM rates it CVSS 9.8, CISA calls it exploited, and the fix is a version bump plus three configuration
CVE-2026-20253 is the first Splunk vulnerability ever added to CISA's KEV catalog: an unauthenticated RCE via the PostgreSQL sidecar. Here is the version matrix, the temporary workaround, and an hour-by-hour SOC runbook.
Oracle's largest-ever Critical Patch Update landed 1,400+ patches, ten CVSS 10.0 flaws and a PeopleSoft zero-day already exploited. How to triage by exposure before the October 2026 CPU.
On July 21, 2026, Gemini 3.5 Flash Cyber found 55 unique V8 vulnerabilities to Claude Opus 4.6's 36, then shipped only to governments and trusted partners. What the gated launch signals, and what AppSec teams can use
Microsoft's July 2026 Patch Tuesday fixed a record 570 flaws, including two zero-days already under attack. AI-assisted discovery is why the number exploded, and why the old triage signals stopped working.
