-
Microsoft ties the ConnectWise compromise to agentic AI, and the AI-accelerated password spray produced zero successful logins
Microsoft says a China-state-aligned actor used an open-source agentic AI framework to accelerate the campaign behind the ConnectWise compromise, and the part the AI accelerated produced 151,000 failed…
-
PHP fixed php2shell in four branches, its finders say it reaches back to PHP 5.4, and one record calls the rest unaffected
PHP’s two critical remote code execution fixes shipped on schedule for the four supported branches, while the researchers who found them say nearly every PHP version back to…
-
CISA gives SiteGuard’s exploited WAF flaw three days and a forensic triage, and the record still says local access only
CISA added CVE-2026-106931 to its catalog on October 20 with a deadline of Friday, October 23, while the record’s only scores still describe an attacker who is already…
-
Plex’s widely exploited takeover chain is four records scored 4.3 to 7.2, on two federal deadlines
CISA added all four Plex Media Server flaws to its catalog on October 20, gave two of them until Friday and two until November 3, and NVD’s machine-readable…
-
Every Bp Premier install shared one SQL Server admin password, and its two records disagree on who can reach it
CI-ISAC scored it 9.6 adjacent-network with scope change; VulnCheck scored it 9.8 network with scope unchanged. Two opposite judgments, 0.2 apart.
-
PHP reserved the right to patch early if the details leaked, the details leaked, and the release time did not move
PHP’s advance notice for two CVSS 9.2 flaws names no CVE, no component and no versions; the identifiers in every advisory today are in no published record.
-
Oracle’s 1,076 new CVE records all cite one page, and it is still the October 15 pre-release announcement
Every record in Oracle’s October Critical Patch Update, including a 9.8 unauthenticated takeover in E-Business Suite, lists one reference — a page that carries no CVE IDs and…
-
A2A and MCP both shipped a task store called InMemoryTaskStore that answers any caller who knows a task ID
Two agent protocols, two reference SDKs, two languages, two reporters — and the same class, with the same name, missing the same check. What happened On October 20,…
-
Apache marks a CouchDB 9.3 as under active attack, and CouchDB’s release notes file the fix under Tests/CI/Builds
CouchDB withheld six vulnerability descriptions for seven days to buy patching time, and the most severe one arrived carrying a machine-readable marker, unsupported by any Apache prose, that…