$ briefings
Briefings
Periodic SITREPs that compress the week's vulnerability and exploit news into a single readable digest, sourced throughout.
57
editions
298
items covered
52
critical flags
Latest edition·November 2, 2026
Nov 2: Desk Briefing
November 2 desk briefing on the latest published coverage: Ivanti KEV remediation, GitLab and Drupal exploitation, Cisco patches, and November 1 disclosures.
1c1h2m
- CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV. Fixes for the full exploited chain are now out in 25.1.1.3 and 22.8R2.6.
- CISA added GitLab's CVSS 10.0 RCE to KEV after an attempted attack on Alpine Linux's instance. Federal deadline is Nov 1. Patch, then check for crashes.
- Drupal says CVE-2026-118539, a highly critical Commerce Core access bypass, is exploited in the wild. Update to 3.3.13 or 8.x-2.41 and audit your orders.
- CVE-2026-76418 lets unauthenticated attackers crash Cisco ASA and FTD firewalls via SSL VPN. Cisco confirmed active exploitation; patches released October 29.
Read full briefing →
$ archive
October 2026
Oct 31: Desk Briefing1 itemsOct 30: Desk Briefing3 itemsOct 29: Desk Briefing3 itemsOct 28: Desk Briefing3 itemsOct 27: Desk Briefing3 itemsWeek in Review: Oct 20-26, 20265 itemsOct 25: BlackX Bootkit, OpenAI VM Escape, Oracle Java CVSS 9.15 itemsOct 24: Brotli RCE in Node.js, HPE 72 CVEs, CISA Oct 26 Deadline5 itemsOct 23: Arista Zero-Day, Cisco 34 CVEs, Quest Breach5 itemsOct 22: GitLab CVSS 10, PHP2Shell Exploits, QPACK Crash5 itemsOct 21: PHP Patches RCE Pair, SafePay Advisory5 itemsOct 20: Plex2Shell Exploited, F5 NGINX OOB, Siemens ClickFix5 itemsWeek in Review: Oct 1-4, 20265 itemsWeek in Review: Oct 5-11, 20265 items
1h
1c2m
2m1l
1c2m
1c2m
1c2h2m
3c2m
1h4m
2c3m
1c4m
1c1h3m
2c3m
3h2m
1c2h2m
September 2026
Sep 29: Citrix KEV Deadline, PeopleSoft Live Campaign4 itemsSep 22: Cl0p Extorted, CrowdSec Source Code, BigCommerce4 itemsSep 21: REDCap 9.8 RCE, Keycloak IAM, Jade Sleet Backdoors5 itemsWeek in Review: Sep 14-20, 20266 itemsSep 18: Two CVSS 10 Zero-Days Active, Pixel Deadline Tomorrow5 itemsSep 17: Cisco SEG Deadline Today, GitLab Still Exploited5 itemsSep 16: Cisco SEG in KEV, Apple 200 Patches, Japan VPN Breach5 itemsWeek in Review: Sep 7-13, 20266 itemsSep 15: ScreenConnect Worm, Revolut Breach, GrayRabbit4 itemsSep 11: Cisco FMC, Fortinet Hit KEV; Sept. 12 Deadline5 itemsWeek in Review: Sep 1-6, 20265 itemsSep 7: N-central Exploited, MikroTik Hijacked4 itemsSep 3: Elasticsearch ML RCE, Seven KEV Additions, FalconFlank PoC4 itemsSep 2: SonicWall Zero-Days, Langflow Theft, Sality Down5 itemsSep 1: PaperCut KEV, McKesson Deadline, MAG Claim5 items
1h3m
4m
1c1h3m
1c3h2m
3c1h1m
2c1h2m
2c1h2m
3c3h
1c1h2m
2c1h2m
1c2h2m
2c2m
1c2h1m
1c1h3m
1h4m
August 2026
Aug 31: Elixir CVE Wave, ToolJet 9.9, Ransomware Claims Spike5 itemsWeek in Review: Aug 24-30, 20266 itemsAug 24: StackGres 9.9, GitLab RCE, Zimbra KEV6 itemsAug 17–23: Entra ID CVSS 10 KEV, Citrix, RedC27 itemsAug 17: Clop/GE/Philips, Azure claim, ShieldBreak unpatched5 itemsAug 3–10: Four KEV Additions, Metabase CVSS 107 items
1c4m
1c2h3m
1c1h4m
1c1h5m
5m
2c5m
July 2026
July 29: VMware trio, Cisco FMC KEV, Minnesota water attack7 itemsJuly 28 evening: Check Point MDS scope, vBulletin3 itemsJuly 28: TeamCity RCE, OpenWrt critical, AI sandbox escape6 itemsJuly 27 evening: Certighost PoC, KEV adds, Fairlife5 itemsJuly 27 desk: TELESHIM Telegram C2, supply chain cooldown4 itemsJuly 25 desk: Fastjson CVE-2026-16723, GitLab RCE PoC7 itemsWeek in Review: AI Ops, Certighost, M365 Failure9 itemsJuly 23-24 desk: AI agents weaponized, Clop active12 itemsJuly 21-22 desk: Three KEVs, SharePoint stripped11 itemsWeek in Review: KEV, Certificates, and the Old Debt5 itemsWeekend desk: wp2shell in the open, 27 DigiCert EV certs8 itemsDesk briefing: KEV +3 in 24 hours, Fairlife goes dark8 itemsDesk briefing: KEV grew by four, SonicWall deadline is Friday7 itemsDesk briefing: Gatekeeper cleared it, and that is the story5 itemsDesk briefing: the fire drill this week is on the routers5 itemsWeek in Review: AI Attacks Stopped Being Theoretical5 itemsDesk Briefing: the install-time gate is not the gate you think it is5 itemsWeek in Review: DPRK Broke Supply Chains, an LLM Ran Ransomware5 items
3c2h2m
3m
1c2h3m
2h3m
1c3m
1c6m
2h7m
12m
1c6h4m
2h3m
2h6m
2c1h5m
2c2h3m
5m
2h3m
1h4m
2h3m
1h4m
Archive begins June 29, 2026.