What this means for your clients: attackers went after a flaw in self-hosted GitLab code servers, and Alpine Linux stayed exposed after two upgrades, the second because the fix also depends on the Ruby that GitLab runs on. Alpine Linux upgraded GitLab after the fix shipped and was still exposed. On October 20 and 21 a new account sent crafted CI configurations and crashed GitLab workers eight times, getting partway through the exploit in four. Alpine found no evidence that co

What this means for your clients: if one laptop or web server on their private Tailscale network is taken over, the remote access rules they set for convenience may decide how far that foothold spreads, so update every device. Picture a client tailnet with a build box that runs Docker and a contractor laptop that can SSH into it. The laptop picks up an infostealer. Until this week, that one SSH rule with forwarding was enough, according to the researcher, to reach the build b

Update, 30 October: CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26. On October 28 it added the Linux kernel flaw CVE-2026-46300, and CISA's KEV entry says that flaw can be chained with both PHP bugs to implant PHP webshells and run commands as root. Dream Research, which calls the kernel flaw Fragnesia, reports a campaign that did exactly that: a custom PHP2Shell exploit plus Fragnesia rooted 25 Palo Alto Networks P

WSO2 fixed CVE-2026-5430 in May. In September, honeypots started catching forged admin JWTs. What the flaw allows, why patching does not end the question, and how to hunt the gap in KQL, Falcon CQL, Splunk and Kibana.