A small office runs Nextcloud on one server, and staff edit spreadsheets in the browser without asking how. It works because of one optional app, added from the app store long ago, that downloads a copy of a document server and runs it on the same box. Most days nobody thinks about it. When the machine restarts, there is a short stretch before that bundled server is back, and during it the app's plain PHP file tries to start the server again with each request that comes in. C

Microsoft shipped CVE-2026-65660 in August as a moderate spoofing bug at CVSS 6.5. The record now reads remote code execution at 8.8, and CISA added it to KEV on 25 September with forensic triage required. If your farm deferred the August patch because the advisory said spoofing, here is what to hunt.

GitHub disabled two compromised actions-cool Actions in May but never cleaned their release tags. When the repos came back on 16 September, every workflow still pinned to a mutable tag resumed stealing CI secrets on its own. Here is how to hunt the reopen window in KQL, Falcon CQL, Splunk and Kibana.

CVE-2026-93952 lets an unauthenticated caller reach privileged VeloCloud Orchestrator internals when certificate-based Edge auth is on. CVSS 10.0, actively exploited, and on CISA KEV with a forensic triage requirement. Here is how to hunt it in KQL, Falcon CQL, Splunk and Kibana.

SHA pinning was supposed to freeze a reviewed plugin at one commit. Four major AI coding agents check out the pinned hash without verifying what landed. What Plugin4Shell allows, which agents are patched, and how to hunt it on developer endpoints.

A pre-authentication stack overflow in Check Point's login path gives an unauthenticated attacker root on Security Management Server, Multi-Domain, and Log Server. What it means for policy and log trust, how to patch, and hunt queries you can run today.