Dispatch log77 filed108 CVEs citedLast filed 18 SEP 2026
Enter the log5 on the patch-now boardNo newsletter · no tracking · no ads
The weekly 'top vulnerabilities by CVSS' email goes dark Monday. CISA's replacement signal chain is KEV + advisories + CVE.org — and BOD 26-04 replaces severity scores with a four-variable risk model your patch routine can run on too.
Your containers stop being a free elevator to the host — and you can prove it with one deliberate test. Audit the raw /var/run/docker.sock mounts, front them with Tecnativa's socket proxy (pinned v0.5.0), then userns-remap or rootless for structural isolation.
One spare switch port, one Docker container, and you find out exactly who is scanning your network — and when they touch something that shouldn't exist. Built around Cowrie 3.x and CISA's Sep 16 cyber-decoys guidance.
Insecure file permissions in Acronis's cPanel & WHM plugin and Plesk extension let a low-privilege local user escalate to root. Exploited in the wild in limited, targeted attacks; fixed builds are out now.
A single crafted request to an unauthenticated REST endpoint in Cisco Identity Services Engine bypasses the management interface entirely and lands at root. CVSS 10, actively exploited, no workarounds. CISA's federal due date is Saturday.
The next Orange Pi 'Zero' puts the Allwinner A733 (dual A76, hexa A55, RISC-V RT core, 3 TOPS NPU) into a postage-stamp board with Gigabit Ethernet, Wi-Fi 6, and a PCIe Gen3 x1 slot that finally gives the Zero line real storage. From $26.50; the 4GB tier is the one to buy.
Your cameras can't phone home or leak creds to the internet, and only your NVR can reach them — with four firewall rules on OPNsense (or UniFi) that take an afternoon. Verified against current docs, 2026-09-16.
CISA advisory ICSA-26-258-08 covers seven CVEs in the CareCam CM2507 IP camera (firmware v251211.1507). Headlined by unauthenticated live video over the network — and no fix exists, because CareCam hasn't answered CISA's coordination attempts.
CISA advisory ICSA-26-258-01 covers six CVEs across the entire Digital Watchdog VMAX DVR/NVR line — all versions affected. An unauthenticated request can hand over your admin credentials in plaintext, and a hard-coded credential scores 9.6.
CISA advisory ICSA-26-251-01: CareCam Pro / ANJIA AJL33PC0801 cameras ship with a hard-coded credential that authenticates the U-Boot bootloader — physical access means full device compromise, and the vendor hasn't answered CISA's calls.
A SQL injection in Cisco Secure Email Gateway's AsyncOS email parser lets an unauthenticated attacker run arbitrary commands as root by delivering a single crafted email. No login, no exotic ports — just SMTP. CISA added it to KEV on 2026-09-14 with a due date of 2026-09-17.
What is actively breaking, being exploited, or needs patching before you go to bed.
What attackers, researchers, governments and security organisations are doing that a self-hoster should understand.
The physical layer: SBCs, routers, appliances, embedded systems and chips — and what the hardware people actually buy means for their security.
Defensive procedures, drills, configurations, checks and scripts you can run yourself, tonight, on your own gear.