6 dispatches · latest 11 SEP 2026 · all keywords →
CERT Polska disclosed six RouterOS vulnerabilities found with GPT-5.5-cyber; two chain into zero-auth full device takeover when SSH is internet-reachable, both are on KEV with a Sep 13 due date, and the patched build scans your config for signs of compromise.
Five days after our last Chrome zero-day post, Google patched a second exploited V8 bug — rated Medium by the vendor with no vector of its own, and CISA added it to KEV the next day. Browser patching is a cadence problem now.
CVE-2026-86218 is a CVSS 10.0 pre-auth RCE in N-able's on-prem RMM appliance, fixed in 2026.3 Hotfix 4 (build 2026.3.1.14) and now on KEV with a September 11 due date. Hosted customers are patched; self-hosted ones need to move tonight.
A type-confusion bug in V8's Maglev compiler turns an ordinary sort() into arbitrary read/write on the JS heap. Fixed in 152.0.7977.82, actively exploited, and it's the sixth of these this year.
An actively-exploited zero-day in PaperCut NG/MF affects every supported version. The alert came from a university's forensics team, an emergency patch for v25/v26 shipped the next morning, hardened Release 2 for every branch followed by 10:08pm AEST on Aug 28, and it published two new CVEs plus concrete IOCs to hunt.
August Patch Tuesday shipped hundreds of CVEs, one of them an exploited zero-day in afd.sys — the fourth in four years.