Home / Insights

Insights

Threat watch and technology news.

The security holes attackers are using right now, from the US government's Known Exploited Vulnerabilities catalog, and the latest technology and security headlines. Refreshed every hour.

Check if you are exposed Cybersecurity services

Last refreshed: Nov 1, 2026 4:26 am EST

Threat watch

Newest actively exploited vulnerabilities

Each entry below is confirmed by CISA as being exploited in real attacks. If you run any of these products, patch now or talk to our security team.

CVE-2026-118527Ivanti · Connect Secure

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CV…

Added 2026-10-30 · US federal fix deadline 2026-11-13 · Details at NVD

CVE-2026-111357Ivanti · Connect Secure

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

Added 2026-10-30 · US federal fix deadline 2026-11-02 · Details at NVD

CVE-2026-97229GitLab · Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration,…

Added 2026-10-29 · US federal fix deadline 2026-11-01 · Details at NVD

CVE-2026-76418Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denia…

Added 2026-10-29 · US federal fix deadline 2026-11-01 · Details at NVD

CVE-2026-41709Broadcom · VMware ESX

Broadcom VMWare ESX Insufficient Logging Vulnerability

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

Added 2026-10-28 · US federal fix deadline 2026-11-11 · Details at NVD

CVE-2026-46300Linux · Kernel

Linux Kernel Missing Initialization of a Variable Vulnerability

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing…

Added 2026-10-28 · US federal fix deadline 2026-10-31 · Details at NVD

CVE-2026-48356Adobe · Commerce and Magento

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or s…

Added 2026-10-27 · US federal fix deadline 2026-11-10 · Details at NVD

CVE-2026-111497Google · Brotli

Google Brotli Unchecked Return Value Vulnerability

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a…

Added 2026-10-27 · US federal fix deadline 2026-11-10 · Details at NVD

CVE-2026-109618PHP Group · PHP

PHP Memory Corruption Vulnerability

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

Added 2026-10-26 · US federal fix deadline 2026-10-29 · Details at NVD

CVE-2026-109619PHP Group · PHP

PHP Stale Internal Request-State Vulnerability

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

Added 2026-10-26 · US federal fix deadline 2026-10-29 · Details at NVD

CVE-2026-114625Arista · VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and avail…

Added 2026-10-23 · US federal fix deadline 2026-10-26 · Details at NVD

CVE-2026-110447Collabora · Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Added 2026-10-23 · US federal fix deadline 2026-10-26 · Details at NVD

CVE-2026-106931EG Secure Solutions · SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Added 2026-10-20 · US federal fix deadline 2026-10-23 · Details at NVD

CVE-2026-96656Plex · Media Server

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

Added 2026-10-20 · US federal fix deadline 2026-10-23 · Details at NVD

CVE-2026-96655Plex · Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained w…

Added 2026-10-20 · US federal fix deadline 2026-11-03 · Details at NVD

Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov), public domain.

Technology and security news

Latest headlines

SecurityHackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear ScriptThe Hacker News · 2 h ago SecurityNetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET InjectionThe Hacker News · 2 h ago SecurityFBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto HeistThe Hacker News · 2 h ago TechnologyData centers are now a midterm issue, even in BrooklynTechCrunch · 7 h ago TechnologyApple CEO says the company doesn’t ‘want to ship AI for AI’s sake’TechCrunch · 12 h ago TechnologyJudge allows NAACP lawsuit over xAI data center pollution to move forwardTechCrunch · 12 h ago SecurityNorthflank security breach leads to abuse of customers' AI API keysBleepingComputer · 15 h ago TechnologyOpenAI reportedly lowers funding target for new roundTechCrunch · 17 h ago TechnologyFrom restaurant guides to payments, here’s how TikTok is building a super appTechCrunch · 18 h ago SecurityNew Android SMS of Death exploit can remotely crash unpatched phonesBleepingComputer · 18 h ago SecurityReddit to lock content behind logins to fight scrapersBleepingComputer · 19 h ago TechnologyI took two iPhones on vacation. The Duo won me over.TechCrunch · 19 h ago SecurityFrom Beginner to Bug Hunter: Learning Cybersecurity in the AI Era.BleepingComputer · 20 h ago SecurityChainalysis discloses data breach from "offensive agentic techniques"BleepingComputer · 20 h ago SecurityChainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity DataThe Hacker News · 21 h ago SecuritySyrian Hacker Gets Prison Time in US After Over a Decade on the RunSecurityWeek · 22 h ago SecurityAttackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root AccessThe Hacker News · Oct 31 SecurityA Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private ChatsThe Hacker News · Oct 31 TechnologyAnthropic VS code extension on Cursor backdoored for nearly 12 hoursArs Technica · Oct 30 SecurityCritical Linux kernel flaw allows remote root attacks on MPTCP serversBleepingComputer · Oct 30 SecurityPHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressSecurityWeek · Oct 30 SecurityIn Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data LeakSecurityWeek · Oct 30 SecurityPasskeys Are Better Than Passwords. But They Are Not Enough.SecurityWeek · Oct 30 SecurityBulletproof Host Virtualine Loses Its Domain to FBI SeizureSecurityWeek · Oct 30 SecurityFresh WordPress Vulnerability in Attackers’ CrosshairsSecurityWeek · Oct 30 TechnologyCode-execution flaw in UEFI firmware affects most servers on planet EarthArs Technica · Oct 27 TechnologyDisgraced eMudhra drops out of TLS business after using cert private key of 4Ars Technica · Oct 22 Technology333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext emailArs Technica · Oct 22 TechnologyEnterprises keep buying software upgrades that IT thinks will make things worseArs Technica · Oct 21 SecurityWidespread PHP Flaw May Cause Many Site Outages TodayKrebs on Security · Oct 21

Headlines link to the original publishers. Urbnix is not affiliated with these publications.

Markets

Tech stocks, markets and commodities

CommoditiesBangladesh forms wage board as garment protests turn violentInvesting.com · 1 min ago Tech stocksBinance resumes withdrawals following $6.3 billion hack, says 90% of stolen user assets are coveredCNBC Technology · 38 min ago Tech stocksCompanies promised AI gains— here's how the payoff showed up in earningsCNBC Technology · 3 h ago CommoditiesOPEC+ set to hold December oil output steady, Reuters reportsInvesting.com · 8 h ago CommoditiesCiti sees European gas prices rising in 2027 as Middle East risks spur price gainsInvesting.com · 10 h ago CommoditiesIranian envoys meet Qatari mediators as threat looms of US strikes after midtermsInvesting.com · 10 h ago CommoditiesChevron Raises Exploration Spending By 50%OilPrice.com · 10 h ago CommoditiesU.S. Intelligence: China Could Put Laser Weapons in Space by 2030OilPrice.com · 12 h ago CommoditiesOPEC+ set to keep production targets unchanged in December, source saysInvesting.com · 13 h ago MarketsMy abusive ex-husband promised $20,000 for our kids’ education. Now he refuses to pay. Is he legally obligated?MarketWatch · 13 h ago Tech stocksSpaceX loses bid to toss NAACP lawsuit over Memphis data center air pollutionCNBC Technology · 13 h ago Tech stocksOpenAI pares fundraising goal, now seeking up to $20 billion in latest roundCNBC Technology · 13 h ago Markets‘Showy jewelry and fancy cars hold no appeal’: We have a 99% chance of outliving our life savings. Why not spend it all?MarketWatch · 14 h ago MarketsThis is where most people go wrong in their 30s and 40sMarketWatch · 14 h ago MarketsWe’re in our 70s. Should we pay off our 2.5% mortgage — or put the money in a high-yield savings account?MarketWatch · 14 h ago CommoditiesJackdaw Approval Sparks Fierce Debate Over Britain's Energy FutureOilPrice.com · 14 h ago Markets‘He was heartbroken’: My husband’s kids abandoned him when he was dying. Was he right to leave everything to me?MarketWatch · 14 h ago MarketsIs it curtains for COLA? Saving Social Security could mean changing the cost-of-living adjustment.MarketWatch · 15 h ago CommoditiesDARPA Backs Project to Measure AI Energy Use at Every Stage of the WorkflowOilPrice.com · 16 h ago Tech stocksStocks started the week with promise but ended in despair. Our take on the big reversalCNBC Technology · 18 h ago

News headlines only, for information. Not investment advice. Urbnix is not affiliated with these publications.