Newly disclosed and actively exploited vulnerabilities: what’s affected, whether attackers are using it, and what to patch first, with a date on everything.
Start here: The Alert Tracker · Plex2Shell is being exploited: patch Plex, then assume compromise
A WAF won't fix this autumn's PHP, Java, WordPress or Atlassian flaws, but it can buy time while you patch. What ten major WAF vendors have published for each, where they're silent, and where a WAF can't help at all.
Some flaws will never get a patch, some don't have one yet, and some have one you can't install. How to find them, fence them, watch them and plan their exit.
Arista's tunnel decapsulation flaw has been on CISA's KEV list since June, and Arista says no software fix is planned. Find the exposed switches and fence them with ACLs.
A hijacked LiteLLM release pipeline pushed a credential stealer to PyPI and Docker for about two hours on 21 October. Rebuild on 1.106.2 and rotate secrets.
Unit 42 says Qilin and Inc affiliates are exploiting a May GlobalProtect bypass, in one case pivoting to vCenter and a domain controller's disk.
Two untested draft Sigma rules for Plex2Shell on Linux: shared objects written to Plex's Codecs folder, and Plex spawning shells, downloaders or known miners.
FBI, CISA, NCA and German police detail SafePay: old edge-device CVEs, legitimate tools, NAS backups reset to factory settings and phone calls to victims.
A four-bug Plex Media Server chain is planting miners. The fix shipped in August; exposed servers older than 1.43.3.10861 should be treated as compromised.
Microsoft links the ConnectWise Cloud Backup compromise to Storm-0940 and the ARTEX framework. Export your Entra logs before retention eats the evidence.
