Latest cybersecurity reporting from selected sources.

US government agencies have until July 19 to patch two critical Fortinet vulnerabilities

New CISA directive tells federal agencies to patch by real-world risk, not CVSS severity scores

CISA added CVE-2026-20131 to its KEV catalog as it is being used in ransomware campaigns

A high-severity security flaw in the Gogs Git service is being actively exploited, leading to remote code execution

The US cybersecurity agency has added the critical flaw to its Known Exploited Vulnerabilities list

One US cybersecurity leader described the short-term extension of the Cybersecurity Information Sharing Act as a “temporary patch” and called for a long-term solution

CISA has demanded federal agencies patch a zero-day vulnerability affecting Samsung devices used in LandFall spyware attacks

Sysadmins are urged to patch WSUS vulnerability CVE-2025-59287 as soon as possible, with federal agencies required to update by November 14

The US Cybersecurity and Infrastructure Security Agency (CISA) has added five new flaws in Ivanti and VeraCore products to its Known Exploited Vulnerabilities catalog

CISA has added five more CVEs into its known exploited vulnerabilities catalog

CISA has told federal agencies to patch a critical GeoServer GeoTools vulnerability under active exploitation

CISA’s advisory provides mitigations for vulnerabilities in ICS products used in critical infrastructure industries like energy, manufacturing and transportation

Apache flaw can enable remote command execution

Zero-day was linked to malicious Pinduoduo apps

CISA has added the bug to its Known Exploited Vulnerabilities (KEV) list

CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog

Alert explains how misconfigured authentication allowed hackers in

Another nine bugs added to catalog of known exploited vulnerabilities

Another eight bugs added to exploited vulnerabilities catalog