Security news aggregator

Latest coverage for Patch

Patch management fixes known software flaws before attackers exploit them, reducing intrusion risk; prioritize critical systems and verify deployment.

10 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

Patch is a software, firmware, or configuration update that fixes a defect, including a vulnerability an attacker could use to gain access, execute code, escalate privileges, or expose data. Patching reduces the exploitable attack surface across operating systems, applications, network devices, and embedded systems; it does not remove risk from unsupported or misconfigured assets, and updates can sometimes introduce compatibility or availability problems.

Effective patch management starts with an accurate inventory and vulnerability assessment, then prioritizes internet-facing systems, high-impact assets, and flaws known to be exploited. Organizations should test updates where practical, deploy them within defined time limits, verify installation, and retain rollback or compensating controls when immediate patching is unsafe. Monitoring vendor advisories and threat intelligence can identify urgent fixes, while documenting exceptions and coverage supports vulnerability management and audit requirements.

Showing 10 most recent headlines Filtered view

Attackers are exploiting the critical CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released. Threat actors have started exploiting a maximum-severity OS command injection flaw in Ivanti Sentry, tracked as CVE-2026-10520, that allows remote code execution with root privileges. “An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote […]

More from Security Affairs 12 Jun 2026, 5:57 a.m. Incident · 2 stories Actively exploited CVE-2026-10520 Compromise Critical Vulnerability CVE Exposure Flaw Patch Remote Code Execution Root Access Threat Actor Vulnerability

Attackers are exploiting the critical CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released. Threat actors have started exploiting a maximum-severity OS command injection flaw in Ivanti Sentry, tracked as CVE-2026-10520, that allows remote code execution with root privileges. “An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote […]

More from Security Affairs 12 Jun 2026, 5:57 a.m. Incident · 2 stories Actively exploited CVE-2026-10520 Compromise Critical Vulnerability CVE Exposure Flaw Patch Remote Code Execution Root Access Threat Actor Vulnerability
Security Affairs 1 month, 1 week ago

Fortinet patched a new critical FortiSandbox flaw

Fortinet patched a critical FortiSandbox vulnerability that could let unauthenticated attackers remotely execute commands via crafted HTTP requests. Fortinet released security updates to address several vulnerabilities affecting FortiSandbox, FortiOS, FortiProxy, and FortiPortal. The most severe issue, tracked as CVE-2026-25089 (CVSS score of 9.8), is an OS command injection flaw in FortiSandbox products. The vulnerability could […]

More from Security Affairs 11 Jun 2026, 9:51 p.m. Incident · 5 stories Actively exploited CVE-2026-25089 CVE Flaw Fortinet Patch Unauthenticated Vulnerability

Despite a 2025 patch, Russian-linked groups still exploit a WinRAR flaw (CVE-2025-8088) to deploy malware via phishing archives. CVE-2025-8088 is a path traversal flaw in WinRAR that lets an attacker write files outside the extraction directory using NTFS Alternate Data Streams. WinRAR fixed it in version 7.13 in July 2025. Nearly a year later, Trend […]

More from Security Affairs 11 Jun 2026, 1:34 a.m. Incident · 4 stories Actively exploited CVE-2025-8088 Advanced Persistent Threat CVE Exploit Fixed Flaw Malware Patch Phishing Russia

Veeam addressed a critical RCE vulnerability flaw in Backup & Replication that lets low-privileged domain users take control of backup servers. Veeam has patched a critical remote code execution vulnerability, tracked as CVE-2026-44963 (CVSS v4 Score of 9.4), affecting Backup & Replication version 12.x. The flaw could allow a low-privileged domain user to execute code on […]

More from Security Affairs 10 Jun 2026, 4:51 a.m. Incident · 3 stories CVE-2026-44963 Backup CVE Flaw Patch Remote Code Execution Vulnerability

A Linux kernel nf_tables bug lets local users gain root via use-after-free caused by a logic error; patch removes a single “!”. CVE-2026-23111 lives in nf_tables, the Linux kernel’s packet filtering framework. Exodus Intelligence researcher Oliver Sieber found the bug in early 2025 and chained it into a full local privilege escalation. The flaw was […]

More from Security Affairs 9 Jun 2026, 7:27 p.m. CVE-2026-23111 CVE Exploit Flaw Framework Linux Patch Privilege Escalation Root Access

Hackers exploit CVE-2026-3300 in Everest Forms Pro to inject PHP via form fields, creating rogue admin accounts. 29,300 attempts blocked. Researcher h0xilo submitted a flaw in Everest Forms Pro for WordPress, tracked as CVE-2026-3300, to Wordfence’s bug bounty program and earned $325 for it. WPEverest patched the flaw on March 18. Wordfence published a full […]

More from Security Affairs 9 Jun 2026, 2:11 a.m. Incident · 6 stories CVE-2026-3300 Bug Bounty CVE Exploit Flaw Patch PHP Wordpress
Trend Micro Research, News and Perspectives 1 month, 1 week ago

Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open

Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships.

More from Trend Micro Research, News and Perspectives 8 Jun 2026, 12:00 p.m. Incident · 4 stories Actively exploited CVE-2025-8088 CVE Flaw Patch Russia Ukraine