Threat Advisories & Vulnerability Intelligence

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center (CVE-2026-21589)

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

CRITICALOctober 15, 2026

Cisco patches new Secure Email Gateway zero-day exploited in attacks

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.

MEDIUMOctober 14, 2026

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.

HIGHOctober 14, 2026

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server.

HIGHOctober 14, 2026

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation (CVE-2026-105134)

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

CRITICALOctober 14, 2026

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files (CVE-2026-76519)

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

CRITICALOctober 14, 2026

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random (CVE-2026-105133)

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

CRITICALOctober 14, 2026

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code (CVE-2026-0322)

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

CRITICALOctober 14, 2026

Zero-Days Lurk in Microsoft’s Overgrown October Patch Tuesday

The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.

MEDIUMOctober 13, 2026

Patch Tuesday – October 2026

Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still.

HIGHOctober 13, 2026

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Today is Microsoft’s October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

MEDIUMOctober 13, 2026

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions.

MEDIUMOctober 13, 2026

Cookie	Duration	Description
__cfduid	1 month	The cookie is used by CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
cookielawinfo-checkbox-advertisement	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Advertisement".
cookielawinfo-checkbox-analytics	1 year	This cookies is set by GDPR Cookie Consent WordPress Plugin. The cookie is used to remember the user consent for the cookies under the category "Analytics".
cookielawinfo-checkbox-functional	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	1 year	No description
cookielawinfo-checkbox-performance	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
pll_language	1 year	The cookie stores the language code of the last browsed page.

Cookie	Duration	Description
_clck	1 year	Used by Microsoft Clarity to store a unique user ID
_clsk		Microsoft Clarity analytics application
_ga	2 years	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_ga_L2RPNQR0FJ	2 years	This cookie is set by Google Analytics 4 to persist session state and count sessions for this property.
_gat_gtag_UA_44752404_1	1 minute	No description
_gid	1 day	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
_lfa	2 years	This cookie is set by the provider Leadfeeder. This cookie is used for identifying the IP address of devices visiting the website. The cookie collects information such as IP addresses, time spent on website and page requests for the visits.This collected information is used for retargeting of multiple users routing from the same IP address.
CLID	1 year	Microsoft Clarity
of.tracking	1 year
ofs
SL_C_23361dd035530_KEY		Outfunnel Campaign
SL_C_23361dd035530_SID		Outfunnel Campaign
SL_C_23361dd035530_VID		Outfunnel Campaign
SM	session	Used in synchronizing the MUID across Microsoft domains.
SRM_B	1 year 24 days	Identifies unique web browsers visiting Microsoft sites
vuid	2 years	This domain of this cookie is owned by Vimeo. This cookie is used by vimeo to collect tracking information. It sets a unique ID to embed videos to the website.

Cookie	Duration	Description
__oppref	30 days	Cookie used by OpenAI Ads to measure the performance of ads on ChatGPT.
_gcl_au	3 months	This cookie is set by Google Tag Manager and Google Ads to measure how well advertising performs and to attribute conversions to ad clicks.
ANONCHK	10 minutes	This cookie is used for storing the session ID for a user. This cookie ensures that clicks from advertisement on the Bing search engine are verified and it is used for reporting purposes and for personalization.
MUID	1 year 24 days	Used by Microsoft as a unique identifier. The cookie is set by embedded Microsoft scripts. The purpose of this cookie is to synchronize the ID across many different Microsoft domains to enable user tracking.
oaacct	30 days	Stores which EXEO OpenAI ads account referred the visit, so that conversions are measured in the right account. Set only after advertising consent.

Threat advisories that tell you what to do next

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center (CVE-2026-21589)

Cisco patches new Secure Email Gateway zero-day exploited in attacks

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation (CVE-2026-105134)

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files (CVE-2026-76519)

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random (CVE-2026-105133)

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code (CVE-2026-0322)

Zero-Days Lurk in Microsoft’s Overgrown October Patch Tuesday

Patch Tuesday – October 2026

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Get in touch