INTELLIGENCE BEAT31 Briefs

Cybersecurity Advisories

31 Briefs

Critical CVE disclosures, active exploits, hypervisor bugs, and vendor patches

Filter:

CISA7 Google4 Amazon3 Cisco3 Microsoft3 GitLab2 NVIDIA2 Anthropic1

GitLabAnalysis1 min read

GitLab patches critical regex compiler integer overflow RCE flaw

What happened.GitLab released emergency security updates for a maximum-severity remote code execution flaw in its regular expression compiler. The defect affects all Community and Enterprise editions across twelve years of releases.

Why it matters.Self-managed GitLab servers operate at the center of enterprise deployment pipelines and maintain direct access to proprietary source code and production credentials. Organizations running vulnerable self-hosted instances must apply the vendor maintenance releases immediately to prevent perimeter breach and lateral compromise.

↳Continues storyline: GitLab patches critical CI/CD compiler remote code execution flaw

Read Full Brief →

Source:GitLab Security

All Stories30 stories

GoogleAnalysis1 min read

Node.js patches critical Brotli decoder buffer overflow vulnerability

What happened.The Node.js project published emergency security updates across all active release lines to patch a critical out-of-bounds write buffer overflow vulnerability within the bundled Google Brotli compression decoder.

Source:GitHub Security Advisories

CISAAnalysis1 min read

CISA adds exploited Palo Alto Networks PAN-OS management flaw to KEV catalog

What happened.CISA added an actively exploited remote code execution vulnerability in the Palo Alto Networks PAN-OS management interface to its Known Exploited Vulnerabilities catalog.

Source:CISA Known Exploited Vulnerabilities

AmazonAnalysis1 min read

Amazon Web Services patches CI/CD serverless toolchain privilege escalation flaw

What happened.Amazon Web Services issued security bulletin 2026-141-AWS detailing a resolved privilege escalation vulnerability in the AWS CI/CD toolchain for serverless applications.

Source:AWS Security Bulletins

CISAAnalysis1 min read

CISA and AWS issue urgent warnings over critical PHP2Shell remote code execution

What happened.CISA and Amazon Web Services published urgent security advisories warning organizations to patch two critical memory corruption vulnerabilities in core PHP that enable unauthenticated remote code execution.

Source:CISA

NVIDIAAnalysis1 min read

NVIDIA debuts OpenShell and Sentry for hardware-enforced AI agent governance

What happened.NVIDIA released the open-source OpenShell reference runtime alongside NVIDIA Sentry software to govern autonomous enterprise artificial intelligence agents directly in hardware.

Source:NVIDIA Blog

↳Continues: NVIDIA opens Vera Rubin architecture specifications to the Open Compute Project

CISAAnalysis1 min read

CISA adds Plex2Shell remote code execution exploit chain to Known Exploited Vulnerabilities catalog

What happened.CISA added four chained vulnerabilities impacting Plex Media Server to its Known Exploited Vulnerabilities catalog after confirming active exploitation by threat actors in the wild.

Source:CISA

OpenAIAnalysis1 min read

OpenAI launches Patch the Planet to secure open-source code with AI

What happened.OpenAI introduced Patch the Planet under its Daybreak cybersecurity framework to help open-source maintainers detect and remediate critical software vulnerabilities before public exploitation.

Source:OpenAI

↳Continues: CISA and AWS issue urgent warnings over critical PHP2Shell remote code execution

CiscoAnalysis1 min read

Cisco releases critical security advisories for Expressway RCE and Snort 3 engine

What happened.Cisco published urgent security advisories addressing a maximum-severity remote code execution flaw in Cisco Expressway Series collaboration gateways alongside multiple critical fixes in the Snort 3 engine.

Source:Cisco Security Advisories

AmazonAnalysis1 min read

Amazon Web Services patches SageMaker Python SDK bucket ownership verification flaw

What happened.Amazon Web Services released security bulletin 2026-142-AWS detailing a resolved bucket ownership verification vulnerability in the Amazon SageMaker Python SDK.

Source:AWS Security Bulletins

CISAAnalysis1 min read

CISA and FBI issue joint advisory on SafePay ransomware targeting critical infrastructure

What happened.CISA, the FBI, and allied cyber agencies published joint advisory AA26-293A detailing active intrusion campaigns conducted by the SafePay ransomware group against critical infrastructure organizations.

Source:CISA

GoogleAnalysis1 min read

Compromised eMudhra intermediate CA keys trigger emergency browser and runtime blocks

What happened.Browser vendors and runtime maintainers released urgent security updates to distrust eight intermediate certificate authority keys operated by eMudhra after private keys with near-zero entropy were exposed.

Source:Google Cloud Security Bulletins

MicrosoftAnalysis1 min read

Attackers hijack OVHcloud CLI GitHub releases to distribute secret-stealing backdoor

What happened.Cloud infrastructure provider OVHcloud notified customers that an unauthorized actor compromised a contributor account to replace official command-line interface release binaries with infostealing malware on GitHub.

Source:GitHub Security Advisories

NVIDIAAnalysis1 min read

NVIDIA introduces agentic security architecture for broadcast media

What happened.NVIDIA published an agentic security architecture designed to verify content authenticity and protect media broadcast pipelines against automated tampering.

Source:NVIDIA Blog

MicrosoftAnalysis1 min read

Microsoft introduces Quick Machine Recovery in Windows Server 2025 to remediate boot failure

What happened.Microsoft incorporated remote Quick Machine Recovery into Windows Server 2025 with the release of the October security update to help enterprise administrators resolve catastrophic system startup failures.

Source:Microsoft Security Response Center

CISAAnalysis1 min read

BeyondTrust and CISA disclose critical remote support auth bypass under active attack

What happened.CISA added an improper origin validation flaw in BeyondTrust Remote Support to its Known Exploited Vulnerabilities catalog following active zero-day attacks.

Source:CISA

CiscoAnalysis1 min read

Cisco fixes maximum-severity Secure Email Gateway relative path traversal flaw

What happened.Cisco published an urgent advisory for Secure Email Gateway addressing an unauthenticated remote code execution flaw in its file reputation engine.

Source:Cisco Security Advisories

MicrosoftAnalysis1 min read

Microsoft patches actively exploited Windows Shell Mark of the Web bypass zero-day

What happened.Microsoft resolved an actively exploited security feature bypass vulnerability in the Windows Shell as part of its monthly cumulative quality updates.

Source:Microsoft Security Response Center

CISAAnalysis1 min read

CISA mandates emergency remediations for Ivanti Connect Secure zero-day

What happened.CISA issued an urgent directive ordering federal agencies to patch an authentication spoofing zero-day in Ivanti Connect Secure VPN appliances.

Source:CISA

AmazonAnalysis1 min read

AWS issues security advisory for Linux kernel KVM hypervisor memory flaw

What happened.Amazon Web Services published security bulletin 2026-137-AWS describing a host memory corruption defect in Linux kernel virtualized networking drivers.

Source:AWS Security Bulletins

GoogleAnalysis1 min read

Google updates Chrome desktop with emergency fixes for high-severity ANGLE flaw

What happened.Google released emergency updates for Chrome stable channel desktop builds to address multiple high-severity memory corruption bugs.

Source:Google Cloud Security Bulletins

AnthropicAnalysis1 min read

Anthropic red team warns small AI models can self-replicate across edge IoT

What happened.Anthropic published red team research showing small language models can autonomously replicate across consumer smart devices without data center access. The study warns that edge botnets could soon run capable autonomous malware.

Source:Anthropic

GoogleAnalysis1 min read

Google DeepMind and Singapore GovTech deploy on-device Gemma to fight chat scams

What happened.Google DeepMind and Singapore government agencies launched an on-device AI system to stop conversational fraud on smartphones. The tool runs locally to protect users without reading encrypted chats in the cloud.

Source:Google DeepMind

GitLabAnalysis1 min read

GitLab patches critical CI/CD compiler remote code execution flaw

What happened.GitLab released emergency security updates 19.4.2, 19.3.5, and 19.2.8 for Community and Enterprise Editions. The update fixes an unauthenticated remote code execution flaw in its pipeline regular expression compiler.

Source:GitLab Security

SonicWallAnalysis1 min read

SonicWall fixes maximum-severity SSRF flaw under active attack

What happened.SonicWall released emergency platform hotfixes for its Secure Mobile Access 1000 Series appliances. The update repairs a critical server-side request forgery vulnerability that threat actors are actively exploiting in the wild.

Source:SonicWall PSIRT

CISAAnalysis1 min read

CISA and allied agencies expose commercial hacking network

What happened.CISA, the FBI, and partner cyber defense agencies from six allied nations issued joint advisory AA26-281A. The notice details how state-linked threat actors use commercial tooling firm Integrity Technology Group to breach critical infrastructure.

Source:CISA

CitrixAnalysis1 min read

Citrix and CISA release urgent NetScaler SAML memory safety updates

What happened.Citrix and CISA published urgent security guidance for NetScaler ADC and Gateway appliances. The alert addresses a critical memory overflow flaw in SAML authentication configurations during ongoing edge appliance attacks.

Source:CISA

CiscoAnalysis1 min read

Cisco patches critical admin authentication bypass in SD-WAN Manager

What happened.Cisco issued a critical security advisory for Catalyst SD-WAN Manager. The defect allows unauthenticated remote attackers to bypass API authentication and gain complete administrative control of the system.

Source:Cisco Security Advisories

AtlassianAnalysis1 min read

Atlassian fixes critical arbitrary file access flaw across Data Center platforms

What happened.Atlassian issued security updates across its self-hosted Data Center and Server products. The release resolves an unauthenticated arbitrary file read vulnerability affecting web resource modules.

Source:Atlassian Security

SecurityAnalysis1 min read

Anthropic introduces Cyber Mission with Critical Infrastructure Defense Program and OSS Scanner

What happened.Anthropic launched the Anthropic Cyber Mission, establishing the Critical Infrastructure Defense Program to protect operational technology environments using Claude frontier models. Alongside the industrial initiative, Anthropic released the OSS Scanner, a free service that runs security audits across open-source repositories.

Source:Anthropic

ProductAnalysis1 min read

Google DeepMind releases Gemini 4 Argon with restricted cybersecurity distribution

What happened.Google DeepMind announced Gemini 4 Argon, reporting a 1-million-token output limit and evaluation scores of 77.9% on DeepSWE v1.1 and 91.9% on Vibe Code Bench. Google is withholding general developer API and consumer availability, instead routing early deployment exclusively to vetted defensive specialists through its Fairwind Program and CodeMender automated patching tools while defensive evaluations continue.

Source:Google DeepMind