INTELLIGENCE BEAT9 Briefs

Unpatched

9 Briefs

Verified technical decision briefs tracking unpatched developments

Filter:

CISA3 Google2 Amazon1 Cisco1 GitLab1 Microsoft1

GitLabAnalysis1 min read

GitLab patches critical regex compiler integer overflow RCE flaw

What happened.GitLab released emergency security updates for a maximum-severity remote code execution flaw in its regular expression compiler. The defect affects all Community and Enterprise editions across twelve years of releases.

Why it matters.Self-managed GitLab servers operate at the center of enterprise deployment pipelines and maintain direct access to proprietary source code and production credentials. Organizations running vulnerable self-hosted instances must apply the vendor maintenance releases immediately to prevent perimeter breach and lateral compromise.

↳Continues storyline: GitLab patches critical CI/CD compiler remote code execution flaw

Read Full Brief →

Source:GitLab Security

All Stories8 stories

GoogleAnalysis1 min read

Node.js patches critical Brotli decoder buffer overflow vulnerability

What happened.The Node.js project published emergency security updates across all active release lines to patch a critical out-of-bounds write buffer overflow vulnerability within the bundled Google Brotli compression decoder.

Source:GitHub Security Advisories

AmazonAnalysis1 min read

Amazon Web Services patches CI/CD serverless toolchain privilege escalation flaw

What happened.Amazon Web Services issued security bulletin 2026-141-AWS detailing a resolved privilege escalation vulnerability in the AWS CI/CD toolchain for serverless applications.

Source:AWS Security Bulletins

CISAAnalysis1 min read

CISA and AWS issue urgent warnings over critical PHP2Shell remote code execution

What happened.CISA and Amazon Web Services published urgent security advisories warning organizations to patch two critical memory corruption vulnerabilities in core PHP that enable unauthenticated remote code execution.

Source:CISA

CiscoAnalysis1 min read

Cisco releases critical security advisories for Expressway RCE and Snort 3 engine

What happened.Cisco published urgent security advisories addressing a maximum-severity remote code execution flaw in Cisco Expressway Series collaboration gateways alongside multiple critical fixes in the Snort 3 engine.

Source:Cisco Security Advisories

GoogleAnalysis1 min read

Compromised eMudhra intermediate CA keys trigger emergency browser and runtime blocks

What happened.Browser vendors and runtime maintainers released urgent security updates to distrust eight intermediate certificate authority keys operated by eMudhra after private keys with near-zero entropy were exposed.

Source:Google Cloud Security Bulletins

MicrosoftAnalysis1 min read

Attackers hijack OVHcloud CLI GitHub releases to distribute secret-stealing backdoor

What happened.Cloud infrastructure provider OVHcloud notified customers that an unauthorized actor compromised a contributor account to replace official command-line interface release binaries with infostealing malware on GitHub.

Source:GitHub Security Advisories

CISAAnalysis1 min read

BeyondTrust and CISA disclose critical remote support auth bypass under active attack

What happened.CISA added an improper origin validation flaw in BeyondTrust Remote Support to its Known Exploited Vulnerabilities catalog following active zero-day attacks.

Source:CISA

CISAAnalysis1 min read

CISA mandates emergency remediations for Ivanti Connect Secure zero-day

What happened.CISA issued an urgent directive ordering federal agencies to patch an authentication spoofing zero-day in Ivanti Connect Secure VPN appliances.

Source:CISA