A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 5 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 20 October 2026 · 5 items.
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex M…
Read at source →Malware, campaigns and adversary tradecraft.
The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from?…
Read at source →<p>CMMC requirements don’t exist before a contract does and that distinction matters. In this blog, we clarify what FCI and CUI obligations apply during the pre-contract solicitation phase, and where the line actually is.</p>
Read at source →Ransomware, data breaches and supply-chain events.
Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press…
Read at source →Detection engineering, tooling and defensive analysis.