Vulnerabilities

Today is Microsoft’s February 2026 Patch Tuesday, featuring security updates for 58 flaws, including 6 that are actively exploited and 3 publicly disclosed zero-day vulnerabilities. This Patch Tuesday fixes five “Critical” vulnerabilities: three elevate privileges and two disclose information. The details of vulnerabilities by category are as follows: 25 Elevation …

Fortinet has released a critical security advisory urging administrators to promptly update FortiClientEMS, its central management tool for endpoint protection. A vulnerability, CVE-2026-21643, has a CVSSv3 score of 9.1 and may enable remote attackers to run unauthorized code on affected servers. The flaw is categorized as an SQL Injection (SQLi) …

A study revealed that almost 5 million servers expose Git metadata, including 250,000 that leak deployment credentials through .git/config files. A 2026 study from the Mysterium VPN research team found that about 5 million public web servers are leaking Git repository metadata, including over 250,000 that expose .git/config files with …

CISA announced on Tuesday that a security flaw in SolarWinds Web Help Desk is now listed in its Known Exploited Vulnerabilities catalog, indicating it is actively being targeted in attacks. The vulnerability, CVE-2025-40551 (CVSS score: 9.8), allows untrusted data deserialization that could enable remote code execution. Web Help Desk is …

Hikvision has released an important firmware update for its wireless access points (APs) to fix a serious vulnerability that could let attackers take control of the devices. Known as CVE-2026-0709, this flaw has a CVSS score of 7.2, indicating a high risk for businesses using these devices for connectivity. The …

The Russia-linked group UAC-0001, or APT28, is exploiting a zero-day vulnerability in Microsoft Office. The group exploits this flaw to install advanced malware targeting Ukrainian government and EU organizations. The vulnerability, identified as CVE-2026-21509, was disclosed by Microsoft on January 26, 2026, with warnings about active exploitation in the wild. …

A joint investigation by SentinelOne SentinelLABS and Censys found that open-source AI deployment has led to a large “unmanaged, publicly accessible AI compute infrastructure” with 175,000 unique Ollama hosts in 130 countries. These systems operate outside the usual safety and monitoring measures set by platform providers. According to the company, …

Fortinet has revealed a critical vulnerability affecting its products. The company issued a Public Advisory on January 27 after noticing initial attacks on January 23, when it disabled two malicious accounts exploiting the single sign-on feature in FortiOS. In December 2025, an advisory was issued about two previous SSO bypass …

Microsoft has issued emergency security updates to fix a critical zero-day vulnerability in Microsoft Office that has been actively exploited. The vulnerability, CVE-2026-21509, affects several Office versions: Microsoft Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise (the company’s cloud-based subscription service). “Reliance on untrusted inputs …

GitLab has released a new patch to fix security vulnerabilities and stability issues in versions 18.8.2, 18.7.2, and 18.6.4 for both Community and Enterprise Editions. These updates are ready for self-managed installations and include crucial bug fixes and security improvements. Administrators should upgrade as soon as possible. The GitLab patch …