Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A CoreGraphics out-of-bounds write was used in targeted attacks. Apple fixed it on 28 September in iOS 26.7.1 and two macOS releases, and CISA set a 13 October deadline.
CISA added CVE-2025-39964, CVE-2026-53266 and CVE-2025-39682 to KEV on 18 September with a three-day deadline. Here are the fixed stable versions and how to tell which bugs your hosts can reach.
On 8 October 2026 CISA added five old CVEs to KEV, from BIND and ProFTPD in 2015 to Strapi in 2023. Here is what each one needs, and how to find the forgotten copies.
Two exploited Windows privilege escalation bugs, in the Update Stack and ALPC, were patched and added to CISA KEV on 8 September 2026. Both were fixed in a record Patch Tuesday.
N-able patched a critical pre-authentication RCE in N-central on 6 September 2026. CISA added CVE-2026-86218 to KEV on 8 September with an 11 September due date.
Cisco ISE and ISE-PIC have an unauthenticated API authentication bypass, CVE-2026-76460, under active exploitation. CISA added it to KEV on 16 September 2026, due 19 September.
WSO2 API Manager and related products accept JWTs signed with unsupported algorithms. CISA added CVE-2026-5430 to KEV on 24 September 2026, months after the May advisory.
Zyxel patched a stack overflow in GS1900 switch firmware in June 2026. CISA added CVE-2026-7273 to KEV on 21 September, due 24 September.
52 of 61 CISA KEV entries added from 1 September to 16 October 2026 came with three-day due dates, 24 of them on edge appliances. A small script that alerts on your vendors.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
