Patch Management

CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in self-managed GitLab CE/EE 7.0+, fixed 21 Oct 2026 in 19.5.1 and backports. The 12 Oct fix isn't enough.

A beginner-friendly guide to operating system security: hardening, patching, least privilege, logging, and endpoint protection on servers and workstations.

A16z, using Epoch.ai data across 21 major software vendors (Apple, AWS, Microsoft, Google, Cisco, Oracle and more), shows critical-severity CVEs that never cleared ~100 a month for four years suddenly jumping past 600 a month since spring 2026; high-severity reports spiked toward ~2,200 a month. In parallel, Kevin Mandia (Mandiant’s founder) says his new venture Armadin has found 90+ zero-days in production at customer sites this year using models post-trained with real red-teamers — black-box, from the internet, no source code. What’s confirmed vs. reported, why the curve bent, and what a security leader should do now.

CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco ISE, under active exploitation with no workaround. Affected versions, patches, and detection.

A ranked table of 12 major enterprise infrastructure vendors by CVSS 10.0 vulnerability count and confirmed exploitability through September 2026, with Cisco's record advisory cluster and board-ready framing for CISOs.