Vulnerability Management

An independent, attributed roundup of the major cybersecurity incidents of October 2026 — from the PHP2Shell critical RCEs and the ConnectWise Cloud Backup supply-chain compromise to breaches at ETS, Denmark’s population register, Zeabur, Railway, Burger King Japan and more. Each item carries a verification status (confirmed, claimed or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

A plain-English explainer on Application Security Posture Management (ASPM): what it is, why it emerged from application-security tool sprawl, how it correlates and deduplicates findings from SAST, DAST, SCA and secret scanners, how ASPM differs from CNAPP, and what a good ASPM program actually delivers.

A clear, defensive explainer of mitigation versus remediation: precise definitions, how mitigation reduces impact or likelihood while remediation fixes the root cause, where risk acceptance and transfer fit, how both play out in vulnerability management, and worked examples so teams use the terms consistently.

A plain-English explainer on ACAS, the US Department of Defense's mandated vulnerability-scanning solution: what it is, the components it is built on, who must use it, and how it fits into DoD compliance alongside STIGs and the Risk Management Framework (RMF). Factual, defensive and without fabricated specifics.

A16z, using Epoch.ai data across 21 major software vendors (Apple, AWS, Microsoft, Google, Cisco, Oracle and more), shows critical-severity CVEs that never cleared ~100 a month for four years suddenly jumping past 600 a month since spring 2026; high-severity reports spiked toward ~2,200 a month. In parallel, Kevin Mandia (Mandiant’s founder) says his new venture Armadin has found 90+ zero-days in production at customer sites this year using models post-trained with real red-teamers — black-box, from the internet, no source code. What’s confirmed vs. reported, why the curve bent, and what a security leader should do now.

An independent, attributed roundup of the major cybersecurity incidents of September 2026 — from the actively-exploited Citrix NetScaler and Arista VeloCloud zero-days to the Pentagon Defense Manpower Data Center breach, the Gyazo compromise, the Keio ransomware attack and the disputed ShinyHunters FBI-jobs claim. Each item carries a verification status (confirmed, claimed, reported or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

Anthropic says Zhipu’s open-weight GLM-5.3 can build end-to-end exploits without robust safeguards. The capability finding is right; the policy cure is not.

CVE-2026-88771: a 9.5 unauthenticated command injection in Citrix NetScaler, exploited as a zero-day. Fixed builds and what patching alone misses.

Citrix NetScaler keeps getting mass-exploited — Shitrix, CitrixBleed, CitrixBleed 2 and new zero-days. The durable reason, the CVE timeline, and the fix.

OpenVuln is Z.ai’s free tool that points its GLM-5.3 model at any GitHub repo to hunt vulnerabilities. How it works, the numbers, and what it means for OSS.

Claude Security is a new beta plugin that scans code changes or entire repos for high-severity vulnerabilities directly in the terminal — reasoning through data flows like a security researcher instead of pattern-matching, with adversarial self-checks to cut false positives. Here's how it works and what it means for AppSec teams.

An independent, attributed roundup of the major cybersecurity incidents of June 2026 — from the Oracle PeopleSoft zero-day (CVE-2026-35273) that ShinyHunters used against 100-plus universities and Microsoft’s record ~206-CVE Patch Tuesday to breaches at iRhythm, Novo Nordisk, Tata Electronics and Kodak and a wave of npm supply-chain compromises. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of May 2026 — from the ShinyHunters Canvas/Instructure extortion and the TanStack supply-chain worm that reached OpenAI to the DigiCert code-signing abuse, a suspected Iranian attack on US gas-station tank gauges, and breaches at Carnival, Charter/Spectrum, West Pharmaceutical and more. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of April 2026 — from the ShinyHunters Salesforce extortion wave hitting Charter/Spectrum, ADT, Pitney Bowes, Vimeo and Medtronic, to the ChipSoft ransomware attack on Dutch hospitals, the France Titres (ANTS) identity-portal breach, a Microsoft SharePoint zero-day and the ~$290M Kelp DAO crypto theft. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of March 2026 — from the TeamPCP supply-chain campaign that poisoned LiteLLM and security-scanner packages on PyPI, to the Handala wiper that erased 200,000+ Stryker devices, the Cl0p Oracle E-Business Suite extortion wave, and breaches at Cegedim Sante, Navia, Aura, Crunchyroll and Telus. Each item carries a verification status (confirmed, claimed or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of February 2026 — from Microsoft’s six actively-exploited zero-days and the BeyondTrust and Ivanti EPMM flaws to breaches at the University of Mississippi Medical Center, France’s national bank account registry (FICOBA), CarGurus, Figure, Advantest and Singapore’s four telcos. Each item carries a verification status (confirmed, reported or claimed) and a clearly-labelled subjective editorial severity, with a defensive takeaway.