Cybersecurity Without Panic
Latest publications
GoAhead TLS Backend Flaws Turn Embedded Device Patching Into a Manufacturer-Tracking Problem
Three GoAhead TLS integration flaws affect different libraries and configurations. The upstream fix is available, but many operators still need to identify which device vendors have incorporated it into firmware.
The eMudhra CA Key Compromise Turns Certificate Trust Into a Migration Deadline
Eight eMudhra intermediate CA keys were compromised, prompting browser and trust-store changes. The practical issue for certificate owners is identifying affected chains, replacing them, and checking software that does not receive browser revocation updates.
CVE-2026-92392 in curl: Why HTTP/2 Uploads Need a Dependency-Level Patch Response
curl 8.23.0 fixes a high-severity use-after-free in HTTP/2 uploads. The practical risk depends on how your systems use curl and libcurl, so inventory, update paths, and upload workflows matter more than a dramatic headline.
FortiMail CVE-2026-104286 Is Being Exploited: Patch the Gateway, Then Check What It Could Write
CVE-2026-104286 gives unauthenticated attackers arbitrary file-write capability on affected FortiMail systems. The immediate task is broader than installing a release: identify exposed appliances, apply Fortinet’s guidance, preserve evidence, and investigate for compromise.
CARBONATO Shows Why an Exposed Docker API Is a Host Compromise, Not a Container Problem
A newly reported CARBONATO campaign is targeting unauthenticated Docker APIs exposed to the internet. The practical response is to remove the exposure, investigate the host, rotate secrets, and check every reachable Docker environment.
F5 BIG-IP APM’s OAuth Zero-Day Requires Configuration Discovery and Compromise Assessment
CVE-2026-94127 is being exploited against a narrow but consequential BIG-IP APM configuration. The right response is not to patch blindly: identify OAuth authorization-server virtual servers, contain them, install the hotfix, and investigate activity before closure.
Spain’s First Reported AI-Agent Data Breach Is a Test of Access Control and Response Speed
Spain’s data protection authority has received a breach notification describing an AI agent that logged in, searched for application weaknesses, altered personal data and accessed invoices. The immediate lesson is about permissions, monitoring and containment—not science fiction.
CVE-2026-76461: Cisco Secure Email Gateway Users Need a Patch-and-Forensics Response
Cisco says an unauthenticated SQL injection flaw in Secure Email Gateway is being actively exploited. The right response is broader than upgrading: identify every appliance, install the fixed AsyncOS release, and inspect mail logs for evidence of compromise.
CVE-2026-75650 in Adobe Commerce and Magento: Patch the Store, Then Investigate It
Adobe says CVE-2026-75650 is being exploited in the wild. The emergency fix closes a critical unauthenticated code-execution path, but merchants must also determine whether attackers reached the store before the hotfix was available.
SAP’s September 2026 Kernel Flaws Demand an Inventory-and-Patch Response
Two critical SAP vulnerabilities disclosed on September 8 reach core communication paths and can threaten an entire ERP landscape. Here is what is known, what is not, and how defenders should verify exposure without waiting for exploit chatter.
SonicWall SMA1000 Bugs Are Being Exploited: Patch the Appliance, Then Check What It Exposed
Two newly disclosed SonicWall SMA1000 vulnerabilities are already in CISA’s exploited-vulnerability catalog. The urgent task is not only installing the vendor fix, but deciding whether an internet-facing remote-access appliance should be treated as a possible incident.
CVE-2026-9586 in Switchvox: Patch the PBX, Prove the Fix
Sangoma has fixed a Switchvox flaw that can lead from unauthenticated SQL injection to remote code execution. Here is how to identify exposed systems, update safely, check for prior compromise and communicate the risk without panic.
