Research and briefing notes
Findings, method notes and practical guidance for organizations that must document security decisions.
Latest Research Articles
We regularly publish our security findings, guidance, and analysis to help organizations stay ahead of emerging threats.
Ivanti Connect Secure is under fire again. CISA already put it on the list.
CVE-2026-104935 is an auth bypass that leads to command execution on Connect Secure. Limited wild use. Federal due date is October 16. Patch, then assume the box may already have been used.
Mathew Potter
Security Analyst
NetScaler got another exploited hole a few days after the last one.
CVE-2026-88779 is a memory overflow DoS on customer-managed NetScaler ADC and Gateway when SAML SP or IdP is in play. CISA due date was October 7. Prior patches for the other CVEs do not cover this one.
Mathew Potter
Security Analyst
FortiMail had an unauthenticated file write. Fixes are out. Cloud is already moved.
CVE-2026-104286 (FG-IR-26-175) is a path traversal plus NULL-byte issue on FortiMail. CVSS 9.8, exploited, KEV. On-prem targets are 8.0.2, 7.6.7, 7.4.9. 7.2 has to leave the branch.
Mathew Potter
Security Analyst
The WordPress hole we wrote yesterday is already being used
CVE-2026-87902 saw attempts the afternoon 7.1.2 shipped. Patchstack says probes now write PHP files. Previdian counted 68 honeypot tries. Last week's 7.1.1 is still open.
Mathew Potter
Security Analyst
Ottawa says the May Roundcube patch is being used. Four months is long enough.
CVE-2026-48842 is pre-auth SQL injection in virtuser_query. Cyber Centre updated AV26-503. Fixed in 1.6.16 and 1.7.1. If you cannot update, turn the plugin off.
Mathew Potter
Security Analyst
CISA put a ransomware tag on the July TeamCity hole. About 160 boxes are still out there.
CVE-2026-63077 is unauthenticated commands on TeamCity On-Premises. Patched July 25 in 2025.11.7 and 2026.1.3. Federal clock was August 8. Cloud is fine. Internet-facing and old is not.
Mathew Potter
Security Analyst
Stay updated
New briefing notes by email. No marketing list, and you can leave at any time.
We respect your privacy. Unsubscribe at any time.