Today's specials: 82 live security incidents, brew temperature 666°C

Search specials Search

Decaf: just the things that can hurt you. Breaches, news and anything below high are off the menu. Regular, please

86'dNo fix yet10

Nobody has a patch. Unplug things.

1. Murrelektronik AAS Edge Client13 hMitigated it Critical vulnerability Double espressocritical severity

   Do now Vendor won't fix: replace or isolate it. Murrelektronik will not provide a fix. Advisory

   Re-plated 24 Oct On hold (status unknown) → 86'd (no fix yet) KEV – Record ✓ Vendor –
2. Siemens SIMATIC S72 dMitigated it PLCs Web Server Double espressocritical severity

   Do now Restrict access to the S7-1500 web server and disable it if unused until a vendor fix is available. Advisory

   Re-plated 24 Oct On hold (status unknown) → 86'd (no fix yet) KEV – Record ✓ Vendor –
3. InterSystems IRIS for Health2 dMitigated it Cleartext Transmission of Sensitive Information Americanohigh severity

   Do now Enable TLS on InterSystems IRIS for Health and restrict network access until a vendor fix is available. Advisory

   Re-plated 24 Oct On hold (status unknown) → 86'd (no fix yet) KEV – Record ✓ Vendor –

4. PHP18 hMitigated it Session upload progress RCE in an unusual configuration House blendunknown severity

   Do now Check whether session upload progress is enabled in your PHP setup and disable it until fixed. Advisory

   Re-plated 24 Oct Order up (fix available) → 86'd (no fix yet) KEV – Record – Vendor ✓
5. Apache Vysper22 hMitigated it Unbounded Allocation House blendunknown severity

   Do now Restrict network access to Apache Vysper XML parsing endpoints and monitor memory use until a fix is released. Advisory

   Re-scored 24 Oct high → unknown KEV – Record – Vendor –
6. x402 SDK1 dMitigated it x402 SDK Flaw House blendunknown severity

   Do now Avoid calling untrusted APIs with x402 SDKs and limit agent token balances until a fix is available. Advisory

   Re-scored 24 Oct critical → unknown KEV – Record – Vendor –

All 10 with no fix

Order upFix available56

The fix exists. Somebody has to carry it.

1. Arista VeloCloud Orchestrator32 dPatched it Improper Input Validation 🔥 On the fly · exploitedHell brewcritical severity

   Fixed in 5.2.3.16, 6.4.2.8 Advisory

   Re-plated 24 Oct On hold (status unknown) → Order up (fix available) Under the heat lamp: 32 days KEV ✓ Record ✓ Vendor –
2. WSO2 API Manager30 dPatched it WSO2 Multiple Products Path Traversal 🔥 On the fly · exploitedHell brewcritical severity

   Fixed in WSO2 Universal Gateway 4.5.0.57, WSO2 Universal Gateway 4.6.0.21 +13 Advisory

   Re-plated 24 Oct On hold (status unknown) → Order up (fix available) Under the heat lamp: 30 days KEV ✓ Record ✓ Vendor ✓
3. Citrix NetScaler ADC12 hPatched it Memory corruption 🔥 On the fly · exploitedHell brewcritical severity

   Fixed in ADC 14.1-73.37, ADC 13.1-64.23 +2 Advisory

   Re-plated 24 Oct On hold (status unknown) → Order up (fix available) Under the heat lamp: 27 days KEV ✓ Record ✓ Vendor ✓

All 56 with a fix

On holdStatus unknown9

Nobody has said yet. Read the advisory.

Show all 9

1. ProFTPD16 dMitigated it Improper Access Control 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dHell brewcritical severity

   Do now Restrict access to the ProFTPD SITE CPFR and SITE CPTO commands and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 11:17 UTC. Advisory

   KEV ✓ Record ✓ Vendor –
2. Fortinet FortiMail23 dMitigated it Path Traversal 🔥 On the fly · exploitedKEV overdue 20dHell brewcritical severity

   Do now Restrict access to FortiMail HTTP and HTTPS interfaces and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 11:17 UTC. Advisory

   KEV ✓ Record ✓ Vendor –
3. BeyondTrust Remote Support8 dMitigated it Authentication Bypass by Spoofing 🔥 On the fly · exploitedKEV overdue 5dHell brewcritical severity

   Do now Restrict network access to BeyondTrust Remote Support and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 11:17 UTC. Advisory

   KEV ✓ Record ✓ Vendor –

All 9 unknown

OverheardBreaches and other news7

Nothing to patch. Rotate, then worry.

Show all 7

1. Company websites18 h Ransomware affiliates use AI agents House blendunknown severity

   Do now Restrict exposure of company websites and monitor for AI-driven intrusion activity. Advisory

   Re-scored 24 Oct high → unknown
2. EU Supermarkets20 h Suffer Losses Due to Unupdated Refrigerator Firmware House blendunknown severity

   Do now Restrict network access to supermarket refrigeration controllers and check their firmware versions. Advisory

   Re-scored 24 Oct high → unknown
3. eMudhra certificates13 h EMudhra CA Keys Compromised House blendunknown severity

   Do now Check whether any eMudhra-issued certificates are in use and plan replacements before the authority's withdrawal takes effect. Advisory

   Re-scored 24 Oct critical → unknown

All 7