patch management

The PHP security team does not usually announce patches before they ship. So when it posted an advance notice on the evening of 20 October 2026 warning of an out-of-cycle …

A critical WordPress core flaw, CVE-2026-87902, was being probed by attackers hours after the 22 September patch. Here’s how it works and what to do now.

Third party plugin risk, not clever malware, is why a critical WooCommerce flaw patched in February is still being exploited in September.

The Cisco ISE patch for CVE-2026-76460 isn’t optional. A step-by-step plan for checking versions, patching, and spotting prior compromise.

A practical checklist for the WordPress Click2Shell flaw: whether you’re affected, how serious it really was, and the five things to check this week.

WordPress’s automated plugin review caught a real backdoor before it shipped. That is a genuine win, but it does nothing about the vulnerable plugins already on your site.

CISA has added five actively exploited vulnerabilities in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its watch list this week.

A maximum-severity path traversal flaw in GitLab’s repository commits API is being scanned within hours of disclosure. Here’s what happened and what self-managed users need to check.

New firewall and VPN vulnerabilities in Cisco, Citrix and Fortinet gear are under active attack. A step-by-step checklist for IT managers without a dedicated security team.

A practical order for tackling this month’s 974 Patch Tuesday vulnerabilities, from the two already-exploited bugs to your e-commerce platform.