Security Patches news | The Register

REG AD

SECURITY > PATCHES

Latest updates and fixes for exploitable security flaws and other bugs

Welcome to the vulnpocalypse, as vendors use AI to find bugs and patches multiply like rabbits

Palo Alto Networks found and fixed 75 flaws this month, up from its usual five

Doozy of a Patch Tuesday includes 30 critical Microsoft CVEs

The good news: no 0-days. The bad news: busy week ahead for Microsoft admins

influencer uploads video to Vimeo. image credit: Premreuthai / Shutterstock

ShinyHunters claims dump puts 119K Vimeo emails in the wild

Vimeo points finger at analytics supplier Anodot, says no logins or card data were touched

perfect story

Brace for the patch tsunami: AI is unearthing decades of buried code debt

Britain's cyber agency says the bill for years of technical shortcuts is coming due, and it's arriving all at once

REG AD

Gemini CLI

Google's fix for critical Gemini CLI bug might break your CI/CD pipelines

This CVSS 10.0 RCE vuln has been patched, automatically for some, so better check those workflows

cables

Bug of the year (so far): Nasty cPanel vulnerability probably exploited as a 0-day

Emergency patches out now for those managing the millions of domains assumed to be affected

Russian bear

Microsoft's patch for a 0-day exploited by Russian spies fell short. Another Windows flaw is under attack

Second try's a charm?

Cisco

More Cisco SD-WAN bugs battered in attacks

CISA gives federal agencies 4 days to patch

sandbox

Patch these critical Fortinet sandbox bugs that let attackers bypass login, run commands over HTTP

No reports of active exploitation (yet)

excel. home made by jude k in 2022

Ancient Excel bug comes out of retirement for active attacks

Vuln old enough to drive lands on CISA's exploited list

Locusts

Microsoft's massive Patch Tuesday: It's raining bugs

One CVE under attack, one already disclosed by angry bug hunter, and 163 more

Image composite: Microsoft and StudioLondon http://www.shutterstock.com/gallery-893620p1.html

Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum

One was patched almost 14 years ago

REG AD

roof fire

Attackers exploited this critical FortiClient EMS bug as a 0-day

CISA added the flaw to KEV after Fortinet confirmed exploitation in the wild

Illustration of a bug over some computer circuit board diagrams

Citrix NetScaler bug exploited in days, may be multiple flaws in a trench coat

Researchers say attackers are already looting vulnerable boxes

Crazy guy with power tools

Out-of-band getting out of hand as Microsoft pushes hotpatch for Bluetooth

Second emergency fix in days targets Windows 11 24H2 and 25H2

chrome

Google rushes Chrome update fixing two zero-days already under attack

Skia graphics lib and V8 JavaScript engine brings browser's tally of actively exploited bugs to three in 2026

hot

Hotpatching goes default in Windows Autopatch whether you like it or not

Microsoft insists rebootless updates are 'the quickest way to get secure'

patch

Patch these 4 critical, make-me-root SolarWinds bugs ASAP

SolarWinds + file transfer software = what attackers' dreams are made of

Red alert symbol

CISA gives federal agencies three days to patch actively exploited Dell bug

Hardcoded credential flaw in RecoverPoint already abused in espionage campaign

bug

Attackers finally get around to exploiting critical Microsoft bug from 2024

As if admins haven't had enough to do this week

patch issues for admins

Microsoft's Valentine's gift to admins: 6 exploited zero-day fixes

Roses are red, violets are blue ... now get patching

solarwinds

Critical SolarWinds Web Help Desk bug under attack

US agencies told to patch by Friday

scream

Critical React Native Metro dev server bug under attack as researchers scream into the void

Too slow react-ion time

boot

Microsoft probes Windows 11 boot failures tied to January security updates

Some machines are failing to start after security updates, prompting yet another Microsoft investigation

updating

Patch or die: VMware vCenter Server bug fixed in 2024 under attack today

If you skipped it back then, now’s a very good time

Illustration of a software bug under a magnifying glass

Fortinet admits FortiGate SSO bug still exploitable despite December patch

Fix didn't quite do the job – attackers spotted logging in

root

Ancient telnet bug happily hands out root to attackers

Critical vuln flew under the radar for a decade

phone

Another week, another emergency patch as Cisco plugs Unified Comms zero-day

The critical-rated flaw leaves unpatched systems open to full takeover

melted-ice-cubes-drops

Microsoft admits Outlook might freeze when saving files to OneDrive

January update is the gift that keeps on giving

thief sneaking through door

Cloudflare whacks WAF bypass bug that opened side door for attackers

ACME validation had a challenge-request hole

REG AD

Cloud security cloud data leak

AI framework flaws put enterprise clouds at risk of takeover

Update Chainlit to the latest version ASAP

Anthropic

Anthropic quietly fixed flaws in its Git MCP server that allowed for remote code execution

Prompt injection for the win

Hal

Sorry Dave, I’m afraid I can’t do that! PCs refuse to shut down after Microsoft patch

Microsoft claims it's a Secure Launch bug

REG AD

Late

Cisco finally fixes max-severity bug under active attack for weeks

This is a threat to security - and to the weekend for some unlucky netadmins

cloud

A simple CodeBuild flaw put every AWS environment at risk – and pwned 'the central nervous system of the cloud'

And it's 'not unique to AWS,' researcher tells The Reg

Python attacking

Popular Python libraries used in Hugging Face models subject to poisoned metadata attack

The open-source libraries were created by Salesforce, Nvidia, and Apple with a Swiss group

bug in code

Patch Cisco ISE bug now before attackers abuse proof-of-concept exploit

No reports of active exploitation … yet

Maximum-severity n8n flaw lets randos run your automation server

Unauthenticated RCE means anyone on the network can seize full control

Logitech MX Master 4 (pic: Richard Speed)

Logitech macOS mouse mayhem traced to expired dev certificate

Company says it dropped the ball, apologizes for wasting people's time

hesitant looking man offers up christmas present

An early end to the holidays: 'Heartbleed of MongoDB' is now under active exploit

You didn't think you'd get to enjoy your time off without a major cybersecurity incident, did you?

Windows update

Microsoft rushes an out-of-band update for Message Queuing bug

Redmond gets in early for the twelve whoopsies of Christmas

perfect 10

HPE tells customers to patch fast as OneView RCE bug scores a perfect 10

Maximum-severity vuln lets unauthenticated attackers execute code on trusted infra management platform

Scared looking office consultant hides under desk

Apple, Google forced to issue emergency 0-day patches

Both admit attackers were already exploiting the bugs, with scant detail and hints of spyware-grade abuse

0-day

Microsoft RasMan DoS 0-day gets unofficial patch - and a working exploit

Exploit hasn't been picked up by any malware detection engines, CEO tells The Reg

React

New React vulns leak secrets, invite DoS attacks

And the earlier React2Shell patch is vulnerable

Chrome icon on sandy beach

Google fixes super-secret 8th Chrome 0-day

No details, no CVE, update your browser now

patch

Microsoft reports 7.8-rated zero day, plus 56 more in December Patch Tuesday

Plus critical critical Notepad++, Ivanti, and Fortinet updates, and one of these patches an under-attack security hole

REG AD

quiet

Microsoft quietly shuts down Windows shortcut flaw after years of espionage abuse

Silent Patch Tuesday mitigation ends ability to hide malicious commands in .lnk files

hacked

'Exploitation is imminent' as 39 percent of cloud environs have max-severity React hole

Finish reading this, then patch

android reclines on a keyboard on smartphone

Two Android 0-day bugs disclosed and fixed, plus 105 more to patch

Christmas comes early for attackers this year

Cyber Crim

Fortinet 'fesses up to second 0-day within a week

Attackers may be joining the dots to enable unauthenticated RCE

Zero day

Google Chrome bug exploited as a 0-day – patch now or risk full system compromise

Seventh Chrome 0-day this year

A wasp, from Shutterstock

Fortinet finally cops to critical make-me-admin bug under active exploitation

More than a month after PoC made public

firewall

Cisco warns of 'new attack variant' battering firewalls under exploit for 6 months

Plus 2 new critical vulns - patch now

docker

Docker Compose vulnerability opens door to host-level writes – patch pronto

Windows Desktop installer also fixed after DLL hijack flaw rated 8.8 severity

Hammer, spanner and screw

Microsoft drops surprise Windows Server patch before weekend downtime

You didn't have plans, did you?

python

Forking confusing: Vulnerable Rust crate exposes uv Python packager

Forks of forks of forks, but which ones are patched?

admin

Oracle rushes out another emergency E-Business Suite patch as Clop fallout widens

Latest in a long line of EBS flaws leta miscreants remotely compromise enterprise systems to pinch sensitive data

Illustration of database servers

Level-10 vuln lurking in Redis source code for 13 years could allow remote code execution

No evidence of exploitation … yet

'Delightful' root-access bug in Red Hat OpenShift AI allows full cluster takeover

Who wouldn't want root access on cluster master nodes?

cisco

Warnings about Cisco vulns under active exploit are falling on deaf ears

50,000 firewall devices still exposed

Criminal

‘An attacker's playground:’ Crims exploit GoAnywhere perfect-10 bug

Researchers say tens of thousands of instances remain publicly reachable

panic button

UK and US security agencies order urgent fixes as Cisco firewall bugs exploited in wild

CISA gives feds 24 hours to patch, NCSC urges rapid action as flaws linked to ArcaneDoor spies

sonic

SonicWall releases rootkit-busting firmware update following wave of attacks

Security vendor's no good, very bad week year

solarwinds

Third time's the charm? SolarWinds (again) patches critical Web Help Desk RCE

Or maybe 3 strikes, you're out?

Illustration of binary data in transfer

Ding ding: Fortra rings the perfect-10 bell over latest GoAnywhere MFT bug

Outside experts say the vulnerability has probably already been exploited

woman squints suspiciously at laptop

OpenAI plugs ShadowLeak bug in ChatGPT that let miscreants raid inboxes

Radware says flaw enabled hidden email prompts to trick Deep Research agent into exfiltrating sensitive data

Google Chrome icon

Google pushes emergency patch for Chrome 0-day – check your browser version now

Sixth such Chrome flaw this year spotted by the Chocolate Factory, already in play

iphone8 passcode

Apple 0-day likely used in spy attacks affected devices as old as iPhone 8

May have been used in 'extremely sophisticated' attacks against 'specific targeted individuals'

Close up of the WhatsApp icon on a phone

Samsung fixes Android 0-day that may have been used to spy on WhatsApp messages

A similar vuln on Apple devices was used against 'specific targeted users'