Three Linux kernel CVEs enter CISA’s KEV catalogue with a three-day deadline and mandatory forensic triage. Fixes, scope and how to read the scores.
Vulnerabilities & Alerts
Linux kernel: three exploited CVEs enter the KEV catalogue
by •
Tag: SOC
Practical Cybersecurity, Projects & Governance
Three days to patch: what the data actually says about AI-accelerated exploitation
by •
CISA justifies its new directive and its three-day deadline by pointing to AI-accelerated exploitation. Tested against the two public datasets available, that justification holds on one indicator and gives way on the others.
Compliance & Standards, Projects & Governance
SIM3 v2 interim: 45 parameters to raise your maturity
by •
SIM3 v2 interim measures a team over 45 parameters and 5 levels. Free for internal use, tooled online, and soon extended to SOCs and PSIRTs
Vulnerabilities & Alerts
SQL injection exploited in Cisco Secure Email Gateway
by •
Cisco has published an unauthenticated SQL injection in Secure Email Gateway, already exploited. No workaround, and a second critical advisory the same day.
Vulnerabilities & Alerts
Six permission bypasses in Mistral Vibe
by •
HiddenLayer published six critical CVEs in Mistral’s coding agent. All target the same authorisation layer, and no fix has shipped.
Open Source & Tools
Microsoft Patch Tuesday May 2026
by •
Patch Tuesday Analysis · May 2026 May 2026 Patch Tuesday: No Zero-Days for the First Time in 23 Months, but Three Unauthenticated 9.8 RCEs in the Queue Microsoft fixes 118 to 138 CVEs depending on methodology, including 16 critical, with no actively exploited or publicly disclosed vulnerability. First Patch Tuesday without a zero-day since June…
Vulnerabilities & Alerts
Reading Root-Owned Files Without Privilege
by •
Technical Analysis · Linux Kernel Vulnerability Reading Root-Owned Files Without Privilege: What CVE-2026-46333 Reveals About Nine Years of Blind Spot in the Linux Kernel A race window in the Linux kernel ptrace access control allows, via pidfd_getfd(2), the theft of file descriptors held by SUID root binaries about to terminate. Two public exploits exfiltrate SSH…
CTI & OSINT, Vulnerabilities & Alerts
Two Windows zero-days disclosed without coordination
by •
CTI Analysis · Critical Vulnerability BitLocker Is No Longer a Promise: What the YellowKey Case Reveals Two Windows zero-days disclosed without coordination, a researcher openly challenging Microsoft, and a phantom component in the Windows Recovery Environment whose true nature, bug or backdoor, no one can yet determine. Published May 14, 2026 Reading time 15 minutes…
CTI & OSINT, Vulnerabilities & Alerts
CVE-2026-40361: zero-click use-after-free vulnerability in the Outlook rendering engine (wwlib.dll)
by •
Remote code execution via the Reading Pane, without user interaction Executive summary On May 12, 2026, as part of the monthly Patch Tuesday cycle, Microsoft released a fix for CVE-2026-40361, a critical use-after-free vulnerability (CWE-416) officially classified by the vendor as a “Microsoft Office Word Remote Code Execution Vulnerability” (1) (2). Researcher Haifei Li, founder…
Vulnerabilities & Alerts
Dirty Frag (CVE-2026-43284 and CVE-2026-43500)
by •
Universal Local Privilege Escalation in the Linux Kernel Executive summary On May 7, 2026, researcher Hyunwoo Kim (alias @v4bel) publicly disclosed a new class of Linux kernel vulnerabilities named Dirty Frag (1) (2). This disclosure, brought forward as a result of an embargo break by an unrelated third party, exposes an exploitation chain combining two…
