Patch Tuesday
p.s. Yes that IS a SQL injection vulnerability, in Fortinet’s FortiClient EMS, in 2026...
A zero day with the potential for use in a chain is top of the 112-strong list.
Microsoft patched 1,139 vulnerabilities in 2025. This month, look out for...
Three 0days and a pre-auth RCE (CVSS 9.8) in Windows Server Update Service that deserves urgent attention
The bug is in the SPNEGO Extended Negotiation Security Mechanism – which essentially allows a client and server to negotiate the choice of security mechanism that they use.
Attackers are going after high-profile targets in the government and defense sectors, with phishing campaigns that use WebDAV and LOLBins to deploy malware
Five zero days also known-exploited. Patch up!
"It’s notable that the exploit first uses the NtQuerySystemInformation API to leak kernel addresses to user mode."