Security Patches news | The Register

REG AD

SECURITY > PATCHES

Latest updates and fixes for exploitable security flaws and other bugs

Decorative Russian doll in a red headdress and dress, posed against a light background.

Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using it

Ukrainian hacktivists exploiting the bugs, but TrueConf's reach stretches well beyond home turf

Man pushes a stroller with a glowing humanoid robot in it on a tree-lined path.

AI struggles to patch vulns without adult supervision

Left alone, autonomous fixes often fail to fully remediate flaws

Why the 'patchpocalypse' demands immediate isolation

PARTNER CONTENT: Attackers automated, but your 30-day patch window didn't

A plush penguin toy holds a small cardboard sign that says HELP.

Microsoft Defender for Endpoint leaves some Linux boxes defenseless after update

One bug disabled the security service on restart, another blocked installation on hardened RHEL systems

REG AD

Year-long Russian attacks infect users as soon as they look at an email

Phishing for dummies

Linux kernel team publishes 432 CVEs in two days

Sunday-to-Monday onslaught fuels speculation over AI-assisted bug reports

Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released

Attackers appear to have reverse-engineered Big Red's patch

Microsoft extends extended updates for Windows 10 in the most muted way imaginable

Tiny tweak to support page reveals consumers can purchase another year of patch protection

Windows 11 can now turn back the clock when updates go bad

Point-in-time restore offers a 72-hour escape hatch for stricken PCs

Windows update leaves third-party Office document launches in limbo

Microsoft won the OLE vs OpenDoc wars. Now it's saying OLE dependencies don't matter

Glowing virus warning symbol on a blue digital interface with circular tech graphics.

Cisco SD-WAN make-me-root bug under attack

Second Catalyst SD-WAN Manager flaw exploited as an 0-day this month

A vintage photo of the PDP-11/70 minicomputer

The Y2K bug is back! Dutch dev digs up untimely flaw in old BSD build

26 years late and no threat unless you still run a PDP-11/70 and rely on short-wave timekeeping broadcasts

REG AD

Green road sign saying Vulnerability Just Ahead against a cloudy sky.

Ivanti tells Sentry customers to patch now as critical bugs hit 10.0 and 9.9

Remote, unauthenticated RCE with root privileges is about as bad as it gets

AI is making Patch Tuesday (kinda) fun again

Unless you're an admin or vulnerability manager – then you're totally screwed

Man using a desktop computer in a server room with equipment racks.

Microsoft tests the 15-character limit of Windows Server admins' patience

May security update trips over hostnames of a very specific length

Anthropic to release Mythos-class models to the public

AI flaw-finder still under lock and key for now while company figures out guardrails, but extends access to more users including governments

Clear your calendar, Drupal user: You have a critically urgent patch to install

The org’s staying mum on the details, but Wednesday’s fixes reach back to unsupported 8.9 branches

Patch time for Cisco SD-WAN admins as vendor drops yet another make-me-admin zero-day

CISA hands feds super-tight deadline for this perfect-10, actively exploited flaw

Welcome to the vulnpocalypse, as vendors use AI to find bugs and patches multiply like rabbits

Palo Alto Networks found and fixed 75 flaws this month, up from its usual five

Doozy of a Patch Tuesday includes 30 critical Microsoft CVEs

The good news: no 0-days. The bad news: busy week ahead for Microsoft admins

influencer uploads video to Vimeo. image credit: Premreuthai / Shutterstock

ShinyHunters claims dump puts 119K Vimeo emails in the wild

Vimeo points finger at analytics supplier Anodot, says no logins or card data were touched

perfect story

Brace for the patch tsunami: AI is unearthing decades of buried code debt

Britain's cyber agency says the bill for years of technical shortcuts is coming due, and it's arriving all at once

Gemini CLI

Google's fix for critical Gemini CLI bug might break your CI/CD pipelines

This CVSS 10.0 RCE vuln has been patched, automatically for some, so better check those workflows

cables

Bug of the year (so far): Nasty cPanel vulnerability probably exploited as a 0-day

Emergency patches out now for those managing the millions of domains assumed to be affected

Russian bear

Microsoft's patch for a 0-day exploited by Russian spies fell short. Another Windows flaw is under attack

Second try's a charm?

Cisco

More Cisco SD-WAN bugs battered in attacks

CISA gives federal agencies 4 days to patch

sandbox

Patch these critical Fortinet sandbox bugs that let attackers bypass login, run commands over HTTP

No reports of active exploitation (yet)

excel. home made by jude k in 2022

Ancient Excel bug comes out of retirement for active attacks

Vuln old enough to drive lands on CISA's exploited list

Locusts

Microsoft's massive Patch Tuesday: It's raining bugs

One CVE under attack, one already disclosed by angry bug hunter, and 163 more

Image composite: Microsoft and StudioLondon http://www.shutterstock.com/gallery-893620p1.html

Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum

One was patched almost 14 years ago

REG AD

roof fire

Attackers exploited this critical FortiClient EMS bug as a 0-day

CISA added the flaw to KEV after Fortinet confirmed exploitation in the wild

Illustration of a bug over some computer circuit board diagrams

Citrix NetScaler bug exploited in days, may be multiple flaws in a trench coat

Researchers say attackers are already looting vulnerable boxes

Crazy guy with power tools

Out-of-band getting out of hand as Microsoft pushes hotpatch for Bluetooth

Second emergency fix in days targets Windows 11 24H2 and 25H2

chrome

Google rushes Chrome update fixing two zero-days already under attack

Skia graphics lib and V8 JavaScript engine brings browser's tally of actively exploited bugs to three in 2026

hot

Hotpatching goes default in Windows Autopatch whether you like it or not

Microsoft insists rebootless updates are 'the quickest way to get secure'

patch

Patch these 4 critical, make-me-root SolarWinds bugs ASAP

SolarWinds + file transfer software = what attackers' dreams are made of

REG AD

Red alert symbol

CISA gives federal agencies three days to patch actively exploited Dell bug

Hardcoded credential flaw in RecoverPoint already abused in espionage campaign

bug

Attackers finally get around to exploiting critical Microsoft bug from 2024

As if admins haven't had enough to do this week

patch issues for admins

Microsoft's Valentine's gift to admins: 6 exploited zero-day fixes

Roses are red, violets are blue ... now get patching

solarwinds

Critical SolarWinds Web Help Desk bug under attack

US agencies told to patch by Friday

scream

Critical React Native Metro dev server bug under attack as researchers scream into the void

Too slow react-ion time

boot

Microsoft probes Windows 11 boot failures tied to January security updates

Some machines are failing to start after security updates, prompting yet another Microsoft investigation

updating

Patch or die: VMware vCenter Server bug fixed in 2024 under attack today

If you skipped it back then, now’s a very good time

Illustration of a software bug under a magnifying glass

Fortinet admits FortiGate SSO bug still exploitable despite December patch

Fix didn't quite do the job – attackers spotted logging in

root

Ancient telnet bug happily hands out root to attackers

Critical vuln flew under the radar for a decade

phone

Another week, another emergency patch as Cisco plugs Unified Comms zero-day

The critical-rated flaw leaves unpatched systems open to full takeover

melted-ice-cubes-drops

Microsoft admits Outlook might freeze when saving files to OneDrive

January update is the gift that keeps on giving

thief sneaking through door

Cloudflare whacks WAF bypass bug that opened side door for attackers

ACME validation had a challenge-request hole

Cloud security cloud data leak

AI framework flaws put enterprise clouds at risk of takeover

Update Chainlit to the latest version ASAP

Anthropic

Anthropic quietly fixed flaws in its Git MCP server that allowed for remote code execution

Prompt injection for the win

REG AD

Hal

Sorry Dave, I’m afraid I can’t do that! PCs refuse to shut down after Microsoft patch

Microsoft claims it's a Secure Launch bug

Late

Cisco finally fixes max-severity bug under active attack for weeks

This is a threat to security - and to the weekend for some unlucky netadmins

cloud

A simple CodeBuild flaw put every AWS environment at risk – and pwned 'the central nervous system of the cloud'

And it's 'not unique to AWS,' researcher tells The Reg

Python attacking

Popular Python libraries used in Hugging Face models subject to poisoned metadata attack

The open-source libraries were created by Salesforce, Nvidia, and Apple with a Swiss group

bug in code

Patch Cisco ISE bug now before attackers abuse proof-of-concept exploit

No reports of active exploitation … yet

Maximum-severity n8n flaw lets randos run your automation server

Unauthenticated RCE means anyone on the network can seize full control

Logitech MX Master 4 (pic: Richard Speed)

Logitech macOS mouse mayhem traced to expired dev certificate

Company says it dropped the ball, apologizes for wasting people's time

hesitant looking man offers up christmas present

An early end to the holidays: 'Heartbleed of MongoDB' is now under active exploit

You didn't think you'd get to enjoy your time off without a major cybersecurity incident, did you?

Windows update

Microsoft rushes an out-of-band update for Message Queuing bug

Redmond gets in early for the twelve whoopsies of Christmas

perfect 10

HPE tells customers to patch fast as OneView RCE bug scores a perfect 10

Maximum-severity vuln lets unauthenticated attackers execute code on trusted infra management platform

Scared looking office consultant hides under desk

Apple, Google forced to issue emergency 0-day patches

Both admit attackers were already exploiting the bugs, with scant detail and hints of spyware-grade abuse

0-day

Microsoft RasMan DoS 0-day gets unofficial patch - and a working exploit

Exploit hasn't been picked up by any malware detection engines, CEO tells The Reg

React

New React vulns leak secrets, invite DoS attacks

And the earlier React2Shell patch is vulnerable

Chrome icon on sandy beach

Google fixes super-secret 8th Chrome 0-day

No details, no CVE, update your browser now

patch

Microsoft reports 7.8-rated zero day, plus 56 more in December Patch Tuesday

Plus critical critical Notepad++, Ivanti, and Fortinet updates, and one of these patches an under-attack security hole

quiet

Microsoft quietly shuts down Windows shortcut flaw after years of espionage abuse

Silent Patch Tuesday mitigation ends ability to hide malicious commands in .lnk files

hacked

'Exploitation is imminent' as 39 percent of cloud environs have max-severity React hole

Finish reading this, then patch

android reclines on a keyboard on smartphone

Two Android 0-day bugs disclosed and fixed, plus 105 more to patch

Christmas comes early for attackers this year

Cyber Crim

Fortinet 'fesses up to second 0-day within a week

Attackers may be joining the dots to enable unauthenticated RCE

Zero day

Google Chrome bug exploited as a 0-day – patch now or risk full system compromise

Seventh Chrome 0-day this year