Arista has published Security Advisory 0183 warning of a critical vulnerability in on-premises VeloCloud Orchestrator (VCO), tracked as CVE-2026-93952. The advisory, dated September 22, 2026, assigns the flaw a CVSS 3.1 base score of 10.0, indicating the highest level of severity. The issue is caused by improper input validation and is already being actively exploited, making immediate assessment and remediation essential for affected organisations.  The vulnerability could allow a remote, unauthenticated attacker to access privileged internal functionality and compromise the VCO host. Successful exploitation may affect the confidentiality, integrity and availability of the orchestrator, including data managed by it. Arista said the issue affects on-premises VCO deployments, while hosted and dedicated VCO versions have already been patched. The affected software includes VCO 5.2.3.15 and earlier in the 5.2.x series, 6.1.3.7 and earlier in the 6.1.x series, 6.4.2.7 and earlier in the 6.4.x series, and 7.0.0.2 and earlier in the 7.0.x series.  An affected deployment requires certificate-based authentication between a VeloCloud Edge and VCO, access to the public portion of the Edge authentication certificate, and network access to the VCO web interface. Tenant or operator credentials are not required. Organisations that limit the VCO web interface to trusted administrative networks can reduce exposure, although this should be treated as a temporary defensive measure rather than a complete solution. Arista’s EOS-based networking products and several other listed Arista platforms are not affected by this vulnerability.  Administrators should inspect VCO web-access, backend application and system logs for unusual requests, encoded URL components, references to internal services or unusually high request rates. Other warning signs include unexpected outbound traffic, unauthorized configuration changes, unexplained maintenance actions, command execution, file creation, database exports or access to credentials and certificates. Arista specifically identified suspicious files, the x-vc-opt HTTP header and connections from 142.93.149.77 and 104.248.126.159 as indicators requiring investigation.  Arista recommends upgrading to a remediated VCO release as soon as possible. Fixes are available in VCO 5.2.3.16 and later within the 5.2.3 train, and VCO 6.4.2.8 and later within the 6.4.2 train; fixes for other release trains will be added. Until then, organisations should restrict web access, monitor inbound and outbound activity, review administrator actions and watch for backdoors or webshells. If compromise is suspected, operators should preserve relevant logs and file timestamps before remediation, contact Arista TAC, rotate credentials, validate managed Edge devices and consider rebuilding the orchestrator from trusted sources.

TL;DR GitLab recently released versions 19.3.1, 19.2.5, and 19.1.7 to address multiple critical flaws. This GitLab EE security patch resolves a high-severity flaw allowing arbitrary command execution within the Duo Claude AI agent. Administrators must apply these updates to secure their self-managed installations immediately. Why the Vulnerability Matters The most critical issue, CVE-2026-18252, scores an 8.7 on the CVSS scale. This flaw permits an authenticated user with developer permissions to execute arbitrary commands.

 Skipping Windows updates may seem harmless, especially when an update requires a restart or temporarily changes familiar settings. Many users postpone updates because they fear slower performance, bugs, or interruptions during work. However, Windows updates are not limited to new features and interface changes. They also contain important security patches that repair weaknesses discovered by Microsoft, cybersecurity researchers, customers, and attackers. When these updates are ignored, a computer can remain exposed to vulnerabilities that criminals already understand how to exploit.  Once Microsoft releases a patch, attackers can study it to identify the weakness it fixes. They can then search for computers that have not installed the update and target them with malware or other attacks. An unpatched Windows system may face threats such as remote code execution, privilege escalation, ransomware, credential theft, and boot-level compromise. These attacks do not always produce immediate warning signs. A computer may appear to work normally while malicious software quietly steals information, monitors activity, or prepares a larger attack.  PrintNightmare, identified as CVE-2021-34527, demonstrates how quickly a Windows vulnerability can become dangerous. After public proof-of-concept exploits began circulating in 2021, Microsoft issued emergency updates because exploitation had already been detected. Users who delayed installing the fixes increased the risk that attackers could gain control through the Windows Print Spooler service. The incident showed that waiting for a convenient time to update can be risky when details about a vulnerability and its exploit are already publicly available.  The WannaCry ransomware outbreak provides an even more dramatic example. Microsoft had released a patch for the exploited SMB vulnerability in March 2017, but many organizations and individuals had not installed it or were still using older, unsupported Windows versions. When WannaCry spread in May, it affected more than 300,000 computers across 150 countries, disrupting hospitals, factories, businesses, and other services. The outbreak proved that a single neglected update can allow malware to spread rapidly across connected networks.  The safest approach is to install Windows updates as soon as practical, while choosing an appropriate time for the restart. Users should also maintain backups, use reputable security software, and avoid keeping unsupported Windows versions connected directly to the internet. Although updates can occasionally cause inconvenience, a short installation and reboot are usually far less costly than recovering from ransomware, stolen credentials, or a compromised system. Keeping Windows updated is therefore one of the simplest and most effective ways to reduce everyday cybersecurity risks.

 Apple has issued a major set of security updates for macOS, iOS, and iPadOS after discovering dozens of vulnerabilities in WebKit, the browser engine that powers Safari and many apps across its platforms. The latest macOS Tahoe update fixes 28 flaws, 21 of them in WebKit, while older-device releases such as iOS 18.7.10 and iPadOS 18.7.10 address more than 120 bugs, including more than 40 WebKit issues.  These bugs are serious because they affect the core component used to display web content, making malicious websites a practical attack path. Apple has not reported active exploitation in the wild, but the company urges users to install the patches quickly. The WebKit flaws can cause a wide range of problems, from Safari or process crashes to memory corruption and sensitive data disclosure.  Some of the issues could also allow attackers to bypass sandbox protections or exfiltrate data across origins, which raises the risk of unauthorized access to private information. On macOS, additional fixes in Audio, ImageIO, IOGPUFamily, and Kernel address risks such as denial-of-service, arbitrary code execution, system termination, and kernel memory corruption. That combination makes the update important not only for browser safety, but for overall device stability and privacy.  The most immediate recommendation is to install the updates as soon as they are available through the device’s normal software update settings. Users should not delay simply because no public exploitation has been announced, since browser-engine flaws are often attractive to attackers once details become known. Organizations should prioritize patching managed Macs, iPhones, and iPads, especially devices used for email, browsing, and access to corporate systems. It is also wise to confirm that older supported versions receive the correct maintenance release, since Apple issued separate fixes for newer and legacy branches.  After updating, users should still practice cautious browsing habits. Avoid opening unfamiliar links in email, text messages, or social media posts, because malicious web content is the most likely delivery method for WebKit exploits. Security teams should monitor for unusual browser crashes, authentication anomalies, or unexpected data leakage, which can be early warning signs of abuse.  If a device cannot be updated immediately, limiting web exposure and using a trusted content filter can reduce risk until patches are applied. This release is a reminder that browser engines remain a high-value target for attackers because they sit between users and the web. Apple’s broad patch set shows that a single update can close multiple pathways to compromise across consumer and enterprise devices. For most users, the safest approach is simple: update first, browse carefully, and keep security features enabled.

Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an

Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an

Zimbra's patch addresses critical SNMP command injection and XSS vulnerabilities. Users must prioritize updates for robust security.

Zimbra security patch for stored XSS vulnerability raises questions. Is it a stopgap measure or a genuine solution for users at risk?