All articles tagged with #patching
Google Chrome’s security team is accelerating patch cadence to twice-weekly updates after AI-assisted vulnerability discovery flagged a flood of bugs, with June alone delivering fixes for 1,072 vulnerabilities—the most in a single period—and signaling a shift toward AI-driven triage, structural hardening (e.g., Rust rewrites), and a new normal of frequent security updates.
Google is pursuing Chrome updates that don’t require a restart, using dynamic patching and AI-powered tooling to fix bugs with minimal disruption. With Chrome 149–150 delivering over 1,000 fixes and a planned two-week release cycle (plus potential two weekly security updates), Google aims to reduce N-day attack risk and trigger automatic seamless session restores during opportune restart moments.
Microsoft is expanding AI-driven vulnerability discovery across Windows to identify issues earlier, accelerate fixes, and deliver more frequent security updates via the MDASH harness and the ACS team, integrating vulnerability discovery into the development lifecycle while maintaining human review to ensure quality. The shift will raise the number of updates per release, challenging IT admins to test and deploy patches—and use Known Issue Rollback and tools like Windows Autopatch to balance speed with stability, even as some experienced engineers depart.
AI agents are increasingly autonomously finding software flaws and crafting exploits, upending bug-bounty economics as researchers log far more discoveries and attackers speed up development. Major programs are trimming or shifting payouts (Curl’s bounty ended; Google adjusted Chrome/Android rewards) and experts warn that faster zero-days and compressed disclosure windows could pressure quicker patches. The trend, including industry calls for structural defenses and architecture changes, suggests a future where human-led bug hunting remains essential but must be complemented by better-infrastructure that makes many bugs irrelevant.
Security researchers say CVE-2026-42945, a heap buffer overflow in NGINX Open Source and NGINX Plus, is being actively exploited in the wild. The flaw can crash NGINX worker processes via crafted requests, with remote code execution possible only if ASLR is disabled and a specific rewrite configuration is present; despite ASLR generally enabled, estimates show up to 5.7 million internet-facing servers may be affected. Organizations should patch promptly, ensure ASLR remains enabled, and audit rewrite rules to mitigate risk while threat actors rapidly scan for vulnerable systems.
A high-severity Linux kernel local privilege-escalation flaw, Fragnasia (CVE-2026-46300), lets an unprivileged attacker write to the kernel page cache via the XFRM ESP-in-TCP subsystem to gain root; patches are rolling out for all affected kernels, and a PoC exists. Mitigations include removing vulnerable modules esp4, esp6, and rxrpc with modprobe.d, though this can disrupt AFS and IPsec VPNs. The bug is part of the Dirty Frag family; CISA has also flagged Copy Fail as actively exploited in the wild.
Linux is hit by a second major kernel vulnerability in weeks, dubbed Dirty Frag, which chains two flaws to allow untrusted users to gain root access by manipulating page caches. Patches are rolling out from Debian, AlmaLinux, and Fedora, but many distributions haven’t yet applied fixes and a reboot may be required. The exploits target esp4/esp6 and rxrpc paths, with public PoCs and signs of limited in-the-wild activity. Administrators should apply patches and mitigations promptly, especially in shared environments or virtual machines, to prevent potential root compromise.
Mega Crit explained their patching approach for Slay the Spire 2 in early access: changes are tested, not permanent, and driven by player feedback, collected metrics, and design philosophy. The beta branch is the most useful place to provide input while updates are expected to be ongoing for 1-2 years to balance the game toward the feel of Slay the Spire 1.
Microsoft disclosed a critical zero-day in SQL Server (CVE-2026-21262) that enables an authenticated attacker to escalate to the sysadmin role via improper access control. The flaw has a CVSS v3.1 base score of 8.8 (Important) and is exploitable over the network with low complexity and no user interaction. While not yet observed in the wild, the disclosure lowers the barrier for exploits. Microsoft has released patches for SQL Server 2016–2025; administrators should urgently apply updates, audit permissions, restrict privileged access, and upgrade unsupported versions to receive future fixes.
CISA added four flaws to the Known Exploited Vulnerabilities catalog due to active exploitation: CVE-2026-2441 (Chrome use-after-free), CVE-2024-7694 (TeamT5 ThreatSonar Anti-Ransomware arbitrary file upload leading to command execution), CVE-2020-7796 (Zimbra Collaboration Server SSRF), and CVE-2008-0015 (Windows Video ActiveX buffer overflow). Google confirms an in-the-wild exploit for CVE-2026-2441; GreyNoise documents about 400 IPs exploiting CVE-2020-7796 across several countries; the CVE-2008-0015 exploit can download additional malware like Dogkild and alter system files/hosts. The TeamT5 exploitation vector remains unclear. Federal agencies are urged to patch by March 10, 2026.
Threat actors are actively exploiting BeyondTrust CVE-2026-1731 (CVSS 9.9) in the wild by abusing get_portal_info to harvest the x-ns-company value before WebSocket setup, enabling unauthenticated remote code execution; BeyondTrust notes PRA v25.1+ do not require patching, while RS requires the BT26-02-RS patch (v21.3–25.3.1) and PRA patch (BT26-02-PRA, v22.1–24.X); watchTowr, GreyNoise/Defused Cyber, and Arctic Wolf report rapid activity and persistence attempts using SimpleHelp and PSexec; CISA added CVE-2026-1731 to KEV with federal patch deadlines by Feb 16, 2026, and KEV also lists other flaws (CVE-2026-20700, CVE-2025-15556, CVE-2025-40536, CVE-2024-43468).
CISA warns that the actively exploited VMware vCenter Server remote-code-execution flaw CVE-2024-37079 is being used in the wild and orders U.S. federal agencies to patch within three weeks, citing a DCERPC heap overflow that enables easy remote control with no user interaction. Broadcom notes there are no mitigations, advising immediate patches to the latest vCenter Server and Cloud Foundation releases.
Microsoft's November 2025 Patch Tuesday addresses 63 vulnerabilities across its ecosystem, including one zero-day actively exploited in the wild, emphasizing the urgent need for immediate patch deployment to mitigate risks from critical flaws in Windows, Office, Azure, and other products.
Over 29,000 Microsoft Exchange servers remain unpatched against a high-severity vulnerability (CVE-2025-53786) that could allow attackers to escalate privileges and compromise entire domains, prompting urgent mitigation efforts by U.S. federal agencies and warnings for organizations worldwide.
A high-severity directory traversal vulnerability in SolarWinds Serv-U file transfer software (CVE-2024-28995) is being actively exploited, allowing attackers to read sensitive files. The flaw affects all versions up to Serv-U 15.4.2 HF 1 and has been patched in version 15.4.2 HF 2. Users are urged to update immediately to mitigate potential threats, as public proof-of-concept exploits make it easy for attackers to leverage this vulnerability.