Google’s AI chips are suddenly everywhere except inside Google’s own cloud. OpenAI is reportedly planning to buy Google’s Tensor Processing Units outright, according to The Information, and Oracle has announced it will offer Google TPUs on Oracle Cloud Infrastructure starting in 2027. Together, the two stories show the same shift: Nvidia’s biggest customers want a…
Magento PolyShell Explained: CISA Adds the Adobe Commerce Upload Flaw to Its Exploited List as 953 Stores Are Hit
On October 27, 2026, the US Cybersecurity and Infrastructure Security Agency added a long-running online store flaw to its Known Exploited Vulnerabilities catalog. The flaw, known as PolyShell and tracked as CVE-2026-48356, affects Adobe Commerce and Magento Open Source. CISA now lists it as actively exploited, and US federal civilian agencies must remediate it by…
Microsoft Authenticator AuthMask Flaw Explained: How a Zero-Permission Android App Could Steal Work Account Tokens
Direct answer: A flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and nicknamed AuthMask, let a malicious app with no Android permissions pose as a trusted Microsoft app such as Teams and receive sign-in tokens for a work account. Microsoft fixed it in Authenticator for Android version 6.2606.4246. If you use Authenticator on Android,…
Tailworm Tailscale SSH Flaws Explained: 11 Findings, No Patch Yet, and How to Lock Down Access
Direct answer: Tailworm is a set of 11 reported flaws in Tailscale SSH, published October 25, 2026, that could let an attacker who already controls one permitted device reach root on other servers that device is allowed to connect to. There is no patch, no CVE number, and no Tailscale security bulletin for these findings…
Node2Shell Hits Go: Traefik, Fiber and Iris Now in Scope, What to Patch
Direct answer: On October 25, 2026, Sweet Security disclosed that the Node2Shell Brotli flaw also exists in a Go implementation of the Brotli library, with a parallel fix pushed on October 23. That puts Go-based HTTP infrastructure in scope, including Traefik, Fiber, Iris and fasthttp, even if your team already patched Node.js and PHP. Dependency…
Quest Diagnostics Data Breach Explained: Patient Records Accessed Through Quanum Lab Portal
Short answer: Quest Diagnostics confirmed that an unauthorized party accessed certain patient records through its Quanum Lab Services Manager system, which doctors and clinics use to order lab tests and look up results. The company discovered the access on October 21, 2026, disclosed it in a U.S. Securities and Exchange Commission filing on October 22,…
GitLab CVSS 10.0 Flaw (CVE-2026-110264) Explained: What to Patch and Why the October 12 Fix Is Not Enough
Direct answer: If you run a self-managed GitLab server, upgrade now to the fixed release for your branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. GitLab patched CVE-2026-110264 on October 21, 2026, a maximum-severity CVSS 10.0 flaw that, under certain conditions, could let an unauthenticated attacker run arbitrary code on the server. Crucially, servers…
HPE Aruba AOS Flaws Explained: 72 Vulnerabilities, Eight Rated 10.0, and What to Patch Now
If you run HPE Aruba wireless networking gear, upgrade AOS-8 or AOS-10 to a fixed release now. HPE’s security bulletin HPESBNW05162, published on October 22, 2026, patches 72 vulnerabilities in the wireless operating systems that run Aruba Mobility Conductors, Mobility Controllers, Mobility Gateways, and access points. Eight of those flaws carry the maximum CVSS score…
Collabora Online Flaw (CVE-2026-110447) Explained: How Attackers Backdoored Nextcloud Servers and What to Patch Now
If you run Nextcloud with the Collabora Online Built-in CODE Server app installed, update it to version 26.4.303 or later, or remove it completely. That is the direct answer to CVE-2026-110447, a critical command injection flaw that attackers have already used to plant web shells on Nextcloud servers. Disabling the app does not fix the…
HTTP2Shell Explained: The Brotli Flaw Behind Node2Shell Now Hits Bun, Python and Envoy
Short answer: HTTP2Shell is the new, wider name for CVE-2026-111497, a flaw in Google’s Brotli compression decoder that was first widely reported as Node2Shell. It is one vulnerability, not a second bug. The reason it has a new name is that the same decoder code turns up in far more software than Node.js alone, including…