Apple Pulled iOS 27 Security Fixes Back Into iOS 26. AI Is Compressing the Patch Window.
Apple has moved fixes from next-generation betas into current systems. AI is shrinking the time enterprises have to test, approve and deploy patches.
Security
Vulnerabilities, defensive security, architecture and operational security.
Your WordPress Site Wasn’t the Victim. It Became the Attacker’s Infrastructure.
A compromised website is usually treated as the end of an incident: clean the files, reset credentials, restore the page and move on. The StopAndProtect operation shows why that model is incomplete. Almost 2,000 hijacked WordPress domains were not merely…
A Breach Reached 1.2 Million Latvians. The Records Went Back to 2008.
Attackers stole historical CSDD payment-receipt data affecting 1.2 million people. The breach combined national-scale identity data with vehicle, address, and payment history dating back to 2008.
Oracle’s August Patch Map: 943 Fixes, 182 Unauthenticated Middleware Paths
Oracle’s August 2026 security update contains 943 new patches. Fusion Middleware alone accounts for 262, including 182 vulnerabilities that may be remotely exploitable without credentials.
A Payment Archive From 2008 Exposed Two-Thirds of Latvia.
A cyberattack on Latvia’s Road Traffic Safety Directorate exposed payment-receipt records belonging to 1.2 million people and 200,000 legal entities. The archive stretched back to 2008 and linked identity data to addresses, vehicle registration plates, payment dates, and amounts. The…
The Database Login Became a Shell: PostgreSQL’s Time-Zone Bug Now Has a Public RCE Exploit
A public exploit for CVE-2026-14669 turns a low-privilege PostgreSQL login into host-level command execution. The released chain is build-specific, but the trust boundary has been crossed in a reproducible lab.
GitLab Issued an Out-of-Band Critical Patch. ‘Public’ Could Become ‘Writable’ Without a Login.
GitLab's out-of-band critical patch closes an unauthenticated GraphQL path that could modify or delete public projects and user data. Self-managed operators should upgrade immediately and review retained activity without assuming compromise.
A Faulty Update Opened a €30 Million Fraud Window. Four Days of Controls Did Not Close It.
A faulty provider update enabled approximately €30 million in fraud. The case shows why payment integrity needs controls beyond software testing.
MyDr May Have Exposed Data on Half of Poland. The Concentration Risk Is the Bigger Story.
MyDr cannot yet confirm the breach scope, while officials cite nearly 19 million people. The platform concentration risk is already clear.
The Cyberattack Was Part of the Strike Package: Ukraine Targeted Wildberries Online and Offline.
Ukraine says cyber disruption amplified strikes on Wildberries warehouses. The effects remain unverified, but the combined-operation model matters.