Cloud & Enterprise
Cloud and enterprise IT covers identity, access, SaaS, hybrid infrastructure and corporate attack surfaces. The analysis helps readers follow risks, incidents and architectural decisions relevant to complex environments.
CVE-2026-19397: Unauthenticated RCE in ASUS Control Center Express Agent
A critical flaw in the ASUS Control Center Express Agent exposes managed workstations to unauthenticated remote code execution via a p…
NI LabVIEW: Integer Overflow in VI File Parsing Exposes Sensitive Data
CVE-2026-18445 affects VI file parsing in NI LabVIEW. The ZDI-26-630 advisory details an integer overflow requiring user interaction t…
Azure Entra ID: OAuth Device Code Grant Flaw Exposes Arbitrary Tenant Data
ZDI advisory ZDI-26-629 discloses a pre-disclosure vulnerability in the Azure Entra ID OAuth Device Code Grant endpoint. Unauthenticat…
Oracle Outside In: RCE via WPS File, Patch Released September 9, 2026
ZDI-26-638 documents a remote code execution vulnerability in the WPS parser of Oracle Outside In Technology 8.5.8. The CVSS score is…
BAS at Machine Speed: The Structural Collapse of Disclosure-to-Exploit
The window from disclosure to weaponized exploit has collapsed to roughly 10 hours. Defensive controls stop 69% of attacks, but only 1…
SAP Patches OVERPASS: Maximum-Severity Kernel Bug Opens ERP Systems to Unauthenticated RCE
SAP released the September 2026 patch for CVE-2026-44756, a maximum-severity kernel vulnerability that allows unauthenticated remote c…
Ransomware Negotiations Evolve into Structured Business Process with Specialized Roles
Intel 471 documents how ransomware groups have industrialized extortion with researchers, negotiators, and pricing calibrated to victi…
FalconFlank Exposes the EDR Paradox: Protection Becomes Attack Surface
Researcher Nightmare Eclipse released FalconFlank, a working zero-day privilege escalation PoC against CrowdStrike Falcon Sensor. The…
Weekly Report Flags Operational Shift to Offensive AI: 10 Hours
Check Point Research's September 7, 2026 Threat Intelligence Report documents the first enterprise intrusion compressed to under 10 ho…
Panzer RaaS: 16 Victims Across 11 Countries With Anomalous Maturity
Panzer is a new Ransomware-as-a-Service operator with a leak site active since August 5, 2026. It supports Windows, Linux, ESXi, and F…
HPE Patches Critical RCE in ArubaOS-CX: Two Independent Exploit Paths in the Same Switch
HPE released patches for 34 CVEs in ArubaOS-CX. Two independent unauthenticated RCE vulnerabilities in the same bulletin point to a sy…
The 12-Step KEV Workflow Pushes Companies Toward 24-Hour Patching, But the Regulation Doesn't
Tech-insider.org has published a 12-step operational workflow for managing CISA's Known Exploited Vulnerabilities (KEV) catalog. The 2…