Ray is an AI compute engine. CISA added CVE-2025-62593 to KEV on 17 August 2026. The Ray GitHub advisory describes a code-injection issue in versions before 2.52.0. Patch to 2.52.0. Do not expose developer Ray services to untrusted networks. The Ray advisory rates it 9.4 Critical under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Correction (27 Oct 2026): the CVSS fields now show the advisory's CVSS 4.0 score and vector; an earlier version paired the 9.4 score with a CVSS 3.1 vector. (source: Ray advisory)
Apple released iOS 26.6.1 and iPadOS 26.6.1 and macOS Tahoe 26.6.2 on 17 August 2026 (security-content pages published 20 August). The iOS advisory includes ImageIO integer overflow CVE-2026-65346, where processing an image may lead to arbitrary code execution; Telephony CVE-2026-65329, where an attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic (iPhone 11 and later); Kernel use-after-free CVE-2026-65343 (remote unexpected system termination); and multiple WebKit memory-safety issues. Apple does not publish CVSS scores on that page. Safari 26.6.1 followed on 18 August for macOS Sonoma and Sequoia. This is separate from CVE-2026-65400 (macOS Screen Sharing), which CISA added to KEV on 18 August.
Apple: iOS 26.6.1 and iPadOS 26.6.1 security content
Linux kernel CVE-2026-72018 (published 15 August 2026; XBOW research write-up 28 September 2026) is an out-of-bounds write in dibs_loopback move_data(): the software SMC-D loopback path memcpy'd into a registered DMB without checking offset+size against DMB length. A local user with CAP_NET_ADMIN can stage a malicious SMC-D peer over loopback, drive a constrained zero-write past the buffer, and escalate to root (XBOW demonstrated reliable LPE). CNA CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected from the 6.10-era DIBS loopback introduction; fixed in stable trains including 6.12.97, 6.18.40, 7.1.5 and 7.2 (per CVE.report / Linux CNA). (sources: CVE.report; kernel stable commits; XBOW)
Microsoft Security Update Guide CVE-2026-69414 is an elevation of privilege in the Microsoft Malware Protection Engine (ShieldBreak): CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), Important. August reporting described a public local PoC to SYSTEM when Defender is enabled, including as a bypass of RoguePlanet (CVE-2026-50656). BleepingComputer (9 September 2026) says Microsoft shipped a ShieldBreak fix in the September 2026 Patch Tuesday set, and that researcher Nightmare Eclipse then released a "ShieldCrash" proof-of-concept claiming the patch is incomplete under specific conditions — arbitrary file read as SYSTEM on fully patched Windows 10/11/Server, without write access in the published skeleton PoC. Treat ShieldCrash as secondary researcher claim until MSRC documents a new CVE or revises 69414. Watch MSRC for engine build requirements; do not equate a public PoC with confirmed in-the-wild exploitation.
PostgreSQL's own security page for CVE-2026-6471 (fix published 13 August 2026) describes missing authorisation in logical decoding: a non-superuser with REPLICATION privilege can cause the server to dlopen any file visible to the OS account running PostgreSQL by choosing the logical decoding plugin path, which runs arbitrary code as that account. Affected before 18.6, 17.11, 16.15, 15.19, and 14.24; fixed in those builds. Vendor CVSS 3.0 is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Cyera's PostGREShell research (covered by SecurityWeek on 4 September 2026) explains how replication-protocol plugin loading can be abused for RCE, privilege escalation and persistence when REPLICATION is granted to backup or monitoring accounts. Inventory roles with REPLICATION, patch to the fixed minor releases, and do not treat REPLICATION as a low-privilege convenience grant.
Nick Scali Limited's 13 August 2026 ASX release says it is investigating a security incident and elected to take certain systems offline. The company said it was bringing those systems back online, continuing to complete sales orders and deliveries, with slower-than-normal customer response times. At the time of the release, Nick Scali said it did not have any evidence of unauthorised access to customer data. It notified the Australian Cyber Security Centre and the Australian Federal Police, and said further updates would follow as appropriate. The Sydney Morning Herald (13 Aug) reported that chief executive Anthony Scali said the incident happened 'about mid-last week' and that staff were referring to manual records to get in touch with customers whose orders had been affected. UPDATE (22 Oct 2026): in an email to customers reported by the NZ Herald on 10 September, Nick Scali said details on sales orders, including name, email address, delivery address and phone number, were affected, and that no credit card details are recorded on sales orders because card payments go through a third-party provider. In its 21 October 2026 ASX trading update, Nick Scali said the incident left its ERP systems unavailable for about three weeks, with stores processing sales orders manually, and that about $980,000 of direct consultant and legal costs will be reported outside underlying net profit. Capital Brief, citing The Australian, reported that Nick Scali hired an intermediary to negotiate; Nick Scali has not confirmed this in its ASX releases. CORRECTION (22 Oct 2026): this card earlier said customer-data access was not verified; Nick Scali has since told customers that sales-order details were affected (source: NZ Herald, 10 Sep 2026). Correction (01 Nov 2026): removed attacker claims that no company, regulator or outlet independently confirmed. (source: Capital Brief)
Google announced Gemini 3.7 Flash on 13 August 2026 as its current Flash workhorse for coding and agents, three weeks after 3.6 Flash. Gemini Spark for Google AI Pro and Ultra subscribers uses 3.7 Flash from that day. Google says the model ships with updated CBRN and cyber-offense safeguards. Introductory API pricing is listed as $0.75 per million input tokens and $3.75 per million output tokens through 31 December 2026.
WordPress 7.0.4 (12 August 2026) is a security release. An Author or anyone with upload_files can upload a malicious PostScript file and reach remote code execution, but only where Imagick and Ghostscript are both in use. WordPress credits pwn.ai. GitHub advisory GHSA-8vr3-7mxf-gx8w scores it 8.8 (CVSS 3.0). Fixed in 7.0.4, with backports through the 4.7 branch (6.9.7, 6.8.8, and the matching older branch builds). No exploitation claim on the WordPress or GitHub notices.
Palo Alto Networks 12 August 2026 advisory: local privilege-escalation bugs in the GlobalProtect app let a local user reach NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux, then run commands with administrative privileges. iOS, Android and Chrome OS are not affected. Vendor CVSS-BT is 5.9 (CVSS 4.0); the same advisory lists CVSS-B 8.5 without the exploit-maturity modifier. Palo Alto Networks says it is not aware of malicious exploitation. Same-day GlobalProtect app advisories cover CVE-2026-0295 (macOS race-condition LPE, CVSS-BT 4.1), CVE-2026-0296 (certificate-validation bypass of app traffic, not the VPN tunnel, CVSS-BT 4.5), CVE-2026-0297 (UDP tunnel handshake buffer overflow, CVSS-BT 5.2) and CVE-2026-0298 (Windows PLAP MitM code execution, CVSS-BT 5.2 / CVSS-B 7.7). Those sibling advisories show Updated 2026-09-12 on the PSIRT hub; Palo Alto Networks still says it is not aware of malicious exploitation. PAN-OS URL Filtering information disclosure CVE-2026-0301 (CVSS 1.7) was also published 12 August. Prisma Access Agent LPE CVE-2026-0294 (CVSS-BT 6.0; patch 26.3+) remains a related same-day PSIRT item.
CVE-2026-65660 is a SharePoint Server code-injection RCE: an authorized low-privilege attacker can execute code over the network without user interaction. CVSS 3.1 8.8 (High), Microsoft CVE record (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affects SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition before 16.0.5565.1001, 16.0.10417.20198 and 16.0.19725.20522 respectively; Microsoft’s advisory reference is tagged as a patch. (source: Microsoft CVE record) Updated (01 Oct 2026, 13:00 AWST): WA SOC advisory 20261001001 (TLP:CLEAR) restates CVE-2026-65660 (CVSS 8.8 High) as an authenticated low-privilege code-injection RCE on SharePoint Server 2016/2019/Subscription Edition, notes CISA KEV listing, gives the build floors above, links Microsoft’s advisory, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. (source: WA SOC) Microsoft’s CVE record (updated 31 Oct 2026, 01:20 AWST) rates exploitation as unproven (E:U in its CVSS 3.1 vector). (source: Microsoft CVE record) CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on 25 Sep 2026. (source: CISA KEV) The two sources differ on whether this flaw has been exploited. Updated (01 Nov 2026): added Microsoft’s current exploitability rating and CISA’s KEV listing, which differ, and WA SOC’s patch-timing advice. (sources: Microsoft CVE record; CISA KEV; WA SOC) Correction (01 Nov 2026): removed the SecurityWeek link and credit, which this desk cannot read, and an update that only SecurityWeek gave; removed details that only The Hacker News gave; removed the MSRC link, which this desk cannot read; removed an incorrect, unsourced line about other KEV additions; removed patch advice no source gives; and removed an update date no source gives. (sources: Microsoft CVE record; CISA KEV)
CVE Program — CVE-2026-65660 record (CNA: Microsoft; updated 31 Oct 2026 01:20 AWST; CVSS 3.1 exploitability E:U)
Microsoft patched CVE-2026-62911 in the August 2026 Patch Tuesday cycle: authentication bypass by capture-replay in Exchange Server that lets an authorised attacker elevate privileges over the network and take over user mailboxes (send, read, download attachments). Affected products named in coverage include Exchange Server 2016, 2019 and Subscription Edition. On 1 September 2026 BleepingComputer reported Shadowserver observing 21,899 internet-exposed Exchange fingerprints still unpatched (largest counts in the United States and Germany), and relayed NCSC-NL guidance that exploit code is available and that Exchange 2016/2019 security updates require the Extended Security Updates programme. Germany's BSI separately warned that a large share of on-premises Exchange in Germany remained vulnerable. Cyberstack has not seen a CISA KEV listing for CVE-2026-62911 at write-up. NEW 8 Sep AU: iTnews cites Shadowserver counts of 382 Australian and 56 New Zealand Exchange hosts still vulnerable as of 31 August 2026; NCSC-NL (28 Aug) said public PoC exists and warned unauthenticated attackers could potentially achieve arbitrary code execution; ASD urges patching or network segmentation for legacy Exchange; coverage rates CVSS 3.1 as 8.0. Patch promptly; do not leave legacy Exchange on the public internet.
Microsoft's 11 August 2026 Patch Tuesday fix (MSRC CVE-2026-63520) addresses improper input validation in on-premises SharePoint that lets an unauthorised attacker execute code over the network. NVD scores it 8.1 (CVSS 3.1, High, attack complexity High). Rapid7, which co-disclosed with Microsoft, says the bug is unsafe .NET type instantiation in Business Connectivity Services and that chaining it with the July auth bypass CVE-2026-55040 yields unauthenticated RCE. August security updates cover SharePoint Server Subscription Edition (KB5002893), SharePoint Server 2019 (KB5002894 / KB5002896), and SharePoint Enterprise Server 2016 (KB5002905 / KB5002906). Public PoC material for the RCE half appeared around 24 August; Defused later reported honeypot probes of the 55040+63520 chain (JWT bypass exercised, BCS probing, no code execution observed in that report). Microsoft had not labelled 63520 as exploited in the wild at last magazine check. Prefer the August updates; do not leave on-prem SharePoint internet-facing without need.
