What's on our radar

October 2026

Two PHP flaws allow unauthenticated code execution on web servers and are exploited within a week, Next.js and React patch critical RCEs, browsers distrust eight compromised eMudhra intermediates, attackers hijack LiteLLM's release pipeline and UpdraftPlus connection keys to push malware, an exploited Drupal Commerce flaw and WordPress 7.1.4 need urgent updates, Ivanti's zero-day grows into a three-flaw chain and ASD launches the Essentials.

September 2026

Attackers exploit two NetScaler pre-auth zero-days and a critical WordPress core flaw within a day of its patch, Chrome fixes two exploited V8 bugs, typosquatted Terraform providers deliver a backdoor, Next.js rushes out an RCE fix and the EU Cyber Resilience Act's 24-hour vulnerability reporting clock starts for software makers.

August 2026

A self-spreading npm worm publishes malware with valid provenance, a libheif flaw gives pre-auth code execution through Next.js and Astro image optimisation, ASD sees TeamCity and N-central servers exploited in Australia, attackers hit Kemp and NetScaler appliances and Debian 11 leaves long-term support.

July 2026

PSPF Release 2026 makes post-quantum transition planning mandatory, an nginx flaw rated major can crash workers and may allow code execution, Node.js patches eleven vulnerabilities across all release lines, npm begins scanning packages at publish time and Drupal AI restructures its governance.

June 2026

Red Hat npm packages are compromised with a credential-stealing worm, OpenSSL patches 18 vulnerabilities across five public release lines, a Drupal core security window patches critical JSON:API object injection, ASD consults on evolving the Essential Eight and Astro 7.0 ships with a Rust compiler and faster builds.

May 2026

A highly critical Drupal core security release lands, a Twig flaw allows PHP code execution and a full sandbox escape, nginx patches six CVEs, then a rewrite-module flaw nine days later, Next.js patches a High middleware bypass via segment-prefetch routes and Privacy Act coverage of tranche 2 AML entities takes effect from 1 July.

April 2026

Drupal core patches a critical cross-site scripting flaw, Home Affairs proposes a stronger Hosting Certification Framework, curl 8.20.0 fixes eight flaws including four credential or cookie leaks, Node.js 20 reaches end of life and WordPress 7.0 is rescheduled to 20 May.

March 2026

The axios npm package is hijacked to deliver cross-platform malware, the TeamPCP campaign compromises Trivy, KICS, LiteLLM and Telnyx, Cyera discloses a new LangChain path traversal flaw, a critical access bypass hits the Unpublished Node Permissions module and the maximum TLS certificate lifetime drops to 200 days.

February 2026

A critical XSS flaw hits Drupal's SAML SSO Service Provider module, GitHub pushes self-hosted runner version enforcement to 16 March, maximum certificate lifetimes drop to 200 days from 15 March, WordPress 6.9.1 fixes 49 bugs and Canberra releases its annual PSPF and cyber posture reports.

January 2026

A critical WAF bypass in the OWASP Core Rule Set is fixed, Node.js patches eight vulnerabilities across its four supported release lines, OpenSSL patches a high severity flaw in CMS parsing, Drupal CMS 2.0 ships with Canvas as the default editing experience and Let's Encrypt makes 6-day and IP address certificates generally available.