On 27 October 2026, WatchGuard published 18 security advisories on its PSIRT portal: 17 for Fireware OS, the operating system on its Firebox firewalls, and one for the Mobile VPN with SSL client for ...

On 27 October 2026, TeamViewer published security bulletin TV-2026-1011, fixing three flaws in its clients. The most broadly relevant is CVE-2026-111585, an integer overflow in the code that processes ...

What ISO/IEC 27001 Annex A actually requires for supplier relationships: the five controls in clauses 5.19-5.23, how they map ...

TL;DR. PwnEscape (CVE-2026-99999) is a Linux kernel flaw in IPv4 packet handling that lets a guest virtual machine attack the host it runs on. The researcher showed it leaking host memory, crashing ...

What FedRAMP requires when a cloud service provider is in a federal agency's supply chain: the FedRAMP Authorization Act (44 ...

A hub for the capabilities behind modern third-party risk management - continuous monitoring, attack surface monitoring, ...

A third-party risk program is easier to build, and to defend to an auditor, when the underlying concepts are kept distinct. Risk is not the same as criticality. A score is not the same as a decision.

What the FTC's GLBA Safeguards Rule (16 CFR Part 314) requires of financial institutions for their service providers: the ...

TL;DR. Drupal rates CVE-2026-118539 in Commerce Core Highly critical (21/25) and says it is being actively exploited in the wild; Rescana treats it as Critical. The flaw lets attackers tamper with ...

The catch: Cursor's revised notice says the extension added the attacker's SSH key, installed persistence and sent host details to the attacker, even where the SSH step failed. These stay after the ...