A maximum-severity, actively exploited flaw in Arista's VeloCloud Orchestrator tops a brutal day of zero-days, while F5 and VMware vCenter demand same-day patching. Plus: ShinyHunters hijacks rival gang Cl0p's own leak site, SEE-suh retires its weekly vulnerability bulletin, and Microsoft dismantles a phishing platform that burned twelve thousand accounts.

Microsoft's record Patch Tuesday hits its federal deadline today, but the story underneath it is a c-v-s-s ten point zero authentication bypass in Cisco Secure Firewall Management Center that Sandworm and Qilin affiliates are exploiting right now. Plus: one hundred fifty-three million driver's license scans for sale, Mandiant's negative time-to-exploit, and Palo Alto's five hundred million dollar bet on agentic remediation.

A c-v-s-s ten point zero file-read flaw in GitLab went from patch to in-the-wild probing in under a day, and Sysdig documented the first ransomware intrusion planned and executed end to end by an a-i agent. Plus: the CIRCIA final rule lands this month, and Wall Street calls a top on the security trade.

A ten-out-of-ten Cisco Identity Services Engine zero-day is under active attack with its federal patch deadline already behind us, Revolut got robbed by a fake government data request, and Amazon's honeypots clocked an autonomous a-i agent running a full attack chain in twelve minutes. Plus: the e-u's incident-reporting clock is now officially running.

Cisco closes a brutal week with two exploited zero-days, including a Secure Email Gateway flaw where simply receiving a message hands an attacker root. Plus: a dark-web service selling more than one hundred fifty-three million driver's license scans, nist's plan to rebuild the National Vulnerability Database for the AI era, and reports that Palo Alto Networks is circling SentinelOne for up to ten billion dollars.

A maximum-severity Cisco Identity Services Engine zero-day is being exploited in the wild and is already on the k-e-v catalog — patch it today. Plus ShinyHunters' extortion spree lands on healthcare giant McKesson, the e-u's Cyber Resilience Act reporting clock starts ticking, and Kevin Mandia raises a record one hundred eighty-nine point nine million dollars to build a-i red teamers.

A root-level, unauthenticated flaw in Cisco Secure Email Gateway has been exploited for nearly a year — and the federal patch deadline lands today. Plus: how hardcoded credentials in public JavaScript gave extortionists two months inside Novo Nordisk, the seventy-two-hour reporting clock arriving with SEE-suh's final CIRCIA rule, and Palo Alto's five-hundred-million-dollar bet on agentic security operations.

Microsoft ships the largest Patch Tuesday on record — 974 CVEs, two of them already exploited — while a dark-web service peddles searchable access to 153 million driver's licenses. Plus: why a 155x surge in password spraying means your MFA policy probably has a hole in it.

A CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center is being worked by three separate threat clusters at once — including Sandworm and the Qilin ransomware crew. Plus Rhysida dumps Berlin's emergency plans, Anthropic catches Midnight Blizzard using Claude to tune malware evasion, and CrowdStrike goes hunting for rogue AI agents.

A maximum-severity GitLab path traversal is under active exploitation with today's federal patch deadline already here -- and it's only one line in a brutal patch queue. Plus: Medusa ransomware crosses 500 critical-infrastructure victims, Anthropic documents AI-run intrusions finishing in two hours, and a public exploit turns CrowdStrike Falcon's own remediation feature into a privilege escalation.