CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
Source: SecurityWeek · 2026-11-02
Tag: Zero-Day
-
Drupal Commerce Core Vulnerability Exploited Against Online Stores
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
Source: SecurityWeek · 2026-10-30
-
Possible new Cellebrite iPhone Radio Zero-Day
Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him:
Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026.
[…]
According to Cellebrite, AU:
- is a “next-generation AFU vector that is more resilient to Apple’s OS changes”
- works with Stolen Device Protection enabled, which tightens USB restrictions
- is enabled by a dedicated appliance with a stated range (!) of about 8 meters.
AU = Advanced Unlocks, Cellebrite’s term. AFU = after first unlock.
Source: Schneier on Security · 2026-10-20