ShipSecurely
Sourced security incidents, newest first. Each one names the stack, the kind of failure, the report it was checked against, and one way to prevent it.
Large, widely reported companies and published CVEs are named. A report about a small app is anonymized. Every item links the source it was checked against. This is not a ranking, and it does not change the guides.
Last updated
On October 13, 2026, CISA said attackers were exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution. CISA added it to the exploited-vulnerabilities catalog the same day.
On October 13, 2026, CISA added CVE-2026-96951, a command-injection vulnerability in Microsoft Windows, to the Known Exploited Vulnerabilities catalog because of evidence it was being exploited.
On October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8. CVE-2026-97229, scored 10.0, can let an unauthenticated user run code on a self-managed server through a crafted CI regular expression.
Huntress says attackers started exploiting CVE-2026-105133 and CVE-2026-105134 in AhsayCBS on October 7, 2026, after the flaws were disclosed on October 4. They ran code, planted webshells, and installed a cryptominer.
The UK NCSC said some ASOS customers got an unauthorized push notification on October 6, 2026. ASOS told the NCSC that names and contact details were accessed, and that it does not believe card numbers or account passwords were.
On October 5, 2026, Atlassian published CVE-2026-21589. An unauthenticated attacker who already knows a file's exact path can read that file inside the web root of several self-managed Data Center products. Atlassian rates it critical.
On October 5, 2026, Denmark's CPR Administration said unauthorized parties misused a Danish company's legitimate access and obtained names, addresses, CPR numbers, and other data for about 8.8 million people in the national register.
Fortinet published CVE-2026-104286 on October 1, 2026. An unauthenticated attacker can write arbitrary files on affected FortiMail systems through crafted web requests, and Fortinet says the bug has been exploited.
On September 27, 2026, Citrix published fixes for NetScaler ADC and NetScaler Gateway. CVE-2026-88771 lets an unauthenticated attacker run commands on a default deployment, and Citrix says exploits of that bug and CVE-2026-88772 have been observed.
On September 16, 2026, CISA added CVE-2026-87886, incorrect default permissions in Acronis Backup, to the Known Exploited Vulnerabilities catalog because of evidence it was being exploited.
On September 16, 2026, CISA added CVE-2026-76460, an incorrect use of privileged APIs in Cisco Identity Services Engine, to the Known Exploited Vulnerabilities catalog because of evidence it was being exploited.
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.
23 tools · 104 fixes · 29 issue guides · Updated Oct 15, 2026 · Sources: GitHub, Supabase, OWASP, Vercel + 28
