TECHNOLOGY PUBLICATION
Tech-Bee
Enterprise technology, explained — infrastructure failures, cybersecurity stories, cloud and AI, researched from primary sources.
CYBERSECURITY ·
Critical PHP Vulnerabilities Allow Remote Code Execution
Two critical vulnerabilities in PHP enable unauthenticated remote code execution, affecting web applications globally.
Read →VMWARE ·
VMware vCenter Exploit Chain Compromises Critical Infrastructure
Attackers exploited vulnerabilities in Palo Alto's GlobalProtect VPN and VMware's vCenter to compromise critical infrastructure.
Read →CLOUD & AI ·
Vultr Enhances Agentic AI Infrastructure for Enterprises
Vultr introduces platform upgrades to address challenges in transitioning agentic AI from proof of concept to production.
Read →CYBERSECURITY ·
BeyondTrust Fixes Zero-Day Exploited Since August
BeyondTrust patches a zero-day vulnerability actively exploited in cyberattacks since August 2026, affecting multiple organizations.
Read →INFRASTRUCTURE ·
Microsoft October 2026 Patch Addresses 1,415 Vulnerabilities
Microsoft's October Patch Tuesday update fixes 1,415 vulnerabilities, including 85 critical ones like RCE flaws in Active Directory and Exchange Server.
Read →CYBERSECURITY ·
Cisco Warns of Critical Email Gateway Bug Exploited
Cisco alerts about a severe vulnerability in Secure Email Gateway exploited by attackers, rated CVSS 9.8.
Read →CLOUD & AI ·
Vertiv Aids AI Transition to Production
Vertiv partners with Deloitte to help enterprises scale AI from pilots to production with a structured guide.
Read →AUTOMATION ·
A disguised GIF gave hackers code execution on WordPress sites
A critical flaw in the Bricksforge WordPress plugin let unauthenticated attackers disguise a PHP file as a GIF and run it — exploited within hours.
Read →CYBERSECURITY ·
iRhythm data breach exposes 360,000 cardiac patients
iRhythm disclosed in October that a June breach of third-party apps exposed health and billing data for at least 360,000 cardiac-monitor patients.
Read →INFRASTRUCTURE ·
Drone strikes knock three Yandex data centers offline
Ukrainian drones hit three Yandex data centers in four days, forcing the Russian cloud giant into emergency mode across dozens of services.
Read →CYBERSECURITY ·
A fake push notification outed ASOS's real data breach
Hackers who tricked an ASOS employee into giving up account access used it to blast a breach confession through ASOS's own app to millions.
Read →CYBERSECURITY ·
FBI seizes the hacking tools behind China's Flax Typhoon
The FBI and DOJ seized domains behind MicroScan and FishHub, scanning and phishing tools a sanctioned Chinese firm built for state-linked hackers.
Read →CYBERSECURITY ·
Georgia Power breach exposes 400,000 customer accounts
A breach of Southern Company's online customer portal exposed names, addresses and partial Social Security numbers for 400,000 utility customers.
Read →AUTOMATION ·
A single known file turned Atlassian's bug into full admin
CVE-2026-21589 only lets attackers read files whose path they already know, but Crowd's plaintext credentials file sits at a fixed, predictable location.
Read →CYBERSECURITY ·
Oracle Health's Cerner breach hit 20 million patients
A Texas filing shows Oracle Health's 2025 breach of old Cerner servers exposed records on nearly 20 million people, far more than first disclosed.
Read →INFRASTRUCTURE ·
OpenAI, Blackstone and unions team up to stop data center bans
Facing moratoriums in a dozen states, OpenAI, Blackstone, SoftBank and five unions formed the American Infrastructure Alliance to write the rules first.
Read →CYBERSECURITY ·
543,699 live credentials found sitting in public GitHub code
A Truffle Security scan of 224 million GitHub repos found 543,699 still-valid credentials — most of them years old, because nobody ever revoked them.
Read →CYBERSECURITY ·
Times Car breach exposed 6.6 million driver's license records
Japan's Times Car confirmed attackers accessed 6.6 million accounts, including 1.6 million driver's license images used for identity verification.
Read →CYBERSECURITY ·
Bitget's $387M heist traces to a security vendor's zero-day
A zero-day in a third-party security appliance let attackers drain $387.5 million from Bitget's hot wallets before controls caught it.
Read →CYBERSECURITY ·
No login needed: the FortiMail flaw under active attack
CVE-2026-104286 lets an unauthenticated attacker write files to FortiMail's management interface, and Fortinet shipped no patch at disclosure.
Read →AUTOMATION ·
A Zammad flaw let AI-driven attackers reach root in seconds
CVE-2026-102489 and CVE-2026-102490 chain to give remote attackers root on Zammad helpdesk servers, CISA warns, in an attack DIVD says ran in seconds.
Read →INFRASTRUCTURE ·
A hex-encoded 'j' gave attackers admin on Cisco SD-WAN
CVE-2026-76504 lets an unauthenticated attacker bypass login on Cisco SD-WAN Manager by encoding one character in a URL.
Read →CYBERSECURITY ·
Citrix NetScaler zero-days were exploited for weeks unnoticed
Two unauthenticated RCE flaws in Citrix NetScaler were exploited for weeks before patches shipped on September 27, 2026.
Read →CYBERSECURITY ·
Pentagon personnel office let a breach run nine months unnoticed
A file-sharing flaw at the Defense Manpower Data Center exposed unencrypted SSNs for roughly 3 million people over nine months.
Read →INFRASTRUCTURE ·
Cisco Nexus 9000 flaw lets hackers get root, no login needed
Cisco disclosed a maximum-severity flaw in Nexus 9000 AI-fabric switches: two open TCP ports that hand out root to anyone who can reach them.
Read →CYBERSECURITY ·
Sangoma Switchvox flaw lets hackers root VoIP phone servers
Sangoma patched CVE-2026-9586 in July; attackers found it in August, using unauthenticated SQL injection to gain root on Switchvox VoIP servers.
Read →CYBERSECURITY ·
Thomson Reuters' C-Track breach exposed US, Canada court data
A months-long breach of Thomson Reuters' C-Track exposed Social Security numbers and sealed court filings across a dozen US states and Canada.
Read →AUTOMATION ·
JFrog Artifactory's 'phantom' join key let anyone become admin
CVE-2026-82329 let unauthenticated attackers mint admin tokens on default JFrog Artifactory installs; exploitation began four days after the patch.
Read →CLOUD & AI ·
LiteLLM's MCP gateway had an auth check that failed open
CVE-2026-59822 let attackers reach LiteLLM's AI tool-calling endpoint with a fake token because a failed key check fell back to a valid-looking session.
Read →CYBERSECURITY ·
SonicWall's SMA1000 zero-days: SSRF chains into full RCE
SonicWall patched two exploited SMA1000 zero-days on Sept 1, 2026: a maximum-severity SSRF chained with OS command injection for remote code execution.
Read →CLOUD & AI ·
What actually broke in the October 2025 AWS outage
A single empty DNS record in one AWS region took down DynamoDB, then EC2, then a large slice of the internet for roughly 15 hours. Here is the chain of events, from AWS's own post-event summary.
Read →CYBERSECURITY ·
How a ten-minute phone call shut down MGM Resorts
In September 2023, attackers talked their way past the MGM help desk, turned one stolen login into control of the company's identity provider, and encrypted more than a hundred ESXi hosts. Casinos ran on paper for ten days.
Read →CYBERSECURITY ·
The SharePoint bug that let anyone become admin: a token with no signature
CVE-2026-55040 let an unauthenticated attacker impersonate any SharePoint user by presenting a JWT with alg set to none. Researchers found it with an AI agent, Microsoft patched it in July, and attackers were exploiting it within a month.
Read →VMWARE ·
What actually happens when VMware HA fails
vSphere HA restarts VMs when a host dies. The interesting cases are the ambiguous ones — isolation, partition, storage that half-disappears — where HA has to guess, and where a wrong guess means split-brain or VMs that never come back.
Read →VMWARE ·
A suspected Chinese APT turned a five-day-old vCenter patch into 361 breaches
Days after Broadcom patched two critical vCenter flaws, a suspected China-nexus actor was already using them to plant backdoors on vSphere management servers in 47 countries, and in at least one case detonated ransomware on the ESXi hosts underneath.
Read →