Security Signal

Cyber news feed: exploited in the wild

Stories about vulnerabilities attackers are using now, including new entries in CISA’s Known Exploited Vulnerabilities catalogue.

Filtered byExploited Day: 2026-10-28 Unverified shown Clear all filters

Threat dashboard (filtered)

Threat levelGuarded1 story about actively exploited flaws in the last 7 days

3stories, 30 days 3exploited 0breaches & ransomware 0affect everyday life 1new KEV entries

Key insights

0 stories this week, ▼ 100% on the previous week.
0 involve vulnerabilities exploited in the wild, ▼ 100% on the previous week.
0 breaches or ransomware attacks reported, no data for the previous week yet.
Most reported vendor this week: Google (1 story).
CISA added 1 exploited vulnerabilities in 30 days; 0 (0%) are known to be used by ransomware groups.
Most covered story this week (2 sources): CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure.

Daily activity, last 14 days

17 stories · busiest Thu 5 (3) · last 7 days ▼ 11% vs the week before

2Fri
23 Sat
24 Sun
25 1Mon
26 1Tue
27 3Wed
28 2Thu
29 2Fri
30 1Sat
31 Sun
1 Mon
2 Tue
3 2Wed
4 3Thu
5

Exploited Breach / ransomware Other · click a day to filter

Most reported vendors

Vulnerabilities to watch

CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager · EPSS 88%
CVE-2026-111497Google Brotli · EPSS 83%

New exploited flaws by vendor (CISA KEV)

Google1

Topics

Actively exploited3

Source mix

Confidence

Reported2
Confirmed1

Last 30 days. Click any item to filter the news feed. Tags are added automatically and may be incomplete.

↑

Confirmed 100Exploited
Published 28 Oct 2026, 21:58 UTCUpdated 5 days ago

CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

2 sources: AWS Security Bulletins, Palo Alto Networks Security Advisories

Vendor Google Vendor Palo Alto Networks
CVE-2026-111497
Reported 70Exploited
Published 28 Oct 2026, 21:32 UTC

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Source: Cisco Talos

Vendor Cisco
CVE-2026-20127
Reported 70Actively exploited
Published 28 Oct 2026, 19:56 UTC

Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

Source: The Register (Security)

Vendor Oracle