Security Signal
Threat intelligence report · last 30 days
last 7 days · AWS
Generated 5 Nov 2026, 14:44 UTC · Live view: news.rogelio.cloud/?show=all&since=7d&vendor=AWS
Executive summary
- 21 stories in the last 30 days; 11 (52%) confirmed by official sources.
- 3 involve vulnerabilities attackers are already exploiting. Patch these first.
- Most common topic: Vulnerability (16).
- Most reported vendor: AWS (10 stories).
- 12 of the listed vulnerabilities are on CISA's exploited list.
21
Stories
3
Actively exploited
0
Breaches & ransomware
11
Confirmed by official sources
Stories per day
Daily breakdown, last 14 days
Exploited Breach / ransomware Other
Topics
- Vulnerability — 16 (76%)
- Actively exploited — 3 (14%)
- Threat actor — 1 (5%)
- Policy / law — 1 (5%)
Most reported vendors
Top stories · newest days first, most confident within each day
-
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws5 Nov 2026
-
CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS4 Nov 2026
-
CVE-2026-122192 - Guest Access to Firecracker Process Memory After a Failed Memory Discard4 Nov 2026
-
PHP2Shell: What to know about two critical PHP flaws4 Nov 2026
-
SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records4 Nov 2026
-
Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory4 Nov 2026
-
CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass3 Nov 2026
-
CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering3 Nov 2026
-
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access3 Nov 2026
-
A primer on TETRA mission-critical radio network authentication flaws3 Nov 2026
-
CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server2 Nov 2026
-
CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS2 Nov 2026
-
CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows2 Nov 2026
-
CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas2 Nov 2026
-
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers2 Nov 2026
-
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access31 Oct 2026
-
CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C30 Oct 2026
-
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV30 Oct 2026
-
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours30 Oct 2026
-
CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes29 Oct 2026
-
Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched29 Oct 2026
Vulnerabilities to watch
| CVE | Product | Exploited | CVSS | EPSS |
|---|---|---|---|---|
| CVE-2026-109618 | PHP Group PHP | Exploited | — | 100.0% |
| CVE-2026-109619 | PHP Group PHP | Exploited | — | 100.0% |
| CVE-2026-111497 | Google Brotli | Exploited | — | 82.6% |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | Exploited | — | 65.2% |
| CVE-2026-48356 | Adobe Commerce and Magento | Exploited | — | 47.5% |
| CVE-2026-46300 | Linux Kernel | Exploited | — | 16.1% |
| CVE-2026-114625 | Arista VeloCloud Orchestrator | Exploited | — | 1.0% |
| CVE-2026-119977 | WordPress WordPress Core | Exploited | — | 1.0% |
| CVE-2026-118527 | Ivanti Connect Secure | Exploited | — | 0.8% |
| CVE-2026-41709 | Broadcom VMware ESX | Exploited | — | 0.7% |
| CVE-2024-27834 | Apple Multiple Products | Exploited | — | 0.6% |
| CVE-2026-111357 | Ivanti Connect Secure | Exploited | — | 0.5% |