BaseFortify.eu

🚨 PHP2Shell: Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619) have triggered urgent security warnings. Remote code execution may be possible. What should administrators do right now? 🔗 basefortify.eu/posts/2026/1...

🔎 According to watchTowr, PHP versions dating back to PHP 5 may be affected, although this remains unconfirmed. No exploitation in the wild has been reported. Patches are expected today at 16:00 CEST. Inventory your PHP installations and prepare to update. #PHP #CyberSecurity

🧊 Hundreds of French supermarkets reportedly suffered cyberattacks targeting refrigeration systems, causing temperatures to rise and food to spoil. We examine the Danfoss connection and known vulnerabilities. basefortify.eu/posts/2026/1... #Cybersecurity #Danfoss

🔍 Months before the attacks, Claroty researchers detailed serious vulnerabilities in Danfoss refrigeration controllers. ⚠️ Exploitation of those specific CVEs remains unconfirmed. The lesson? Internet-exposed industrial equipment creates real risks. #ICS #OTSecurity #CVE

🎉 Thank you to everyone who joined us on October 7 for the Axxemble Customer Event 2026 at Wonders of Work in Utrecht! A fantastic day filled with insights, conversations and connections. 🙌 #Axxemble #Base27 #CustomerEvent

💡 From financial control and compliance to AI in Base27 and information security, our customer event sparked some great discussions! A big thank you to our speakers for sharing their knowledge and experiences. 👏 #Base27 #ISMS #Cybersecurity

CPEs, Known Affected Configurations, Affected Products… what exactly is the difference? 🤔 We take a closer look at how these pieces fit together — and what they mean for vulnerability matching. basefortify.eu/posts/2026/1... #NVD #CVE #CyberSecurity

🔎 A CPE identifies a product. It does not, by itself, say that the product is vulnerable. NVD configurations add applicability, while Affected Products can provide useful vendor and version information directly from CVE records. #NVD #CPE #VulnerabilityManagement

🚨 Two critical Citrix NetScaler zero-days are under active exploitation. CVE-2026-88771 & CVE-2026-88772 both score 9.5 — and attackers were active before patches arrived. Our guide 👇 basefortify.eu/posts/2026/0... #Citrix #NetScaler #CyberSecurity

🔍 Patching isn't the whole story. These Citrix flaws were exploited as zero-days. Previously exposed NetScaler appliances should also be checked for signs of compromise. We cover what administrators should look for. 🛡️ #Citrix #CVE #InfoSec

🚨 Microsoft just delivered a record-breaking Patch Tuesday: 974 unique vulnerabilities fixed in September. More than 100 are Critical — and two Windows vulnerabilities were already being exploited. basefortify.eu/posts/2026/0... #CyberSecurity #PatchTuesday #Microsoft

⚠️ CVE-2026-81963 and CVE-2026-85880 are already under active attack. Both are Windows privilege-escalation flaws that can help an attacker gain SYSTEM-level control after obtaining an initial foothold. #CVE #Windows #InfoSec

🚨 Google fixed 38 Chrome security vulnerabilities in just a few days — and one is already being actively exploited. CVE-2026-85046 affects the V8 JavaScript engine and can enable code execution inside the browser sandbox. basefortify.eu/posts/2026/0... #CyberSecurity #Chrome #CVE

⚠️ The Chrome updates address vulnerabilities in V8, WebGL, DevTools, Skia, WebRTC and more. Several flaws can enable code execution outside the Chrome sandbox. Google confirms an exploit for CVE-2026-85046 exists in the wild. #InfoSec #Vulnerability

🚨 Dutch NCSC warns about CVE-2026-18963, a critical Keycloak password-reset vulnerability. 🔐 Affected systems may be exposed to unauthenticated account takeover. What to check and how to fix it: basefortify.eu/posts/2026/0... #Keycloak #CyberSecurity

🔎 The problem is in Keycloak's reset-credentials flow: the email-verification gate can be bypassed. 🛠️ Community Keycloak 26.7.2 contains the fix. Our article covers affected versions, version checks, backups and mitigation. #InfoSec #CVE #Keycloak

🚨 Serious CVE disclosures are surging. But does that mean software is suddenly less secure? Our latest article looks beyond the headline numbers — and at why vulnerability management must change. 🔗 basefortify.eu/posts/2026/0... #CyberSecurity #CVE

📈 The story is more nuanced than “AI caused the CVE surge.” The rise began before Claude Mythos, while Oracle alone accounted for 25% of July’s serious CVEs. AI-assisted defensive discovery is another part of the picture. #VulnerabilityManagement #AI #CVE

🚨 Cisco has confirmed active exploitation of CVE-2026-20316, a hardcoded credential vulnerability affecting Secure Firewall Management Center. We've published a summary and analysis: basefortify.eu/posts/2026/0... 🔐🛡️ #CyberSecurity #Cisco #InfoSec #CVE202620316

🔍 CVE-2026-20316 allows an unauthenticated attacker to log in using a built-in low-privileged account. Cisco recommends installing the available hotfixes immediately and checking systems for published IoCs. ⚠️ Stay ahead of the threat. #CyberSecurity #ThreatIntel #Cisco #Vulnerability

🚨 A vulnerability in Microsoft Defender is now reportedly being used in ransomware attacks. CVE-2026-33825 evolved quickly from a local privilege escalation issue into a much more operationally significant threat. 👇 basefortify.eu/posts/2026/0... #CyberSecurity #Microsoft #Ransomware #CVE

📈 One interesting aspect of CVE-2026-33825 is how the risk evolved over time: • Public PoC released • KEV inclusion • Active exploitation • Reported ransomware usage Threat intelligence is not static. #CyberSecurity #ThreatIntel #KEV #InfoSec

🚨 Cisco is urging organizations to patch CVE-2026-20230 after reports of active exploitation against Unified Communications Manager. Public exploit code is online and the EPSS score jumped sharply after attack reports surfaced. 👇 basefortify.eu/posts/2026/0... #CyberSecurity #Cisco #CVE #InfoSec

📞 One detail that stands out: exploitation requires the WebDialer service to be enabled. It is disabled by default, but environments that enabled it may have unintentionally exposed additional attack surface. #CyberSecurity #Cisco #ThreatManagement #VulnerabilityManagement

⚠️ Not every CVE is actively exploited. CISA’s KEV Catalog highlights vulnerabilities that are already being used in real-world attacks. That makes KEV one of the most important signals for prioritization. #CyberSecurity #KEV #CVE basefortify.eu/cve_reports

🛡️ Over the last few years vulnerability management moved beyond just CVSS scores. Now CISA’s BOD 26-04 introduces a more systematic risk-based approach using KEV, exposure, exploitability, and technical impact 👇 basefortify.eu/posts/2026/0... #CyberSecurity #VulnerabilityManagement #CISA #InfoSec

📊 One of the most interesting parts of BOD 26-04 is the remediation timeline model. Instead of treating all vulnerabilities equally, urgency now depends on: • Public exposure • KEV status • Automatable exploitation • Technical impact #CyberSecurity #KEV #EPSS #CVSS #RiskManagement

🇪🇺 Can Nextcloud become a real alternative to Microsoft 365 for governments and businesses? Digital sovereignty is important — but sovereignty does not automatically equal security. Read our latest article 👇 basefortify.eu/posts/2026/0... #CyberSecurity #Nextcloud #Microsoft365 #DigitalSovereignty

🔐 Recent Nextcloud CVEs included issues involving: • Authentication bypass • SQL injection • Privilege escalation • OIDC weaknesses Open source software still requires strong patch management and visibility into exposed systems. #CyberSecurity #Nextcloud #VulnerabilityManagement #CVE #OpenSource

📈 CVSS tells you how severe a vulnerability is. EPSS answers a different question: 👉 “How likely is this vulnerability to actually be exploited?” A rapidly increasing EPSS score can be an important signal for defenders prioritizing threats. #CyberSecurity #EPSS #CVE basefortify.eu/cve_reports