Act now:Adobe Commerce CVE-2026-71362: Exploited Account Takeover. Merchants and agencies running Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9 at the 2026-jul level or earlier, including staging and campaign sites.
Patch this week:Cisco ASA/FTD CVE-2026-20349: Exploited VPN Crash Bug. Teams running Cisco Secure Firewall ASA or FTD with SSL VPN (webvpn), IKEv2 remote access with client services, or Zero Trust Network Access enabled, which in practice means internet-facing VPN headends.
Patch this week:Windows AFD.sys CVE-2026-68820: Exploited Zero-Day EoP. Admins of Windows 10, Windows 11 and Windows Server 2012 through 2025 machines that have not installed the August 11, 2026 or a later cumulative update, starting with workstations of staff who receive outside job offers or documents.
Do you run any of these? Metabase Metabase, Microsoft Windows Ancillary Function Driver for WinSock, Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-14.
Go: 1 critical advisory (github.com/seaweedfs/seaweedfs). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Any Magento or Adobe Commerce store without the August 2026 isolated patch is exposed to an exploited, login-free takeover of customer accounts; apply it today.
Must act: Merchants and agencies running Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9 at the 2026-jul level or earlier, including staging and campaign sites.
Can relax: Teams that do not run Magento or Adobe Commerce, and stores whose host or agency has confirmed the August 2026 isolated patch is installed.
List every Magento and Adobe Commerce install, including staging, regional and campaign stores, and record the exact release (bin/magento --version).
Bring each store to the latest -p release for its line (2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18) with all earlier monthly isolated patches, including July 2026.
Apply the matching APSB26-92 isolated patch ZIP from Adobe's KB (Cloud: via the cloud patches update, not both), then flush caches and redeploy.
If your ASA or FTD terminates remote access VPN, SSL VPN or ZTNA, install the fixed release this week; attackers are using this to knock firewalls offline, but Cisco describes no code execution or data theft.
Must act: Teams running Cisco Secure Firewall ASA or FTD with SSL VPN (webvpn), IKEv2 remote access with client services, or Zero Trust Network Access enabled, which in practice means internet-facing VPN headends.
Can relax: Cisco firewalls with none of those features enabled, Secure Firewall Management Center (not affected), and organizations that do not run Cisco firewalls at all.
Check each ASA and FTD for webvpn, IKEv2 client-services or zero-trust in the running configuration.
Upgrade affected devices to the fixed release for their train, starting with internet-facing VPN headends.
Use Cisco's Software Checker to pick a release that also covers the other September 2026 Secure Firewall advisories.
A local bug, but a real zero-day: North Korea's Lazarus group used it to load a kernel rootkit, so any Windows host still missing the August 2026 or later cumulative update should be patched this week.
Must act: Admins of Windows 10, Windows 11 and Windows Server 2012 through 2025 machines that have not installed the August 11, 2026 or a later cumulative update, starting with workstations of staff who receive outside job offers or documents.
Can relax: Fleets that installed the August, September or October 2026 cumulative updates are already fixed and need only confirm coverage.
Confirm every Windows host runs the August 11, 2026 cumulative update or later; the fixed build numbers per version are in the Microsoft advisory.
Patch stragglers first where users open outside documents, job offers or PDF viewers, then servers where many users can run code.
Block and hunt for the Check Point indicators: envell[.]xyz, enveil[.]online, uxtramine[.]org, 135.181.67[.]203 and 135.181.185[.]158.