My Local News
About our Software Vulnerabilities news
Latest news on software vulnerabilities, providing coverage of critical vulnerability alerts, zero-day exploits, CVE disclosures, CVSS scores, remote code execution (RCE) flaws, security patches, emergency updates, Patch Tuesday, actively exploited bugs, the CISA KEV catalogue, MITRE and NVD records, supply chain attacks, proof-of-concept exploits and bug bounty news, plus PHP2Shell, Log4Shell and Heartbleed.
A software vulnerability is a flaw in code or design that attackers can abuse to steal data or take control. Known flaws receive CVE identifiers, a system MITRE launched in 1999 so everyone can refer to the same issue. The CVSS scale, maintained by FIRST, rates severity from 0 to 10, and scores from 9.0 upwards count as critical. NIST's National Vulnerability Database (NVD) adds analysis and severity scores to many CVE records for defenders.
A zero-day is a flaw attackers exploit before a fix exists, leaving defenders no warning and no patch to apply. When one emerges, vendors may issue emergency out-of-band patches, and exploit attempts can begin within days. In October 2026, two critical PHP flaws nicknamed PHP2Shell were patched on 21 October, and security firms reported exploit attempts. Supply chain attacks, which compromise trusted software or updates, can reach thousands of organisations at once.
Since October 2003, Microsoft has issued security updates on the second Tuesday of each month, known as Patch Tuesday. Other vendors, open-source projects and Linux distributions publish their own advisories, and many fixes arrive as security patches. CISA's Known Exploited Vulnerabilities (KEV) catalogue, launched in November 2021, lists flaws attacked in the wild with federal patch deadlines.
A global community of researchers, vendors and bug bounty programmes works to find flaws and report them privately. Disclosure is debated: some favour full publication to force fixes, while coordinated disclosure gives vendors a private window. Critics say bounties can fall below a bug's value, and different sources sometimes give the same flaw different CVSS scores.
Heartbleed, a flaw in the OpenSSL library disclosed in April 2014, let attackers read memory from affected servers. WannaCry spread to more than 150 countries in May 2017 using EternalBlue, which targeted a Windows flaw Microsoft had patched. Log4Shell, a December 2021 flaw in the Log4j logging library, received the maximum CVSS score of 10. Later incidents, including the SolarWinds build compromise of 2020 and the MOVEit zero-day of 2023, affected many organisations.
Staying informed matters because a single unpatched flaw in widely used software can expose millions of systems. Our NewsNow software vulnerabilities feed gathers the latest CVE, zero-day, critical vulnerability and security patch headlines from reliable sources worldwide.
