Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
VMware ESX CVE-2026-41709: administrator actions never reach the log
On 28 October CISA added CVE-2026-41709 to the known-exploited catalog. This is not a remote break-in of ESX. It is a logging gap: some administrator operations can be performed with no record.
A vulnerability check of a site: a scanner, an audit and a pentest are not the same
A "scan the site" button finds open ports and old versions. It usually misses someone else's order and a weak role. That needs a different job.
VMware and the revoked eMudhra certificates: this is not a hypervisor hole
Broadcom warned that emSign intermediates sit in the trust lists of VCF, Cloud Director, Workstation, Fusion, and neighboring products. Fixes are promised in upcoming releases. Do not confuse this with CVE-2026-41709.
Penetration testing: what it means for a site owner
Penetration testing is a check, with the owner's permission, of whether someone can sign in or see other people's data. Without the owner's letter it is not a service.
CVE-2026-46300: a Linux kernel bug next to the PHP bugs
On 28 October CISA added CVE-2026-46300 to the known-exploited catalog. It is a local kernel bug. It has already been chained with the two critical PHP bugs to run commands as root.
What a website pentest costs and what moves the quote
Lexora's guide price is from $50 per endpoint. The total depends on the number of apps, roles and APIs, not on how thick the report is.
Magento CVE-2026-48356: a July patch that October is already exploiting
Adobe fixed CVE-2026-48356 on 14 July 2026 in APSB26-73. By late October the bug is in the CISA catalog. An admin password is not required, but the bulletin does require a person to do something.
What a pentest report needs so development can actually use it
A good pentest report is short for the owner and specific for the developer. A long scanner dump without confirmation is not a report.
CVE-2026-111497: Brotli corrupts memory wherever an app decompresses a stream
A bug in the Brotli decoder, versions 1.0.3 through 1.2.0. A compressed stream can corrupt process memory, leak data, crash it, or run code. Node is fixed in 22.23.4, 24.22.2, and 26.12.1. The 20 line will not get a patch.
Cisco ASA and FTD: a VPN with secondary authentication reloads
CVE-2026-76418 reloads Cisco ASA and FTD on SSL VPN when a tunnel group has secondary authentication. This is denial of service, not a way into the network. There is no workaround. There is a patch. CISA added it on 29 October.