Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
A retest after a pentest: why it still matters when "we already fixed it"
A checkbox in the tracker does not close a finding. A retest looks at whether the scenario is gone, not the row in the table.
Ivanti Connect Secure: three bugs are enough, a patch for only the first is not
The Connect Secure chain is closed by 25.1.1.3 and 22.8R2.6, released 29 October. The earlier fix for CVE-2026-104935 does not close the other two. Ivanti's integrity checker can miss an in-memory compromise.
How to choose a pentest vendor and not buy a scan in a cover
A good vendor names the addresses, the bans and the report before the start. A bad one starts with "full coverage" and a score.
WordPress 7.1.4 updates a certificate list, not the engine
On 28 October WordPress 7.1.4 replaced its bundled root set because of the revoked eMudhra intermediates. This release does not touch the host PHP or the system ca-certificates.
Go 1.27.3 and 1.26.10 stopped trusting the weak eMudhra key
CVE-2026-111943 on the Go line is not a compiler hole. Builds 1.27.3 and 1.26.10 drop the emSign intermediates with a guessable key from trust. An old binary in a container will not hear about it.
Atlassian CVE-2026-21589: a file by its known name, with no login and no directory listing
Since 5 October, CVE-2026-21589 reads individual files inside the directory of Atlassian Data Center products. Cloud is already closed. A self-hosted Jira, Confluence, or Bitbucket is not, until it is on a build from the advisory.
Cisco email gateway: CVE-2026-76519 is already in use
On 14 October Cisco fixed arbitrary file write in Secure Email Gateway, scored 9.8. It requires file reputation to be on and a Content Scanner older than 25.3.0.5525. CISA added the bug the same day.
GitLab dropped eMudhra on 29 October. Runner and CI images kept their own copy
Builds 18.11.14, 19.0.11, 19.1.10, 19.2.10, 19.3.7, 19.4.5, and 19.5.3 stopped trusting the eight emSign intermediates. Runner 19.5.1 and base images do not follow along by themselves.
Voice phishing and a letter that sounds like yours
A letter no longer fails on a crooked logo. Neither does the voice on the phone. The working defense is a second channel, not a training called "do not open attachments".
Swapped bank details on an invoice: the money leaves on a legitimate-looking letter
A letter from a known supplier, the usual attachment, a different account at the bottom. This is the most expensive "cyberattack" for an ordinary company, and it is barely about the site.