Field notes from the CloudKey security team. CVEs, zero-days, product walkthroughs and honest comparisons.https://www.cloudkey-tech.com/en-UShttps://www.cloudkey-tech.com/blog/cve-digest-2026-07-13/https://www.cloudkey-tech.com/blog/cve-digest-2026-07-13/Seven flaws are now confirmed exploited: an Adobe ColdFusion path traversal and a wave of Joomla file-upload RCEs, all on CISA KEV this week. Patch by exposure first.Mon, 13 Jul 2026 00:00:00 GMTcvekevepsscve-digestcoldfusionjoomlalangflowhttps://www.cloudkey-tech.com/blog/cve-digest-2026-07-06/https://www.cloudkey-tech.com/blog/cve-digest-2026-07-06/Two flaws are now confirmed exploited: a Microsoft SharePoint code-execution bug and a SimpleHelp auth bypass, both on CISA KEV this week. Patch them before your CVSS queue.Mon, 06 Jul 2026 00:00:00 GMTcvekevepsscve-digestsharepointsimplehelphttps://www.cloudkey-tech.com/blog/check-company-credentials-leaked/https://www.cloudkey-tech.com/blog/check-company-credentials-leaked/A practical guide to check if your company credentials leaked: where stolen logins come from, how to search breach and infostealer data safely, and what to do about a hit.Wed, 01 Jul 2026 00:00:00 GMTproductcredential-leakdark-webinfostealerpassword-securitymfadark-web-monitoringhttps://www.cloudkey-tech.com/blog/microsoft-sharepoint-cve-2026-45659-exploited/https://www.cloudkey-tech.com/blog/microsoft-sharepoint-cve-2026-45659-exploited/CVE-2026-45659 is an actively exploited deserialization flaw in Microsoft SharePoint Server. CISA added it to KEV on July 1 with a federal deadline of July 4, 2026.Wed, 01 Jul 2026 00:00:00 GMTzero-dayrapid-responsekevmicrosoftsharepointdeserializationcwe-502https://www.cloudkey-tech.com/blog/simplehelp-cve-2026-48558-auth-bypass-exploited/https://www.cloudkey-tech.com/blog/simplehelp-cve-2026-48558-auth-bypass-exploited/CVE-2026-48558, a CVSS 10 authentication bypass in SimpleHelp, is actively exploited and added to CISA KEV with a July 2 federal patch deadline.Tue, 30 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevepsssimplehelpauthentication-bypassoidchttps://www.cloudkey-tech.com/blog/cve-digest-2026-06-29/https://www.cloudkey-tech.com/blog/cve-digest-2026-06-29/Four flaws now confirmed exploited, added to CISA's KEV the week of June 29, 2026: Cisco Unified CM, Ubiquiti UniFi OS, PTC Windchill and Lantronix. What to patch first.Mon, 29 Jun 2026 00:00:00 GMTcvekevepsscve-digestciscoubiquitiptchttps://www.cloudkey-tech.com/blog/cisco-unified-cm-cve-2026-20230-exploited/https://www.cloudkey-tech.com/blog/cisco-unified-cm-cve-2026-20230-exploited/CVE-2026-20230 is a server-side request forgery flaw in Cisco Unified CM and Unified CM SME added to CISA KEV on June 25. Federal deadline is June 28.Fri, 26 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevciscounified-cmssrfcwe-918https://www.cloudkey-tech.com/blog/penetration-testing-for-soc2/https://www.cloudkey-tech.com/blog/penetration-testing-for-soc2/Is penetration testing required for SOC 2? Not by name in the Trust Services Criteria, but auditors expect one to satisfy CC7.1. What to test, and how often.Wed, 24 Jun 2026 00:00:00 GMTproductpenetration-testingsoc-2compliancesecurity-testingtrust-services-criteriahttps://www.cloudkey-tech.com/blog/cisa-kev-unifi-os-lantronix-copy-fail-2026-06-23-exploited/https://www.cloudkey-tech.com/blog/cisa-kev-unifi-os-lantronix-copy-fail-2026-06-23-exploited/Ubiquiti UniFi OS and Lantronix EDS5000 reached CISA KEV on June 23 with unauthenticated root flaws, and Copy Fail (CVE-2026-31431) now hits B&R OT gear. Patch fast.Tue, 23 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevubiquitiunifi-oslantronixlinux-kernelzero-dayhttps://www.cloudkey-tech.com/blog/cve-digest-2026-06-22/https://www.cloudkey-tech.com/blog/cve-digest-2026-06-22/Three flaws now confirmed exploited, added to CISA's KEV the week of June 22, 2026: Splunk Enterprise, the Joomla JCE editor and a LiteSpeed cPanel plugin. What to patch first.Mon, 22 Jun 2026 00:00:00 GMTcvekevepsscve-digestsplunkjoomlalitespeedhttps://www.cloudkey-tech.com/blog/fortibleed-fortinet-vpn-credentials-exposed/https://www.cloudkey-tech.com/blog/fortibleed-fortinet-vpn-credentials-exposed/A leaked dataset exposed plaintext VPN credentials for 73,932 FortiGate firewalls in 194 countries. What FortiBleed is, whether your gateway is affected, and what to do now.Fri, 19 Jun 2026 00:00:00 GMTnewsfortinetfortigatevpncredential-leakssl-vpndark-webincident-responsehttps://www.cloudkey-tech.com/blog/splunk-enterprise-cve-2026-20253-exploited/https://www.cloudkey-tech.com/blog/splunk-enterprise-cve-2026-20253-exploited/CISA added Splunk Enterprise CVE-2026-20253 to KEV on June 18, 2026. Unauthenticated file write via PostgreSQL sidecar, federal due date June 21. Who is affected and what to do.Thu, 18 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevsplunkenterprisefile-writeauthentication-bypasshttps://www.cloudkey-tech.com/blog/vulnerability-scanning-vs-penetration-testing/https://www.cloudkey-tech.com/blog/vulnerability-scanning-vs-penetration-testing/Vulnerability scanning vs penetration testing: one finds known flaws at scale, the other proves what an attacker can exploit. Which you need, and why both.Wed, 17 Jun 2026 00:00:00 GMTcomparisonvulnerability-scanningpenetration-testingsecurity-testingpci-dssvulnerability-managementhttps://www.cloudkey-tech.com/blog/widget-factory-jce-cve-2026-48907-exploited/https://www.cloudkey-tech.com/blog/widget-factory-jce-cve-2026-48907-exploited/CVE-2026-48907 in Joomla Content Editor lets unauthenticated attackers upload PHP webshells. CISA added it to KEV on June 16; patch to JCE 2.9.99.6 now.Wed, 17 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevjoomlajcewebshellcmshttps://www.cloudkey-tech.com/blog/cisa-kev-cisco-sd-wan-litespeed-2026-06-15-exploited/https://www.cloudkey-tech.com/blog/cisa-kev-cisco-sd-wan-litespeed-2026-06-15-exploited/Attackers are exploiting Cisco Catalyst SD-WAN Manager (CVE-2026-20262) and the LiteSpeed cPanel plugin (CVE-2026-54420), both added to CISA KEV on June 15, 2026. Patch now.Mon, 15 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevciscosd-wanlitespeedcpanelzero-dayhttps://www.cloudkey-tech.com/blog/cve-digest-2026-06-15/https://www.cloudkey-tech.com/blog/cve-digest-2026-06-15/CISA added six CVEs to KEV in the week of June 15, 2026: Oracle PeopleSoft, Ivanti Sentry, Cisco SD-WAN, Arista, Chrome and LiteLLM. Scores and what to patch first.Mon, 15 Jun 2026 00:00:00 GMTcvekevepsscve-digestivantioracleciscochromehttps://www.cloudkey-tech.com/blog/oracle-peoplesoft-cve-2026-35273-exploited/https://www.cloudkey-tech.com/blog/oracle-peoplesoft-cve-2026-35273-exploited/Oracle PeopleSoft PeopleTools CVE-2026-35273: active exploitation, known ransomware use, unauthenticated takeover, CVSS 9.8, on CISA KEV. Who is affected and what to do.Sat, 13 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevepssoraclepeoplesoftssrfrcehttps://www.cloudkey-tech.com/blog/ivanti-sentry-cve-2026-10520-exploited/https://www.cloudkey-tech.com/blog/ivanti-sentry-cve-2026-10520-exploited/CISA added Ivanti Sentry CVE-2026-10520 to KEV on June 11, 2026. Unauthenticated root RCE, CVSS 10.0, federal due date June 14. Here is who is affected and what to do.Fri, 12 Jun 2026 00:00:00 GMTzero-dayrapid-responsekevepssivantisentryrcehttps://www.cloudkey-tech.com/blog/what-is-a-cve/https://www.cloudkey-tech.com/blog/what-is-a-cve/What a CVE is, who assigns the IDs, how the numbering works, and how to act on the 40,000+ published each year. A plain-language guide for IT and security teams.Thu, 11 Jun 2026 00:00:00 GMTcvecvenvdvulnerability-managementvulnmonitorhttps://www.cloudkey-tech.com/blog/cve-digest-2026-06-09/https://www.cloudkey-tech.com/blog/cve-digest-2026-06-09/Four CVEs hit CISA KEV this week: Linux, Android, Magento RCE, and SolarWinds DoS. See which patch cuts the most risk against confirmed exploitation.Tue, 09 Jun 2026 00:00:00 GMTcvekevepsscve-digestlinuxandroidmagentosolarwindshttps://www.cloudkey-tech.com/blog/cvss-vs-epss-vs-kev/https://www.cloudkey-tech.com/blog/cvss-vs-epss-vs-kev/CVSS vs EPSS vs KEV: three signals that rank vulnerabilities differently. Why CloudKey patches KEV-listed CVEs first, EPSS-elevated next, CVSS last.Tue, 19 May 2026 00:00:00 GMTcvekevcvssepssvulnerability-prioritizationvulnmonitorhttps://www.cloudkey-tech.com/blog/dark-web-monitoring-report/https://www.cloudkey-tech.com/blog/dark-web-monitoring-report/A CloudKey dark web monitoring report, walked section by section: the open-finding ledger, re-test attestations, and the parts auditors ask for first.Tue, 12 May 2026 00:00:00 GMTproductdark-web-monitoringexposure-reportleaked-credentialsexternal-attack-surfacehttps://www.cloudkey-tech.com/blog/sbom-asset-inventory-reconciliation/https://www.cloudkey-tech.com/blog/sbom-asset-inventory-reconciliation/SBOM asset inventory reconciliation maps each signed manifest to the host actually running it, so the CVE queue ranks risk on real systems, not the manifests.Tue, 05 May 2026 00:00:00 GMTproductsbomasset-inventoryvulnmonitorsupply-chain