ConnectWise has patched a CVSS 9.9 hole in ScreenConnect that attackers have been riding since late August, turning the remote support tool many African businesses depend on into a self-propagating worm. Your MSP probably uses ScreenConnect. So does your payroll provider, your backup vendor, and the three-person IT shop that keeps your branch network alive….
A maximum-severity flaw in GitLab’s commits API lets anyone read arbitrary files off your CI server, and scanners were already probing for it within a day of disclosure GitLab shipped patches on Thursday for CVE-2026-85706, a path traversal bug in the repository commits API rated at the maximum severity score. No login required. No token….
A CVSS 10 hole in the SAP kernel lets an unauthenticated attacker own the system before the first authorization check ever runs. Patch Tuesday just moved from IT chore to board-level emergency. SAP’s September security patch day landed on Tuesday (Sept 8) with 20 new and updated notes. One of them, CVE-2026-44756, carries the maximum…