Patch Monday

Safeguard

A weekly security news briefing in about ten minutes: the top vulnerability, breach, compliance and AI agent stories of the week, each with what to do on Monday. Zero-day and CVE news, KEV additions, SOC 2 and ISO 27001 updates, software supply chain attacks, AI coding agent and MCP security. Learn more at safeguard.sh.

Episodes

  1. 1d ago

    Patch Monday, Ep 2: Turn it off, narrow it, set it on purpose

    Is there a document editing app on your file server that you installed once and forgot? CISA put one on its exploited list on 23 October, and the advisory says switching it off is not enough. This Patch Monday briefing covers four stories from 23 to 30 October 2026, each with what happened, who is stuck with it right now, and one switch to flip on Monday morning: turn it off, narrow it, or set it on purpose. A vulnerability management and patch management story: CVE-2026-110447 in the Collabora Online Built-in CODE Server app for Nextcloud, on CISA's Known Exploited Vulnerabilities list since 23 October, and why Collabora's advisory says to update or remove the app. A credential theft story: Wiz Research's 25 October report on Gheist, a campaign that uses stolen GitHub tokens to plant workflows that print repository secrets, and how to narrow the tokens that can reach your repositories. A compliance story: the Department of Homeland Security notice of 30 October on an order to remove Acronis products from federal civilian systems, and the question it raises about every tool that runs with privileged access. And an AI agent security story: Anthropic's 26 October advisory for CVE-2026-88968, a race condition in the Claude Code Edit tool that could let a file be written outside the workspace on macOS. About eight minutes, for security engineers, AppSec leads, platform teams, compliance leads and CISOs.

  2. 6d ago

    Patch the store, rotate the keys, move your agent

    CISA put an Adobe Commerce and Magento flaw on its Known Exploited Vulnerabilities (KEV) list on 27 October 2026, and researchers say attackers have been using it since March. This first full Patch Monday briefing covers four stories from 21 to 27 October, each with what happened, who is stuck with it right now, and one thing to do on Monday morning. A CVE and vulnerability management story: CVE-2026-48356 in Adobe Commerce and Magento Open Source, how to patch it and how to check a store for web shells left behind. A cloud platform breach and secrets story: Railway's disclosure and preliminary report on an unauthorized party that may have accessed encrypted environment variables, and how to rotate API keys and credentials in the right order. A compliance story: the paused CMMC program, NIST SP 800-171 and what a defense supplier can do while the Pentagon decides, as reported by Federal News Network. And an AI coding agent security story: a malicious AGENTS.md file in a Downloads folder, Codex and Claude Code, and the malicious npm package an agent tried to install.

    Patch the store, rotate the keys, move your agent

  3. Season 1 Trailer

    Patch Monday: trailer

    Trailer for Patch Monday, a weekly security news briefing in about ten minutes: the top vulnerability, breach, compliance and AI agent stories of the week, each with what to do on Monday. Mira and Cal cover zero-day and CVE news, KEV additions, SOC 2 and ISO 27001 updates, software supply chain attacks and AI coding agent and MCP security. New episode every Monday morning. Learn more at safeguard.sh: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=patch-monday&utm_content=trailer Topics: security news, zero-day, CVE, KEV, vulnerability management, SOC 2, ISO 27001, software supply chain security, AI agent security, MCP security.

    Patch Monday: trailer
  • 1 Trailer
    2 Episodes

Trailer

About

A weekly security news briefing in about ten minutes: the top vulnerability, breach, compliance and AI agent stories of the week, each with what to do on Monday. Zero-day and CVE news, KEV additions, SOC 2 and ISO 27001 updates, software supply chain attacks, AI coding agent and MCP security. Learn more at safeguard.sh.

Information

  • Creator
    Safeguard
  • Years Active
    2026
  • Episodes
    3
  • Rating
    Clean
  • Copyright
    © Safeguard
  • Show Website
    Patch Monday