Qualys says its Policy Audit includes an out-of-the-box policy to assess Cisco router configurations against CISA AA26-194A, covering SNMP, management access, authentication, software lifecycle and other hardening practices.
Qualys outlines interim mitigations for Node.js flaws, including CVE-2026-111497, and recommends prioritizing exposed runtimes, adding WAF/IPS/EDR controls, then upgrading and verifying. Its telemetry found 42,000 of 3.3 million installations patched.
Qualys recommends finding exposed PHP, disabling session upload progress, layering WAF/IPS/EDR controls, then patching and validating PHP2Shell. It reports 199,000 of 156 million installations patched in the first 12 hours; one customer probe validated 25 of 1,539 PHP -
Qualys explains how to find systems using eight weak eMudhra intermediate certificates and affected Go versions. The researcher reportedly recovered their private keys; eMudhra says none issued certificates to websites or end users.
Node.js fixed 10 flaws across supported 22.x, 24.x and 26.x lines, including a Brotli decoder out-of-bounds write that may enable remote code execution. Qualys says most observed installations remain unpatched or unsupported and recommends upgrading runtimes.
Qualys details BlueHammer, an eight-stage Windows Defender local privilege-escalation chain that reached SYSTEM in lab testing. It requires prior standard-user code execution; Defender platform 4.18.26030.3011 or later closes the vulnerable path.
PHP has fixed two critical flaws that can enable unauthenticated remote code execution and memory disclosure. Qualys reports broad exposure in its dataset; upgrading is the complete fix, while configuration changes offer temporary risk reduction.
Qualys research found that vulnerability closures rose sixfold from 2022 to 2025, while the share of critical findings still open after seven days increased. The article argues for prioritizing vulnerabilities using exploitation evidence and asset context.
Qualys says TruRisk Eliminate 2.0 uses TruConfidence and Agent Sara to select and stage remediation, including patchless fixes, then monitor deployments and roll back on anomalies. The company reports deploying 178 million patches in the past year.
Microsoft’s October 2026 updates address 1,414 vulnerabilities, including 78 rated critical. The article highlights an actively exploited Windows Shell flaw and provides vulnerability details and Qualys remediation guidance.
