Seven CVEs, a Proxmox Root Bypass, and Ubiquiti's AmpliFi Comeback — Big Day in the Lab

CISA just added seven actively exploited flaws to its KEV catalog on the same day a critical Proxmox authentication bypass went public. Patch windows are closing fast.

CISA Drops Seven New KEVs, Reverse Shells and Crypto Miners Already in the Wild

CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog yesterday, and the payloads attackers are deploying tell you everything about their intent: reverse shells for persistent access, crypto miners for quiet monetization. These aren't theoretical proof-of-concept exploits. They're confirmed in-the-wild attacks.

Federal agencies have the standard 21-day remediation deadline, but treat that timeline as a ceiling, not a target. Pull the full KEV list at cisa.gov/known-exploited-vulnerabilities-catalog and cross-reference against your asset inventory today.

The broader pattern is worth paying attention to. Attackers are increasingly chaining commodity exploits: a known CVE gets them a foothold, a reverse shell keeps them in, and a miner pays the bills while they decide what to do next. Your perimeter firewall is not enough when the vulnerable service is already inside it. Segment, patch, and monitor egress traffic for unexpected outbound connections. Running UniFi with IDS/IPS enabled? Make sure your threat intelligence signatures are current. This is exactly the scenario those features exist for.

Proxmox VE 7 Has a Critical Auth Bypass, Root Access, No Password Required

Every homelab operator and small business sysadmin should stop what they're doing and read this one. A critical authentication bypass vulnerability in Proxmox VE 7 allows an attacker to gain root-level access to the web management interface without supplying valid credentials. The mechanism skips authentication entirely under certain conditions, no brute force, no credential stuffing, just a direct path to your hypervisor.

The immediate mitigation is straightforward: do not expose your Proxmox web UI (port 8006) directly to the internet. Behind a VPN or restricted to a management VLAN, you're in a much better position. Relying on "security through obscurity" or a non-standard port is not sufficient.

Proxmox VE 8.x does not appear to share this vulnerability, so upgrading from VE 7 is your best long-term fix. In the meantime, put a firewall rule in front of that management interface immediately. Running Proxmox on a UniFi network? Now is a good moment to verify your management VLAN ACLs are actually doing what you think they're doing. Pull the traffic logs and confirm.

The redeszone.net writeup is in Spanish but the technical details translate clearly enough; independent English-language confirmation is circulating on the Proxmox forums as well.

Ubiquiti's UniFi Whole Home WiFi 7 Is the AmpliFi Successor We've Been Waiting For

Ubiquiti quietly killed the AmpliFi line years ago and left a gap for users who wanted Ubiquiti-quality hardware without the full UniFi controller complexity. UniFi Whole Home WiFi 7 looks like the answer. The system meshes over 5 GHz and 6 GHz backhaul, putting it in the same performance tier as competing WiFi 7 mesh systems from Eero and Orbi, but with one significant differentiator: it lives inside the UniFi ecosystem.

That last point matters more than it might seem. Already running a UniFi gateway and switches? You can fold this into your existing Network application instead of managing a separate app for the mesh layer. Ubiquiti is also confirming compatibility with their travel router, which is a nice touch for users who want consistent policy and SSID behavior on the road.

For the networking professionals in this audience, think of this as a legitimate answer to the "my parents/client needs reliable WiFi but I don't want to manage a full UniFi site" problem. A single pane of glass that handles both the home mesh and the rest of the UniFi stack is genuinely useful. Pricing and availability details are still rolling out, watch the Ubiquiti store and the UniFi subreddit for in-hand reviews before committing.

HPE Raises Guidance as AI Workloads Drive Networking and Server Demand

HPE lifted its sales outlook for fiscal 2026 and 2027, and the driver is exactly what you'd expect: AI infrastructure buildout. Enterprises are buying more servers and, critically for this audience, more networking gear to support GPU clusters and the high-bandwidth, low-latency interconnects they require.

The revenue beat itself isn't the interesting part. What it signals about where networking budgets are flowing is. AI workloads are pushing organizations toward higher-speed fabrics (400G and 800G in the data center), smarter traffic management, and more investment in observability tooling to understand what's actually moving across those pipes. HPE's Aruba and Slingshot product lines are direct beneficiaries.

For network engineers in the enterprise space, this is validation that AI infrastructure isn't just a server team problem anymore. Spine-leaf redesigns, GPU cluster networking, RDMA over Converged Ethernet, these conversations are coming your way soon. Getting ahead of that curve, even at the lab level, is worth your time.

Meta's Muse Spark 1.3 Beats Opus 5 and GPT Sol 5.6 on Select Benchmarks

Meta dropped Muse Spark 1.3 and is claiming benchmark wins over Anthropic's Opus 5 and OpenAI's GPT Sol 5.6 in select categories. The obligatory caveat applies: these are Meta's numbers, run on Meta's evaluation harness. Independent evaluators like Artificial Analysis had early access to 1.1 and 1.2 and will publish third-party results on 1.3 within the next few days. Those numbers will be the ones worth acting on.

Muse Spark's trajectory has been fast. The jump from 1.1 to 1.3 in a relatively short window suggests Meta is iterating aggressively, and being competitive with frontier models from OpenAI and Anthropic on at least some tasks is meaningful for practitioners who care about open-weight or self-hosted options.

For IT teams evaluating AI tooling for internal use, code review, documentation, log analysis, network config generation, Muse Spark's continued improvement keeps the self-hosted path viable. Sending sensitive configs or logs to a third-party API is a real risk; running your own inference stack on local hardware sidesteps it. A model that benchmarks near the top of the field makes that tradeoff a lot easier to justify to stakeholders.