44 issues

All briefings

October 2026

23 Oct 2026 — CISA flags actively exploited Arista VeloCloud SQL injection as PHP warns of an unpatched 9.8 RCE One confirmed in-the-wild flaw hit CISA's catalogue, PHP issued mitigation for an unpatched remote code execution bug, Google Chrome and Ruby shipped fixes, and researchers tallied tens of thousands of stolen edge-device credentials.

22 Oct 2026 — Arista VeloCloud Orchestrator zero-day under active attack; PHP ships emergency RCE patches Thursday 22 October 2026 brought an exploited SD-WAN management flaw, unauthenticated PHP remote code execution, a second LiteLLM supply-chain compromise and a certificate authority quitting after its private keys were guessed.

20 Oct 2026 — Eight eMudhra CA keys compromised, forcing emergency distrust across browsers — Palo Alto PAN-OS under active ransomware attack Mozilla and Google confirmed the private keys of eight eMudhra intermediate certificate authority certificates are compromised, while The Register reported multiple ransomware groups have been exploiting Palo Alto's firewall OS since June.

19 Oct 2026 — Three actively exploited flaws hit CISA's KEV list — Palo Alto, Microsoft and Ivanti all need patching CISA's Known Exploited Vulnerabilities catalog now lists three bugs under active exploitation, while supply-chain compromises at ConnectWise, Rank Math and AOMEI pushed malware and intruders into downstream networks.

18 Oct 2026 — ConnectWise disables seven of its own app identities after attackers use them to break into Microsoft 365 tenants Two actively-exploited problems led the weekend's reporting — a ConnectWise identity compromise reaching into customer Microsoft 365 tenants, and an OS command injection flaw in SiteGuard letting attackers run commands as root or SYSTEM.

17 Oct 2026 — ConnectWise Cloud Backup credential abused to sign in to 173 Microsoft 365 tenants; three flaws CISA lists as exploited The day's reporting centred on a live supply-chain campaign through ConnectWise Cloud Backup into Microsoft 365, while CISA's catalogue lists actively exploited flaws in Palo Alto Networks, Microsoft and Ivanti gear.

16 Oct 2026 — CISA adds actively-exploited BeyondTrust Remote Support auth bypass to its KEV catalog A critical authentication bypass in BeyondTrust Remote Support is being exploited for initial access, CISA warned on 16 October, alongside active exploitation flagged in PAN-OS, Windows Server and Ivanti Connect Secure.

15 Oct 2026 — Three actively-exploited flaws lead Thursday's fixes — Ivanti, Microsoft and Palo Alto CISA's catalog lists an Ivanti Connect Secure, a Windows Server and a PAN-OS vulnerability as under active exploitation, while BleepingComputer tracked live attacks on Nextcloud servers, D-Link and Ubiquiti devices, and the Arch Linux repository.

14 Oct 2026 — Palo Alto Networks patches an exploited PAN-OS zero-day as CISA flags four actively attacked flaws Firewalls, email gateways and Nextcloud servers are all under active attack, with a PAN-OS code-injection zero-day leading CISA's 14 October batch of exploited vulnerabilities.

13 Oct 2026 — Actively exploited Ivanti Connect Secure zero-day headlines a record 1,411-flaw Patch Tuesday CISA added an unauthenticated Ivanti Connect Secure remote-code-execution flaw to its Known Exploited Vulnerabilities catalog the same day Microsoft shipped its largest-ever Patch Tuesday.

12 Oct 2026 — GitLab urges an immediate patch for a max-severity RCE flaw as Google fixes six critical Chrome vulnerabilities — patch both today Two patch-now advisories landed together — a maximum-severity remote code execution flaw in GitLab and six critical Chrome vulnerabilities — alongside an actively exploited WordPress plugin and a run of disruptive attacks on European retail.

11 Oct 2026 — Six critical Chrome flaws get a fix as a cyberattack spoils food in hundreds of French supermarkets Google's advisory lists six CVSS 9.6 Chrome vulnerabilities fixed in 155.0.8059.39, while The Record reports an overnight attack disrupted refrigeration at French grocery chains.

10 Oct 2026 — Citrix NetScaler flaw under active attack leads a day dominated by Chrome fixes, arrests and AI-agent abuse A CISA-listed, actively exploited Citrix NetScaler ADC vulnerability tops a day that also brought five Chrome flaws rated 9.6 and a run of law-enforcement and AI-security news.

9 Oct 2026 — Citrix NetScaler flaw is being exploited now — CISA lists it, Google ships five critical Chrome fixes the same day An actively exploited Citrix NetScaler ADC denial-of-service flaw leads Friday's reporting, alongside a Chrome release closing five 9.6-rated bugs and unpatched AhsayCBS flaws already being exploited.

8 Oct 2026 — Citrix NetScaler flaw on CISA's exploited list tops a day dominated by a seven-government China advisory CISA added an actively exploited Citrix vulnerability to its Known Exploited Vulnerabilities catalog as the US and six partners detailed a Chinese state hacking campaign, and Google and Cisco shipped critical fixes.

7 Oct 2026 — FBI, CISA and researchers flag three edge-device flaws under active attack as Citrix NetScaler bug lands on KEV Active exploitation hit Citrix, Atlassian and Fortinet gateways, fresh critical patches landed for SonicWall and Chrome, and attackers obtained unauthorized certificates for Google domains by hijacking national domain registries.

6 Oct 2026 — Citrix NetScaler flaw is being exploited now; Chrome ships five critical fixes CISA added an actively-exploited Citrix NetScaler ADC bug to its Known Exploited Vulnerabilities catalog, Google patched five critical Chrome flaws, and researchers exploited 32 zero-days on day one of Pwn2Own Ireland.

5 Oct 2026 — CISA lists an actively exploited Citrix NetScaler flaw that crashes appliances — patch now CVE-2026-88779 is on CISA's Known Exploited Vulnerabilities catalog and is being used to knock NetScaler devices offline, while a second, separate NetScaler issue drew US and Australian warnings the same week.

4 Oct 2026 — Citrix patches an actively exploited NetScaler zero-day; CISA orders federal remediation A NetScaler denial-of-service flaw is being exploited in the wild, Citrix has shipped emergency updates, and CISA added it to its Known Exploited Vulnerabilities catalog on 4 October.

3 Oct 2026 — Three actively exploited flaws land on CISA's KEV list — Citrix, Apple patch now CISA's Known Exploited Vulnerabilities catalog added Citrix NetScaler and Apple macOS flaws confirmed under attack, while Warlock ransomware kept exploiting SharePoint against utilities and telecoms.

2 Oct 2026 — Fortinet FortiMail zero-day under active attack as CISA flags fresh exploited flaws Friday brought an actively exploited FortiMail zero-day with no patch for some admins, new entries on CISA's exploited-vulnerabilities catalog, and critical fixes from Citrix, Apple, Google, GitLab and Dell.

1 Oct 2026 — Fortinet FortiMail zero-day under active attack tops a heavy patch day for Citrix, Apple and Chrome A critical FortiMail flaw is being exploited in zero-day attacks and has been added to CISA's catalog, alongside actively exploited Citrix and Apple bugs and three high-severity Chrome fixes.

September 2026

29 Sept 2026 — Citrix NetScaler exploitation goes from stealth to mass attacks; Apple flaw added to KEV A NetScaler zero-day is now under widespread exploitation with web shells and root access reported, and CISA has added an actively exploited Apple out-of-bounds write flaw to its Known Exploited Vulnerabilities Catalog.

28 Sept 2026 — Actively exploited Citrix ADC flaws top the day; ShinyHunters run a new Oracle PeopleSoft campaign as the FBI's job sites stay offline CISA lists two Citrix ADC vulnerabilities and one WordPress flaw as known to be exploited, while Mandiant ties a live ShinyHunters campaign to an Oracle PeopleSoft bug.

27 Sept 2026 — Citrix NetScaler zero-days under active exploitation top a heavy day for defenders CISA amplified Citrix's disclosure of eight NetScaler flaws and added two to its exploited-vulnerabilities catalogue as an exploited SharePoint bug reached its patch deadline and ShinyHunters resumed PeopleSoft attacks.

26 Sept 2026 — ShinyHunters bypasses WAF filtering to resume mass exploitation of Oracle PeopleSoft The day's reporting centres on active, unauthenticated exploitation of a critical PeopleSoft flaw and Kiteworks urging its customers to stop using the platform after a warning from federal intelligence authorities.

25 Sept 2026 — Kiteworks tells customers to power down servers Saturday over warning of a potential attack A federal intelligence tip-off has Kiteworks asking customers worldwide to shut down, while CISA flags an actively exploited WordPress Core flaw.

24 Sept 2026 — CISA flags two actively exploited flaws in WSO2 and Adobe Commerce/Magento — patch on the clock A day dominated by active exploitation and AI-driven intrusion, led by two vulnerabilities CISA says attackers are already using.

23 Sept 2026 — F5 BIG-IP APM under active attack via critical 0-day RCE — patch is out Three products were reported under active exploitation, F5's access-management module the most serious, and Google shipped a Chrome update closing six flaws.

22 Sept 2026 — CISA flags four actively exploited flaws — in Check Point, Arista, and F5 gear — as WordPress and Chrome ship urgent fixes Tuesday brought confirmed active exploitation of internet-facing management and network appliances alongside critical patches for WordPress and Chrome and a fresh crop of breach claims.

Page 1 of 2 Older →