Mandiant and other security firms say attackers began exploiting an unpatched Citrix NetScaler flaw, tracked as CVE-2026-88772, in early September to install custom web shells and tunneling malware, gain root access, steal credentials, and move into internal networks. Victims span government, financial services, education, legal, and professional services organizations in North America and Europe. Citrix disclosed two related zero-days, CVE-2026-88771 and CVE-2026-88772, on Sunday and released patches after researchers including GreyNoise and watchTowr flagged active exploitation.
bleepingcomputer.com
· 2026-09-29
Citrix disclosed CVE-2026-88771 and CVE-2026-88772, both scoring 9.5 on the CVSS scale, affecting default configurations of its NetScaler ADC and Gateway products. Citrix confirmed exploits against unmitigated deployments and urged customers to patch immediately, though public warnings of attacks had circulated online since September 25, days before the formal disclosure.
darkreading.com
· 2026-09-29
Apple has released a security update fixing a vulnerability in the graphics engine underlying iOS 26, iPadOS 26 and macOS 26, which the company says may have already been used against specific targeted individuals. Meta's product security team discovered and reported the flaw, tracked as CVE-2026-86950; Apple did not disclose how it was found or how many devices were affected. Devices on the newer iOS 27, iPadOS 27 and macOS 27 also received Tuesday's update but were not vulnerable to this particular bug.
techcrunch.com
· 2026-09-29
Apple has issued security updates for CVE-2026-20700, an out-of-bounds write flaw in its CoreGraphics framework that was used in what the company calls an 'extremely sophisticated' attack against specific individuals. The bug, found by Meta Product Security, affects iOS, iPadOS, macOS, watchOS and tvOS, and could let a malicious file trigger arbitrary code execution. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
bleepingcomputer.com
· 2026-09-29
Ridge Security disclosed CVE-2026-42542, a high-severity flaw in the open-source TDengine time-series database used across manufacturing, energy, automotive and IoT sectors. The bug lets an unauthenticated attacker crash a vulnerable server with a single crafted network packet; TDengine has released version 3.4.1.6 to fix versions 3.4.0.0 through 3.4.1.5.
darkreading.com
· 2026-09-28
Apple issued iOS 26.7.1 for iPhones that haven't updated to iOS 27, alongside iOS 27.0.1, iPadOS 27.0.1 and several macOS updates. The update fixes a single CoreGraphics vulnerability, CVE-2026-86950, an out-of-bounds write bug that could allow arbitrary code execution when processing a malicious file, which Apple says was exploited in a highly sophisticated attack on specific targeted individuals.
9to5mac.com
· 2026-09-28
CISA has directed federal agencies to fix two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, that Citrix confirmed are being actively exploited in zero-day attacks. Both bugs let unauthenticated attackers achieve remote code execution, with the first hitting default configurations and the second requiring DTLS, which is on by default for VPN virtual servers. Citrix has issued patches and shared indicators of compromise, after agencies like the Dutch NCSC had already been privately warning organizations to shut down affected appliances.
bleepingcomputer.com
· 2026-09-28
Canonical says it is switching to a unified two-week release cycle for security updates, citing a surge in CVE reports driven partly by AI-assisted vulnerability discovery and the Linux kernel team's decision to become its own CVE Numbering Authority. The company says it will offer interim workarounds or hardening guidance within 24 to 48 hours of disclosure while full patches are prepared.
news.slashdot.org
· 2026-09-26
Google's Mandiant and Threat Intelligence Group report that the ShinyHunters extortion gang, tracked as UNC6240, has modified its exploit for the Oracle PeopleSoft flaw CVE-2026-35273 to bypass web application firewall protections. By URL-encoding characters in the vulnerable /PSEMHUB/ endpoint path, such as '%50' for the letter 'P', attackers can slip past WAF rules that only check the literal, unencoded path while Oracle WebLogic still decodes and routes the request to the vulnerable endpoint.
bleepingcomputer.com
· 2026-09-26
Researchers identified a double-fetch flaw in Avast's kernel driver that can lead to a pool overflow, potentially allowing code execution outside the antivirus sandbox. The flaw involves multiple reads of the same user-supplied data, which can be manipulated between fetches. Recent Windows updates mitigate this issue by enforcing user-mode access checks, reducing the exploit's viability.
safateam.com
· 2026-09-25
The Canadian Centre for Cyber Security has updated its May advisory to warn that CVE-2026-48842, a pre-authenticated SQL injection bug in Roundcube Webmail's virtuser_query plugin, is now being exploited in the wild. Roundcube patched the flaw in May with versions 1.6.16 and 1.7.1, but Shadowserver still counts over 523,000 internet-exposed Roundcube instances, with no clear data on how many remain unpatched.
bleepingcomputer.com
· 2026-09-24
CISA updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-63077, a critical TeamCity authentication bypass patched by JetBrains on July 25, as now being abused in ransomware attacks. JetBrains had already confirmed in-the-wild exploitation on August 7, and CISA had ordered federal agencies on August 5 to secure their systems within three days. Shadowserver currently tracks roughly 160 unpatched TeamCity servers still exposed to the flaw.
bleepingcomputer.com
· 2026-09-24
GoKawiil