Symantec and Carbon Black researchers say the China-linked Warlock group, also tracked as Longlegs, has compromised a water utility, a telecom provider, a regional government body and a university by exploiting on-premises SharePoint vulnerabilities, including the ToolShell exploit chain. In one July 22 intrusion, the attacker disabled security software on roughly 40 hosts within two hours and deployed Warlock ransomware to at least 33 machines, using a signed but vulnerable driver to kill endpoint defenses.
bleepingcomputer.com
· 2026-10-02
The Dutch Institute for Vulnerability Disclosure said its network was breached via a chain of two zero-day flaws in the open-source Zammad ticketing platform, tracked as CVE-2026-102489 and CVE-2026-102490. DIVD said the attack was carried out by an autonomous AI agent that hijacked sessions, executed code remotely, and escalated to root privileges within seconds. Network segmentation and DIVD's response reportedly stopped the attacker from moving further into its systems.
bleepingcomputer.com
· 2026-09-30
Citrix disclosed CVE-2026-88771 and CVE-2026-88772, both scoring 9.5 on the CVSS scale, affecting default configurations of its NetScaler ADC and Gateway products. Citrix confirmed exploits against unmitigated deployments and urged customers to patch immediately, though public warnings of attacks had circulated online since September 25, days before the formal disclosure.
darkreading.com
· 2026-09-29
Citrix administrators report being privately contacted by IT suppliers, law enforcement, and cybersecurity agencies warning of two unpatched NetScaler remote code execution vulnerabilities being exploited in the wild. Security firm watchTowr confirmed the flaws are distinct from CVE-2026-19490 and CVE-2026-19489 disclosed in August, and said patches are expected next week.
bleepingcomputer.com
· 2026-09-27
Eclypsium's September InfraTrust Pulse report logged 158 new security advisories across 17 vendors between August 25 and September 17, covering 1,699 vulnerabilities. Of these, 42 were rated critical, eight scored a maximum 10.0 severity, 71 could be exploited remotely without authentication, and five advisories included flaws later added to CISA's Known Exploited Vulnerabilities catalog. The report singles out a maximum-severity Cisco Secure Firewall Management Center authentication bypass, CVE-2026-20079, which Cisco confirmed on September 9 was being actively exploited, allowing attackers to run commands as root without credentials.
bleepingcomputer.com
· 2026-09-23
GreyNoise's Global Observation Grid detected a Chinese-speaking threat actor exploiting flaws in ZyXEL GS1900 switches and WordPress's wp2shell vulnerabilities to compromise 996 devices and steal over 18,500 records. The group, linked to the Red Heron actor previously tied to a Gitea flaw, breached at least 49 organizations across 29 countries since early June 2026, including an unnamed Western government agency.
bleepingcomputer.com
· 2026-09-22
CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog after confirming active attacks. The flaw allows unauthenticated LAN attackers to run OS commands via crafted HTTP requests, and federal agencies must secure affected devices by Thursday under Binding Operational Directive 26-04. Zyxel issued firmware fixes on June 16 but has not yet updated its advisory to acknowledge exploitation.
bleepingcomputer.com
· 2026-09-22
Forcepoint published research showing how AI applications lacking limits on compute and resource usage can rack up massive, unbudgeted bills, a vulnerability now ranked sixth on OWASP's 2026 Top 10 for LLM Applications. Researcher Jyotika Singh outlined five scenarios, including leaked API credentials being used to flood pay-per-use AI services with requests, driving costs far past expected budgets.
darkreading.com
· 2026-09-21
Major tech firms including Microsoft, Oracle and Google reported unprecedented numbers of security patches this year, with Microsoft issuing 974 CVE fixes this month alone and Oracle shipping 1,448 patches in July compared to 309 a year earlier. Analysts tracking cve.icu counted 66,401 confirmed vulnerabilities as of this week, nearly double last September's tally, a jump attributed largely to AI tools now used for automated bug discovery.
wired.com
· 2026-09-19
Apple released detailed security changelogs for macOS 27 Golden Gate, macOS Tahoe 26.7, and macOS Sequoia 15.8, collectively addressing more than 200 vulnerabilities. The flaws include bugs that could let attackers execute code with kernel or root privileges, escape the sandbox, bypass Gatekeeper, or trigger remote code execution via Bluetooth, CUPS, and WebDAV.
9to5mac.com
· 2026-09-14
Alongside its new macOS 27 Golden Gate release, Apple has pushed out macOS Tahoe 26.7 and macOS Sequoia 15.8 as updates for users who haven't moved to the newest OS. Apple describes both as containing important security fixes recommended for all users, though it has not yet published detailed release notes on its security page.
9to5mac.com
· 2026-09-14
Gene Moody, Field CTO at Action1, argues that IT teams face an unsustainable mismatch between the growing volume of software patches and the shrinking time available to test them, forcing many organizations to skip review steps and push updates straight to production. He warns that simply automating patch deployment to go faster does not solve the underlying problem, since automation can propagate a bad update across thousands of endpoints just as quickly as a good one.
bleepingcomputer.com
· 2026-09-14
GoKawiil