Before the CVE numbers existed, the phone calls started. That tells you more about the Citrix NetScaler situation than either severity score does. Citrix confirmed on September 27 that two NetScaler flaws, CVE-2026-88771 and CVE-2026-88772, are being exploited in the wild as zero-days. Both score 9.5. Both allow remote code execution on unauthenticated, internet-facing appliances….
A secure file-sharing vendor just told every customer, everywhere, to power down at the same moment. Six hours, globally synchronized, on a Saturday morning. That is not maintenance. Kiteworks, the secure file-transfer and communications platform used by government organizations, banks, and enterprises, emailed customers this week with advice you essentially never see: shut your servers…
An open Docker socket used to be a server breach. Now it also comes with a robot. ThreatDown disclosed Carbonato on 24 September, a botnet that spreads by finding Docker hosts with the daemon API exposed on port 2375, no password, no TLS. The exposed port itself is old news; that same misconfiguration has been…
An unauthenticated remote-code-execution bug in F5’s BIG-IP Access Policy Manager is being exploited in the wild right now, and the trigger is a configuration most security teams never treated as an attack surface: OAuth. F5 published an advisory this week for CVE-2026-94127, a critical flaw scoring 9.8 on the CVSS scale. The company confirmed that…
A Chinese-linked hacking group has compromised almost 1,000 ZyXEL office switches across 48 countries. The number that should worry African IT teams is 564. That is how many of the breached devices were still running factory default credentials. On Monday, threat intelligence firm GreyNoise published observations of a Chinese-speaking, state-affiliated actor exploiting CVE-2026-7273, a stack-based…
The flaw A pre-authenticated remote code execution chain in WordPress Core now has full technical details and a working proof-of-concept in public. It goes by “Click2Shell,” and BleepingComputer wrote it up on September 21. The good news is that it’s already fixed, in version 7.1.1. The bad news is that most of the internet’s WordPress…
A single browser extension can now take the wheel of your AI assistant. Not by exploiting the model, but by exploiting what the model is allowed to touch. On Saturday, September 19, security researcher Gal Weizman of Forever Security disclosed BragJack, a proof-of-concept attack that hijacks the AI assistants built into Google Chrome, Microsoft Edge,…
The fake installer problem just got worse. LastPass and Delphos Labs found GitHub repos posing as LastPass Authenticator that ship a signed Windows kernel driver built to switch off 145 security products before a stealer empties the machine. Malware that impersonates popular software is old news. Malware that walks in with a valid Microsoft signature…
A single hardcoded Cloudflare API key sitting inside Brevo’s own source code let attackers rewrite what thousands of customer websites served to visitors, without touching a single origin server. The marketing-platform company confirmed on September 17 that attackers used the stolen key to create a malicious Cloudflare Worker and inject ClickFix scripts into brevo.com, sendinblue.com,…
Google patched an actively exploited Pixel zero-day on September 15. The flaw, CVE-2026-58704, sits in the phone’s cellular modem, which is the one processor in your executives’ pockets that no MDM policy has ever inspected. What happened The vulnerability is a permission bypass caused by a logic error in the Pixel’s cellular modem code. Google’s…