Edge software under attack

Huntress saw attackers chain two AhsayCBS flaws to plant webshells and a cryptominer. Version 10.3.4, named as the fix, is also vulnerable, and no patch exists yet.

CVE-2026-88779 affects boxes that use SAML sign-in. Citrix calls it a crash; a researcher found malware running on a patched honeypot. Patch again, then check the logs.

DIVD, which warns others about software holes, says an agent chained two unknown Zammad helpdesk flaws to reach root in seconds and took volunteer data. The root flaw affects every...

A critical FortiMail flaw lets anyone who can reach it over the network write files and run code. Until updates ship, the advice is to switch off one feature or hide the admin inte...

CVE-2026-76504 lets an attacker with no password use Catalyst SD-WAN Manager's API as the administrator. It was exploited before the 30 September fix, and there is no workaround.

Fixes for eight flaws shipped on 27 September. US federal agencies have until 30 September and are told to look for intruders before updating.

CERT Polska now says the chain pairs CVE-2026-67279 with CVE-2026-86060. Routers updated in early September are covered, but patching does not remove an intruder.

Security appliances from Arista, F5 and Check Point are being attacked, and United States agencies must patch them by today. One flaw scores the maximum 10.0.

A stolen Cloudflare key let attackers rewrite three JavaScript files at the edge and strip the policy headers that would otherwise have blocked what they injected.

Local privilege escalation rarely alarms anyone. On shared hosting, where every customer already has a low-privileged account, it is the whole game.

An authentication bypass on the appliance that decides who gets onto the network, scored 10.0, already being exploited when Cisco published it. There is no workaround.

A token signed with an algorithm the gateway does not support is accepted anyway. WSO2 scored it 10.0 and shipped the fix in April; the forged tokens started arriving on 13 Septemb...

A mail gateway reads every message a company receives. Cisco's can be taken over by one of them, and the flaw was already being exploited when it was disclosed.

CVE-2026-68488 needs only a customer's own panel login and FTP access. On shared hosting, that turns one account into every site on the machine. It scores 9.9.

CVE-2026-0310 is reachable through a dataplane interface, not only the management plane, and Palo Alto lists no mitigation but the patch. Nobody has exploited it yet.

Two pre-authentication flaws in Check Point VPN were patched on 9 September. Three days later the Dutch NCSC said attempts are coming. That order is the unusual part.

JFrog Artifactory builds your software, ConnectWise ScreenConnect reaches into your machines and MikroTik RouterOS routes your traffic. A catalogue entry is a claim about attackers...

Talos found Sandworm's implant, Qilin ransomware and a third intruder inside Secure Firewall Management Center. The espionage-or-crime question no longer filters anything.

Two flaws chain an unauthenticated request into administrator scope in under five minutes, and the audit trail records the actions without naming an actor.

An unauthenticated attacker could read any file on a self-managed server. What sits on that server is every credential the build system can reach.

Wiz found 9.6 per cent of 3,074 public LiteLLM proxies accepting sk-1234 or no key at all — which is why LiteLLM scoring a post-authentication flaw at 2.1 is contested.

CISA's exploited-vulnerability catalogue has taken 37 new entries in 30 days, including this week's Citrix NetScaler authentication bypass and a 2025 Fortinet flaw.

CVE-2026-67401 is SQL injection in EmailTrack, disclosed 8 September with no reported exploitation. It is the second cPanel tenant-isolation failure in five weeks.

CVE-2026-75650 is unauthenticated RCE at CVSS 10.0, exploited three days before the fix. The payload runs when the store renders its own reminder email.

CVE-2026-86218 is a pre-auth RCE at CVSS 10.0, already exploited. The customer notice calls it a zero-day observed in the wild; the release notes call exploitation unconfirmed.

CERT Polska confirms exploitation from 2 September; the fixes landed on the 5th. The giveaway is a log entry recording a failed login for user "-2".

Two at CVSS 9.8, unauthenticated and network-reachable, none known to be exploited. The advisory names frontier AI models as part of how they were found, which vendors do not usual...

Five carry a three-day federal clock, two carry fourteen days, in a single batch. Three of the seven sit in AI and build infrastructure: LiteLLM, Kestra and Artifactory.

Two new zero-days are being chained on SMA1000 appliances, in the same two components as the June pair. The July fix builds sit at the top of the vulnerable range.

Softaculous says an attacker announced routes for its Hetzner-hosted addresses for about 33 hours and served a malicious Virtualizor update. The packages were not signed.

VulnCheck has recorded 360 attacks on a Langflow flaw fixed in January. It is the sixth separately identified Langflow vulnerability exploited during 2026.

Sygnia has documented an espionage group running fake services on Cisco routers during alternating hours. The authentication server compromised alongside them is where the value si...

PaperCut has shipped a second emergency patch after researchers walked around the first. A vendor under active exploitation ships something today, which usually blocks a request pa...

Most WordPress advisories describe flaws that need an account first. These five do not, which is what a 9.8 is actually saying, and one of them scores a full 10.

CVE-2026-20349 lets an unauthenticated attacker reload a Cisco ASA or FTD firewall through the remote-access SSL VPN. There is no workaround, the federal deadline was three days, a...

Framework and Tally were both breached on 3 August through a zero-day in Metabase, the business-intelligence tool they used. The bug needed nothing but the UUID in a shared dashboa...

CISA gave three days to fix an actively exploited N-able bypass. Across the catalogue, the three-week remediation window has stopped being the norm.

CVE-2026-20316 scores 5.3 — a medium. CISA still gave federal agencies three days and told them to check for compromise. The gap between those two facts is the story.

The advisory is exemplary and the hotfix shipped the same day. The pattern behind it is the story: two of Check Point's three all-time KEV entries landed this summer, both authenti...

CISA added CVE-2026-45659, a CVSS 8.8 deserialization remote-code-execution flaw in on-premises Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog on 1 Jul...

CISA added CVE-2026-48907, a maximum-severity flaw in the Widget Factory Joomla Content Editor extension (JCE / JCE Pro), to its KEV catalog on 16 June 2026, citing active exploita...

Oracle issued an out-of-band alert on 10 June for CVE-2026-35273, a CVSS 9.8 unauthenticated remote-code-execution flaw in PeopleSoft PeopleTools that Mandiant says was exploited a...

SolarWinds Serv-U CVE-2026-28318 is now in CISA’s Known Exploited Vulnerabilities catalogue after a June 2026 hotfix. This is an availability-risk threat intel update: patch Serv-U...

Singapore's CSA rates a GlobalProtect authentication-bypass flaw critical (9.1) — sterner than Palo Alto's own HIGH rating — as Rapid7 confirms attackers forging VPN cookies since...

CVE-2026-0300, a critical PAN-OS buffer overflow enabling unauthenticated root-level RCE, is being actively exploited by state-sponsored actors. CISA has ordered federal agencies t...