George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].
PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

ShinyHunters changed one letter in the URL and got past the WAF rules protecting PeopleSoft. Oracle’s June fix is the…
Tuesday’s brief: PeopleSoft attackers slip past WAFs, then Kiteworks, iPhones, and leaky Supabase apps

Tuesday’s brief: PeopleSoft attackers slip past WAFs, then Kiteworks, iPhones, and leaky Supabase apps

ShinyHunters is back on unpatched PeopleSoft, Kiteworks’ weekend shutdown, an iPhone fix for targeted attacks, and 16,326 open Supabase databases....
WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

An unsupported JWT algorithm can become an admin session on WSO2 API Manager and Universal Gateway. KEV due was September…
Zimbra OnlyOffice can turn a public Briefcase link into a shell

Zimbra OnlyOffice can turn a public Briefcase link into a shell

Unauthenticated RCE when OnlyOffice meets a public Briefcase document. Patch to 10.1.21 or turn the feature off....
SharePoint’s federal clock runs out today — confirm the August builds

SharePoint’s federal clock runs out today — confirm the August builds

CISA’s SharePoint KEV is due Monday September 28. Microsoft already confirmed observed attacks — verify the farm builds....
Monday’s brief: NetScaler zero-days, then SharePoint’s deadline, Zimbra OnlyOffice, and a WSO2 JWT bypass

Monday’s brief: NetScaler zero-days, then SharePoint’s deadline, Zimbra OnlyOffice, and a WSO2 JWT bypass

Exploited NetScaler RCEs after Saturday’s patch, SharePoint KEV due today, Zimbra OnlyOffice public-share RCE, and WSO2 JWT auth bypass....
NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

Citrix confirmed two NetScaler RCEs were exploited before Saturday’s fix. One hits every appliance in the default config....
Ransomware crews now target TeamCity: patch your build server

Ransomware crews now target TeamCity: patch your build server

CISA says ransomware crews now exploit TeamCity CVE-2026-63077. Upgrade to 2025.11.7 or 2026.1.3, take the server off the Internet, and check for compromise.
Old Roundcube webmail bug now exploited: update this week

Old Roundcube webmail bug now exploited: update this week

A pre-auth SQL injection in Roundcube's virtuser_query plugin is now exploited. Update to 1.6.16 or 1.7.1 or disable the plugin. Here's what to check today.
One cPanel account can own the whole server: patch today

One cPanel account can own the whole server: patch today

A cPanel CalDAV/CardDAV flaw lets any hosting account run code as root. Update to 11.134.0.57, 11.136.0.41 or 11.138.0.8, plus WP Toolkit 6.11.3, today.
Your GitLab issue-email address can push code — rotate it today

Your GitLab issue-email address can push code — rotate it today

GitLab's issue-by-email address carries an account-wide token that can push code and run CI jobs past IP allowlists. How to rotate it and check for misuse.
Friday’s brief: TeamCity ransomware, then Roundcube, cPanel, GitLab

Friday’s brief: TeamCity ransomware, then Roundcube, cPanel, GitLab

Friday's 5-minute cyber brief: ransomware on TeamCity build servers, exploited Roundcube webmail, cPanel root for any account, and a risky GitLab email token.
Tomcat WebSocket lock can be walked around — check yours this week

Tomcat WebSocket lock can be walked around — check yours this week

If auth sits in a Tomcat security constraint, an alternate endpoint name can skip it....