George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].
Citrix NetScaler CVE-2026-19490: Gateway Auth Bypass Exploited in the Wild

Citrix NetScaler CVE-2026-19490: Gateway Auth Bypass Exploited in the Wild

Critical NetScaler ADC/Gateway auth bypass patched August 19 is exploited since ~September 3 and now on CISA KEV. Emergency edge…
JFrog Artifactory: Unauth Token Chain to Admin + Rust Backdoor

JFrog Artifactory: Unauth Token Chain to Admin + Rust Backdoor

Wiz saw attackers chain Artifactory flaws into admin in under five minutes, then drop Groovy plugins and a Rust C2.…
N-able N-central CVE-2026-86218: Pre-Auth RCE on the MSP Brain (CVSS 10)

N-able N-central CVE-2026-86218: Pre-Auth RCE on the MSP Brain (CVSS 10)

CVSS 10 pre-auth RCE on on-prem N-central, exploited before disclosure. Patch Hotfix 4, then hunt stranger admins — especially .invalid…
Adobe Commerce / Magento StyleSmuggler CVE-2026-75650: Unauth RCE Still Sprayed — Patch ≠ Clean

Adobe Commerce / Magento StyleSmuggler CVE-2026-75650: Unauth RCE Still Sprayed — Patch ≠ Clean

CVSS 10 Magento template RCE exploited before the hotfix and still mass-scanned. Apply VULN-39341, hunt backdoors, rotate keys....
VMware vCenter CVE-2026-59310: Ransomware Gangs Join Unauth Syslog RCE

VMware vCenter CVE-2026-59310: Ransomware Gangs Join Unauth Syslog RCE

CISA confirmed ransomware gangs are exploiting the critical vCenter Syslog RCE patched in July. Patch fixed trains and hunt the…
Fortinet FortiOS CVE-2025-25249: CAPWAP Heap Overflow to PivotC2 RAT

Fortinet FortiOS CVE-2025-25249: CAPWAP Heap Overflow to PivotC2 RAT

Unauthenticated CAPWAP overflow abused to deploy PivotC2 on FortiGate. Upgrade FortiOS and rotate harvested secrets....
Cisco Secure FMC CVE-2026-20079: Auth Bypass to Root — Patch ≠ Clean

Cisco Secure FMC CVE-2026-20079: Auth Bypass to Root — Patch ≠ Clean

CVSS 10 FMC authentication bypass confirmed exploited by nation-state and ransomware clusters. Hotfix now; TAC if IoCs hit....
The 5-Minute Cyber Brief: September 16, 2026

The 5-Minute Cyber Brief: September 16, 2026

Wednesday brief: vCenter ransomware, Magento StyleSmuggler, FortiGate PivotC2, and Cisco FMC root bypass....
The 5-Minute Cyber Brief: September 15, 2026

The 5-Minute Cyber Brief: September 15, 2026

Cisco email gateway root RCE due Wednesday, Sogou one-click to GRAYRABBIT, Windows ALPC SYSTEM zero-day, and F5 PoisonedRefresh fileless webshell....
F5 BIG-IP APM PoisonedRefresh: Fileless PHP Web Shell After CVE-2025-53521 — Patch ≠ Clean

F5 BIG-IP APM PoisonedRefresh: Fileless PHP Web Shell After CVE-2025-53521 — Patch ≠ Clean

PoisonedRefresh injects a PHP webshell into BIG-IP APM memory after CVE-2025-53521. Patching alone does not remove the implant....
Windows ALPC Heap Overflow CVE-2026-85880: AppContainer to SYSTEM Zero-Day (Not the Update Stack Bug)

Windows ALPC Heap Overflow CVE-2026-85880: AppContainer to SYSTEM Zero-Day (Not the Update Stack Bug)

CVE-2026-85880 is an exploited Windows ALPC heap overflow to SYSTEM — separate from Update Stack CVE-2026-81963. KEV due September 22....
UNC3569 / Sogou Input Method CVE-2026-51990: One-Click RCE to GRAYRABBIT

UNC3569 / Sogou Input Method CVE-2026-51990: One-Click RCE to GRAYRABBIT

Gen Digital observed UNC3569 exploiting CVE-2026-51990 in Sogou Input Method to deploy GRAYRABBIT. Fix ≥ 16.3.0.3498....
Cisco Secure Email Gateway CVE-2026-76461: Unauth SQL Injection to Root — KEV Due Wednesday

Cisco Secure Email Gateway CVE-2026-76461: Unauth SQL Injection to Root — KEV Due Wednesday

CVE-2026-76461: unauthenticated SQL injection in Cisco AsyncOS email parsing escalates to root. CISA KEV due September 17, 2026. Fixed AsyncOS…