Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

That LiteLLM box someone spun up for a pilot may be mining crypto for a stranger

That LiteLLM box someone spun up for a pilot may be mining crypto for a stranger

A botnet steered by a poem has taken over more than 3,400 exposed AI and dev servers. Find yours before…
Before you book the Nexus upgrade, check which of Cisco’s four critical NX-OS advisories actually apply to your switches

Before you book the Nexus upgrade, check which of Cisco’s four critical NX-OS advisories actually apply to your switches

One batch hits every Nexus config. Three more only matter if NX-API, NGOAM or MPLS OAM is on. Nothing’s exploited…
FortiBleed is still locking admins out of their own FortiGates — reset logins and lock down management today

FortiBleed is still locking admins out of their own FortiGates — reset logins and lock down management today

More than 86,000 FortiGates already taken with real passwords, and ransomware crews are buying the access. A firmware update won’t…

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

Wednesday’s brief: Atlassian Data Center, then Struts, Smarty’s cache, Osaka’s outage

Wednesday’s brief: Atlassian Data Center, then Struts, Smarty’s cache, Osaka’s outage

Wednesday’s CyberExperts Daily Brief — Atlassian Data Center file access, Struts OGNL, Smarty cache injection, Osaka ransomware, plus NetScaler KEV…
Osaka’s university lost hundreds of servers to ransomware — classes stay cancelled through Thursday

Osaka’s university lost hundreds of servers to ransomware — classes stay cancelled through Thursday

About 500 servers down. Possible exposure for ~130,000 people. Prove your offline restore this week....
The PHP template engine under your storefront needs a quiet update

The PHP template engine under your storefront needs a quiet update

Smarty’s cache marker can forge executable PHP. Most teams did not pick Smarty — check the lockfile anyway....
If your Java app still uses Struts’ old REST mapper, upgrade before someone tests it

If your Java app still uses Struts’ old REST mapper, upgrade before someone tests it

Legacy RESTful action mapper still on? That configuration turns this OGNL bug into remote code execution....
Your Confluence and Jira boxes can leak known files without a login — patch Data Center today

Your Confluence and Jira boxes can leak known files without a login — patch Data Center today

Eight Atlassian Data Center products. No login required. Cloud is already fixed — your servers are not....
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day

Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day

CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes…
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again

PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again

CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and…
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners

JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners

CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch…
SonicWall SMA1000: The Front Door Had a Side Door, and Attackers Used Both

SonicWall SMA1000: The Front Door Had a Side Door, and Attackers Used Both

CVE-2026-83548 and CVE-2026-83549 chain pre-auth SSRF into AMC command injection for unauthenticated RCE on SonicWall SMA1000 gateways. Patch 12.4.3-03526 /…
MikroTrick: MikroTik RouterOS Flaws Are Hijacking Internet-Exposed Routers

MikroTrick: MikroTik RouterOS Flaws Are Hijacking Internet-Exposed Routers

CERT.PL: the MikroTrick chain turns exposed SSH into router admin Poland’s CERT.PL is warning that attackers are actively exploiting a…