Follow the cybersecurity developments that matter, explained in about five minutes each weekday.
Citrix confirmed two NetScaler RCEs were exploited before Saturday’s fix. One hits every appliance in the default config....
CISA’s SharePoint KEV is due Monday September 28. Microsoft already confirmed observed attacks — verify the farm builds....
Unauthenticated RCE when OnlyOffice meets a public Briefcase document. Patch to 10.1.21 or turn the feature off....
An unsupported JWT algorithm can become an admin session on WSO2 API Manager and Universal Gateway. KEV due was September…
Exploited NetScaler RCEs after Saturday’s patch, SharePoint KEV due today, Zimbra OnlyOffice public-share RCE, and WSO2 JWT auth bypass....
A cPanel CalDAV/CardDAV flaw lets any hosting account run code as root. Update to 11.134.0.57, 11.136.0.41 or 11.138.0.8, plus WP Toolkit 6.11.3, today.
GitLab's issue-by-email address carries an account-wide token that can push code and run CI jobs past IP allowlists. How to rotate it and check for misuse.
Friday's 5-minute cyber brief: ransomware on TeamCity build servers, exploited Roundcube webmail, cPanel root for any account, and a risky GitLab email token.
CISA says ransomware crews now exploit TeamCity CVE-2026-63077. Upgrade to 2025.11.7 or 2026.1.3, take the server off the Internet, and check for compromise.
A pre-auth SQL injection in Roundcube's virtuser_query plugin is now exploited. Update to 1.6.16 or 1.7.1 or disable the plugin. Here's what to check today.
Attackers went from probing to writing PHP in under a day. Verify you’re on a fixed release....
If auth sits in a Tomcat security constraint, an alternate endpoint name can skip it....
No known exploit yet — that’s the window, not a reason to wait....
