Vulnerabilities

Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

CISA's due date is Wednesday. Mandiant documented WHIPSHOT and SLAPSHOT on appliances hit before the patch. Patch, then hunt....
Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Storm-3168 used stolen Azure service principals to delete storage in seven minutes. Also: Elementor CSRF, a new Spectre Linux leak,…
PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

ShinyHunters changed one letter in the URL and got past the WAF rules protecting PeopleSoft. Oracle’s June fix is the…
Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

A federal tip led Kiteworks to recommend a weekend shutdown. The flaw sits in Advanced Forms, and every customer should…
iPhones still on iOS 26 need Apple’s new update after targeted attacks

iPhones still on iOS 26 need Apple’s new update after targeted attacks

Apple says a CoreGraphics bug may have been used against specific people on iOS before 27. Update to 26.7.1 or…
The app your team built with AI may be leaking its users table. Check Supabase today

The app your team built with AI may be leaking its users table. Check Supabase today

UpGuard found 16,326 Supabase databases with tables anyone can read. If someone shipped a quick app on Supabase, check row…
NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

Citrix confirmed two NetScaler RCEs were exploited before Saturday’s fix. One hits every appliance in the default config....
SharePoint’s federal clock runs out today — confirm the August builds

SharePoint’s federal clock runs out today — confirm the August builds

CISA’s SharePoint KEV is due Monday September 28. Microsoft already confirmed observed attacks — verify the farm builds....
Zimbra OnlyOffice can turn a public Briefcase link into a shell

Zimbra OnlyOffice can turn a public Briefcase link into a shell

Unauthenticated RCE when OnlyOffice meets a public Briefcase document. Patch to 10.1.21 or turn the feature off....
WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

An unsupported JWT algorithm can become an admin session on WSO2 API Manager and Universal Gateway. KEV due was September…
Ransomware crews now target TeamCity: patch your build server

Ransomware crews now target TeamCity: patch your build server

CISA says ransomware crews now exploit TeamCity CVE-2026-63077. Upgrade to 2025.11.7 or 2026.1.3, take the server off the Internet, and check for compromise.
Old Roundcube webmail bug now exploited: update this week

Old Roundcube webmail bug now exploited: update this week

A pre-auth SQL injection in Roundcube's virtuser_query plugin is now exploited. Update to 1.6.16 or 1.7.1 or disable the plugin. Here's what to check today.
One cPanel account can own the whole server: patch today

One cPanel account can own the whole server: patch today

A cPanel CalDAV/CardDAV flaw lets any hosting account run code as root. Update to 11.134.0.57, 11.136.0.41 or 11.138.0.8, plus WP Toolkit 6.11.3, today.