Overview of incoming advisories.
2018 results found
A critical zero-day vulnerability (CVE-2026-94127) has been discovered in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. The flaw specifically affects BIG-IP systems configured with APM acting as an OAuth authorization server. Attackers are actively exploiting this vulnerability in the wild to execute arbitrary code without authentication. F5 disclosed the vulnerability on September 22 and has released engineering hotfixes to address the issue. The vulnerability is limited to environments where APM is issuing access tokens to applications via OAuth. Organizations using BIG-IP APM in OAuth server mode are urged to apply the hotfixes immediately. The active exploitation status and unauthenticated RCE nature make this a critical-priority patch.
View original advisory →A Chinese threat actor identified as UTA0565 has been observed exploiting a chained zero-day exploit involving two Google Chrome vulnerabilities (CVE-2026-85046 and CVE-2026-87491) and one Windows Advanced Local Procedure Call vulnerability (CVE-2026-85880). The attacks were detected on September 3 and 4, 2026, and were delivered through fake websites. The exploit chain was used to deploy malware known as CLEANGULP. The combination of browser and OS-level vulnerabilities allowed attackers to break out of sandboxes and escalate privileges. This represents a sophisticated, multi-stage attack campaign attributed to a Chinese state-linked actor.
View original advisory →Check Point has patched two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8) in Quantum Security Gateway and Security Management products. CVE-2026-85102 involves improper certificate trust validation during VPN negotiation, allowing unauthenticated remote attackers to bypass authentication and execute arbitrary code. CVE-2026-85103 is a heap-based buffer overflow in ASN.1-decoding of VPN certificates, also enabling unauthenticated remote code execution. Both affect Security Gateway and Check Point Spark Firewall when Site-to-Site VPN or Remote Access VPN is enabled. Active exploitation of CVE-2026-85102 has already been observed in the wild. NCSC warns of imminent large-scale exploitation attempts and urges organizations to apply patches immediately. A partial mitigation for Site-to-Site VPN involves disabling implied VPN rules and restricting UDP/500 and UDP/4500 to specific peer IPs.
View original advisory →D-Link has issued a warning about a maximum-severity zero-day vulnerability tracked as CVE-2026-86296 affecting its legacy DIR-822A dual-band Wi-Fi routers. The vulnerability has a public proof-of-concept exploit available but no patch has been released. The flaw is classified as maximum severity, making it extremely dangerous for affected users. As a legacy device, the DIR-822A may not receive an official fix, leaving users exposed. D-Link customers are urged to review the advisory and consider replacing or isolating affected devices. The existence of public PoC exploit code significantly raises the risk of active exploitation in the wild.
View original advisory →A critical CVSS 10.0 vulnerability tracked as CVE-2026-93952 has been discovered in on-premises VeloCloud Orchestrator (VCO), the server responsible for managing Edge devices in VeloCloud SD-WAN deployments. Arista disclosed the flaw on September 22, 2026. The vulnerability allows a remote unauthenticated attacker to access privileged internal functions and potentially compromise the VCO host. Only orchestrators configured to authenticate their Edge devices using certificates are affected by this flaw. Active exploitation has been confirmed in the wild, making this a high-priority patching target for affected organizations. The maximum CVSS score of 10.0 underscores the severity and ease of exploitation of this vulnerability.
View original advisory →A critical vulnerability tracked as CVE-2026-89775 has been discovered in the Linux kernel's KVM virtualization subsystem affecting ARM64 processors. The flaw exposes freed host memory to guest virtual machines when nested virtualization is enabled. An attacker with access to a guest VM can exploit this bug to read and write host kernel memory. The vulnerability can potentially be leveraged to escape the guest VM environment entirely and execute arbitrary code on the host machine. This represents a severe hypervisor escape scenario with significant implications for cloud and virtualization environments running ARM64-based KVM hosts.
View original advisory →A SharePoint Server vulnerability, CVE-2026-65660, was initially classified by Microsoft as a spoofing flaw with a CVSS score of 6.5. However, Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details revealing the flaw actually enables authenticated remote code execution. The vulnerability affects SharePoint Server 2016, 2019, and Subscription Edition. Microsoft has released patches for the affected versions. The misclassification highlights the importance of thorough vulnerability analysis beyond vendor-assigned severity ratings. The authenticated RCE capability makes this significantly more dangerous than the original spoofing classification suggested.
View original advisory →Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, publicly released a new zero-day exploit targeting Microsoft Defender (Windows Defender). The exploit is capable of blocking antivirus definition and software updates, potentially leaving systems unprotected against new threats. This is not the first zero-day released by Naceri, who has a history of disclosing Microsoft vulnerabilities publicly. The vulnerability poses a significant risk as it can be used to prevent security tools from receiving critical updates. If exploited by threat actors, this could be used as a precursor to deploying malware or ransomware on systems with outdated antivirus signatures. No CVE identifier was mentioned in the article. Microsoft had not yet issued a patch at the time of publication. The public release of a working exploit increases the urgency for a fix from Microsoft.
View original advisory →CISA has issued a directive ordering federal agencies to patch a high-severity vulnerability in Zyxel GS1900 series switches. The flaw is being actively exploited by attackers for data theft purposes. The directive comes with a deadline of Thursday, reflecting the urgency of the threat. Zyxel GS1900 series switches are network infrastructure devices commonly used in enterprise environments. The active exploitation of this vulnerability poses significant risk to organizations that have not yet applied available patches. CISA's mandate applies to federal civilian agencies but serves as a strong recommendation for all organizations using affected Zyxel hardware.
View original advisory →Security researcher Patrick Wardle demonstrated a proof-of-concept attack showing how malware already running on a Mac can hijack Meta's Muse AI assistant. The attack exploits a hidden configuration setting that redirects voice prompts dictated by the user to an attacker instead of Meta's servers. By modifying this obscure setting, attackers can leverage the broad system permissions already granted to the Muse app to conduct malicious activity. The vulnerability essentially turns the AI assistant into a backdoor, exploiting user trust and app permissions. The proof-of-concept was released on September 21, 2026, highlighting risks associated with AI assistants and their broad system access.
View original advisory →A critical vulnerability in WordPress core, tracked as CVE-2026-93485 and dubbed 'Comment2Shell', allows anonymous visitors to inject malicious scripts via comments. When a logged-in administrator views the affected page, the script executes and can achieve remote code execution on the server. The attack chain requires no authentication for the initial injection, making it particularly dangerous. WordPress addressed the flaw on September 17 with the release of version 7.1.1. Site owners were urged to update immediately to mitigate risk. The vulnerability represents a stored XSS-to-RCE escalation path exploiting privileged admin sessions.
View original advisory →CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability affecting Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog. The flaw carries a CVSS score of 8.8 and can result in arbitrary operating system command execution. A separate Veeam vulnerability is also referenced as being under active exploitation. Both vulnerabilities grant attackers elevated access, including SYSTEM-level privileges. The article highlights the urgency for organizations to apply available patches. Active exploitation evidence prompted CISA's inclusion of these flaws in the KEV catalog. The Zyxel flaw is a now-patched buffer overflow in network switch firmware. Organizations using affected Zyxel GS1900 series switches and Veeam products are urged to remediate immediately.
View original advisory →A critical improper certificate validation vulnerability has been identified in Check Point Security Gateway and Check Point Spark Firewall products. The flaw affects configurations using Site to Site VPN or Remote Access VPN. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the affected Gateway. The vulnerability is tracked as CVE-2026-85102 and has been listed by CISA. It is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under CISA implementation guidance. Organizations using affected Check Point products should apply vendor patches immediately.
View original advisory →A critical path traversal vulnerability has been identified in multiple Check Point products including Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. The vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on affected systems. This represents a significant risk as no authentication is required to exploit the flaw. The vulnerability is tracked as CVE-2026-93616 and has been listed by CISA, indicating active concern at a federal level. It is also referenced under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Organizations using affected Check Point products are urged to apply patches immediately and conduct forensic triage as outlined in the BOD 26-04 implementation guidance.
View original advisory →F5 BIG-IP APM contains a heap-based buffer overflow vulnerability that is triggered when an access policy and an OAuth profile are configured on a virtual server. An unauthenticated remote attacker can exploit this vulnerability to achieve remote code execution. CISA has flagged this vulnerability under BOD 26-04 for prioritized remediation. As a temporary mitigation, administrators are advised to apply the vendor-provided iRule to enable proactive forensic triage. The final remediation requires installing the official vendor patch as soon as possible. Additional forensic triage requirements are outlined in CISA's BOD 26-04 implementation guidance. The vulnerability is tracked as CVE-2026-94127 and details are available via NVD and F5's support portal.
Arista VeloCloud Orchestrator (VCO) on-premises deployments contain an improper input validation vulnerability tracked as CVE-2026-93952. A remote attacker could exploit this flaw to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data it manages. The vulnerability is listed in CISA's known exploited vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. Organizations running on-prem VCO deployments are urged to apply security updates as prioritized by CISA directive. Arista has published a security advisory with remediation guidance. Forensics triage requirements have also been outlined under BOD 26-04 implementation guidance.
View original advisory →CISA has issued an alert warning that threat actors are actively exploiting three vulnerabilities in the Linux kernel, with at least one rated as critical severity. The agency is urging organizations to apply patches promptly to mitigate risk. The exploitation of these flaws poses significant risk to systems running affected Linux kernel versions. CISA's warning underscores the urgency for system administrators to prioritize patching. Active exploitation in the wild increases the likelihood of widespread impact across enterprise and government environments. The advisory highlights the ongoing targeting of Linux-based infrastructure by malicious actors. Organizations are advised to review CISA's Known Exploited Vulnerabilities catalog and act accordingly.
View original advisory →A new cross-site request forgery (CSRF) vulnerability nicknamed 'Click2Shell' has been disclosed affecting WordPress Core. Technical details and a proof-of-concept exploit have been published, raising the risk of active exploitation. The flaw allows attackers to trick authenticated users into triggering malicious requests, ultimately enabling remote PHP code execution on the server. As it affects WordPress Core rather than a specific plugin or theme, the attack surface is extremely broad. The availability of a public PoC significantly increases the likelihood of exploitation in the wild. WordPress site administrators are advised to apply patches or mitigations as soon as they become available.
View original advisory →North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices across more than 100 countries. The campaign has resulted in the theft of funds or account credentials from over 7,000 cryptocurrency wallets. Total stolen cryptocurrency amounts to approximately $10.71 million. Primary targets include individual web designers, engineers, and cryptocurrency specialists. The findings were released via a joint cybersecurity advisory. The campaign represents a significant and ongoing state-sponsored cyber threat with both financial and espionage motivations. The scale and reach of the operation underscore the sophisticated capabilities of North Korean threat actors in conducting large-scale social engineering and malware campaigns.
View original advisory →Threat actors are using ClickFix-style lures to distribute a previously undocumented remote access trojan (RAT) named ChainScript. The malware has appeared under multiple build names including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams to trick users into execution. ChainScript leverages the Polygon blockchain network to rotate its command-and-control (C2) infrastructure, making takedowns more difficult. The campaign was uncovered and reported by Blackpoint's Adversary Pursuit Group (APG). The use of blockchain for C2 rotation represents an advanced evasion technique increasing the resilience of the malware's infrastructure. ClickFix lures typically trick users into executing malicious scripts under the guise of fixing a software issue. This threat is considered high impact due to its novel infrastructure abuse and active deployment.
View original advisory →