PAN-OS CVE-2026-0322: Exploited Management Interface RCE
PAN-OS CVE-2026-0322 lets an authenticated admin run code as root on PA-Series, VM-Series and Panorama. It is exploited and on CISA KEV.
Read article
News archive
Tech News — Page 2
Showing 24 of 139 articles. Use the numbered pages to browse the complete archive.
Ivanti Connect Secure Zero-Day CVE-2026-104935: Attackers Went Straight for AD Secrets
An unauthenticated Ivanti Connect Secure chain was exploited from 3 October. CISA's deadline is 16 October, and the attackers used the appliance's LDAP account to pull LAPS and BitLocker secrets.
Read article
Danfoss Fridge Controllers Hijacked: Hundreds of French Supermarkets Defrosted to 50°C
Attackers forced internet-exposed Danfoss refrigeration controllers into a six-hour defrost across French supermarket chains. CERT-FR says disconnect, filter, and factory-reset.
Read article
GlobalProtect CVE-2026-0257: Settra Joins Qilin, and a Patch Alone Won't Evict Them
Two ransomware operations now forge GlobalProtect VPN sessions through a May auth bypass. Sessions minted before the fix survive it, so terminate every session and hunt the window.
Read article
AhsayCBS Zero-Days CVE-2026-105133/105134 Exploited to Mine Crypto on Backup Servers
Attackers are chaining an auth bypass and command injection to run code as SYSTEM on internet-facing AhsayCBS backup servers, and the version listed as the fix is still vulnerable.
Read article
GhostAction Returns: Hijacked Maintainer Accounts Mine Git History for Cloud and AI Keys
Attackers hijacked two popular open-source maintainer accounts and pushed a fake 'security audit' workflow to hundreds of repositories, scraping secrets from CI and from full git history.
Read article
CISA Adds Five Old CVEs to KEV as FBI Seizes Flax Typhoon's Scanning Tools
CISA's 8 October KEV batch is five CVEs from 2015 to 2023, all tied to a China-linked scanning operation whose FishHub and MicroScan tools the FBI just seized.
Read article
Splunk CVE-2026-76268: Default-On Patroni Sidecar Takes OS Commands With No Login
Splunk Enterprise 10.2 and 10.4 search head clusters run a bundled Patroni database manager whose REST API accepted unauthenticated commands. Found internally, rated 9.8, fixed in 10.4.3 and 10.2.7.
Read article
Atlassian CVE-2026-21589: Exploited Within Two Hours of the Public PoC Landing
A pre-auth file-read bug in a library shared across eight Atlassian Data Center products leaks Crowd credentials for admin takeover. Honeypots saw attacks two hours after the PoC dropped.
Read article
Dell DSU Flaw CVE-2026-86360: Root RCE Fix Shipped in July Labelled 'Optional'
Dell's DSA-2026-324 discloses a CVSS 9.6 path traversal in Dell System Update that gives an unauthenticated attacker root on PowerEdge hosts. The fixed build shipped 28 July marked Optional.
Read article
Denmark CPR Breach: 8.8M Records Pulled Through One Vendor's Legitimate Lookup Access
Attackers misused a small Danish company's lawful CPR lookup access for about ten days in September, extracting names, addresses and ID numbers for 8.8 million people. No CVE, no exploit.
Read article
NetScaler SAML Zero-Day CVE-2026-88779: Last Week's Patched Boxes Are Crash-Looping
A memory overflow in NetScaler's SAML path crashes the authentication daemon on builds patched for last week's zero-days. Citrix shipped 14.1-73.41 and 13.1-64.28 and confirms targeted attacks.
Read article
Zammad Zero-Days Hit CISA KEV After an AI Agent Rooted DIVD's Helpdesk in Seconds
An AI agent chained a session-fixation flaw and a local root escalation in Zammad to breach DIVD in seconds. Both CVEs are in CISA KEV with a 5 October deadline; the vendor disputes the disclosure.
Read article
FortiMail Zero-Day CVE-2026-104286 Exploited: Disable IBE Now, Patch Is 'Upcoming'
An unauthenticated path traversal and null-byte flaw lets attackers write files to FortiMail and plant an implant. CVSS 9.8, exploited in the wild, no patch yet, CISA KEV deadline 4 October.
Read article
Cisco Catalyst SD-WAN Manager CVE-2026-76504: One Encoded Character Bypasses Admin Auth
An unauthenticated attacker can take over Cisco Catalyst SD-WAN Manager by percent-encoding one character in a request. CVSS 9.8, actively exploited, no workaround, KEV deadline 3 October.
Read article
Apple CoreGraphics Zero-Day CVE-2026-86950: iOS 27 Immune, iOS 26 Fleets Get 3 Days
Apple patched an exploited CoreGraphics out-of-bounds write on iOS 26, iPadOS 26 and two macOS branches; iOS 27 was never affected. CISA gave federal agencies until 2 October.
Read article
Kiteworks Ordered a Global Shutdown on Federal Intel; the Flaw Was in Advanced Forms
Kiteworks told every customer to power off over the 26 September weekend after a federal warning, then fixed a critical Advanced Forms flaw. No CVE, no confirmed compromise, one design gap.
Read article
Citrix NetScaler Zero-Days CVE-2026-88771/88772 Exploited; CISA Gives 3 Days
Two unauthenticated RCE flaws in NetScaler ADC and Gateway were exploited before Citrix's 27 September bulletin. One hits the default config; CISA set a 30 September deadline with forensic triage.
Read article
PeopleSoft RCE CVE-2026-35273: ShinyHunters URL-Encode a Byte to Slip Past WAF Rules
ShinyHunters restarted mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273 by percent-encoding one byte of the URL to slip past WAF rules that blocked the vulnerable path.
Read article
SharePoint CVE-2026-65660: The 'Spoofing' Bug That Was Really RCE, Now Exploited
Microsoft first rated CVE-2026-65660 a moderate SharePoint spoofing bug, then reclassified it as remote code execution. Attackers are now exploiting it, and CISA set a 28 September deadline.
Read article
WSO2 API Manager JWT Bypass CVE-2026-5430 Hits CISA KEV Five Months After the Fix
Attackers are sending forged admin tokens to WSO2 API gateways, exploiting a JWT algorithm bypass patched in May. CISA gives agencies until 27 September; the KEV entry mislabels the bug.
Read article
WordPress Core CVE-2026-87902 Exploited Hours After Patch: Unauthenticated LFI to RCE
A file-inclusion flaw in WordPress core lets unauthenticated attackers reach code execution on sites that meet two common conditions. Patched in 7.1.2; exploited within hours of release.
Read article
F5 BIG-IP APM Zero-Day CVE-2026-94127 Exploited: OAuth Servers Get Unauthenticated RCE
A heap overflow in BIG-IP APM's OAuth handling gives unauthenticated attackers code execution in the data plane. F5 confirms exploitation, ships ENG hotfixes; CISA sets a 25 September deadline.
Read article
Zyxel GS1900 Flaw CVE-2026-7273: 996 Switches Looted in August, CISA Gives Three Days
A pre-auth stack overflow in the GS1900 web interface, patched in June, was used in August to pull configs and root hashes from 996 switches in 48 countries. CISA set a 24 September deadline.
Read article