Vulnerabilities & CVEs

Dell has released fixes for two maximum severity vulnerabilities in its Container Storage Modules (CSM), the components that link Dell enterprise storage arrays to Kubernetes environments. The flaws could allow attackers to gain admin privileges, and admins are being urged to apply the patches as soon as possible. The affected software is Dell's CSM offering used to integrate enterprise storage with Kubernetes clusters. Organizations running these modules should treat the update as high priority given the maximum severity rating and the privilege escalation risk. Administrators should: Identify any deployments running Dell Container Storage Modules (CSM) in their Kubernetes environments. Apply the vendor's available patches as soon as possible. Review access controls and monitor for signs of unauthorized privileged activity while patching is in progress. Given the severity rating, delaying remediation leaves environments exposed to potential privilege escalation. Admins are advised to prioritize these updates over routine maintenance. Source: BleepingComputer Does your organization run Dell CSM in production Kubernetes clusters, and how quickly are you planning to roll out these patches?

GitLab has issued an urgent warning to customers regarding a critical vulnerability in its AI Gateway service. The flaw allows attackers to run arbitrary commands on affected instances, making it a serious remote code execution (RCE) risk that should be addressed immediately. The vulnerability affects the AI Gateway component, which is used to connect GitLab with various AI-powered features. Because the service can be exposed to untrusted input, exploitation could lead to full command execution on the host, potentially compromising sensitive data and infrastructure. At this time, no specific CVE identifier has been provided in the source report. GitLab is urging all customers running the AI Gateway to apply available patches or updates as soon as possible. Until patching is complete, limiting network exposure to the AI Gateway service is strongly recommended. Administrators should: Check whether their GitLab deployment includes the AI Gateway service. Apply the latest security updates from GitLab immediately. Restrict access to the AI Gateway to trusted networks only. Monitor for any signs of unauthorized command execution or unusual outbound traffic. Given the critical severity and the potential for remote exploitation, this should be treated as a high-priority patch for any organization using GitLab's AI features. Source: BleepingComputer Is your organization running the GitLab AI Gateway, and if so, have you already applied the patch or taken it offline?

The quarterly board meeting is looming, and security teams are scrambling to pull exports from the identity provider, cloud posture tool, vulnerability scanner, SIEM, and EDR console. Someone is reconciling all of it in a spreadsheet, and someone else is turning that spreadsheet into slides. Then a board member asks the three hardest questions: How secure is the organization, overall? What is The article cuts off at the second question, so the full set of three is not available in the source material. Source: [email protected] (The Hacker News) How does your organization currently answer the board's question about overall security posture?

CISA has added a critical Fortinet FortiMail vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation in the wild. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8, placing it in the critical severity range. The vulnerability allows unauthenticated attackers to write arbitrary files on the underlying system. CISA's addition of the flaw to the KEV catalog confirms that threat actors are actively targeting it, making patching a priority for affected organizations. Given the unauthenticated nature of the attack vector and the potential for arbitrary file writes to lead to further compromise, administrators running FortiMail should treat this as an urgent item. Review your exposure, apply available fixes from Fortinet, and monitor for signs of exploitation. Source: The Hacker News Has your organization deployed FortiMail, and if so, what steps are you taking to address this actively exploited flaw?

Microsoft's latest threat intelligence assessment warns that cyberattackers are currently extracting more value from artificial intelligence than defenders are, giving threat actors a meaningful edge in the ongoing security race. According to the company, adversaries are using AI to accelerate several phases of the attack lifecycle, while security teams struggle to keep pace with the same technology. The reported advantages for attackers include: Faster vulnerability discovery More efficient malware development Accelerated post-compromise activity, allowing intruders to move quickly once inside a network Microsoft frames this as an early-stage imbalance rather than a permanent condition, but the takeaway is clear: offensive use of AI is already delivering tangible operational gains. Defenders, meanwhile, are still working to integrate AI into detection, triage, and response workflows at a comparable speed. For security teams, this reinforces the need to prioritize fundamentals that blunt the impact of faster attacks: prompt patching, strong identity controls, network segmentation, and rapid detection and response. The gap Microsoft describes is less about any single tool and more about how quickly each side can operationalize AI across its work. Source: BleepingComputer Is your organization seeing AI-driven threats change your detection or response priorities yet?

Fortinet has issued a warning about a critical vulnerability in FortiMail, tracked as CVE-2026-104286, which is being actively exploited in zero-day attacks. The flaw allows attackers to execute unauthorized code or commands on vulnerable devices. At this time, the specific affected versions and mitigation steps have not been detailed in the available information. Administrators running FortiMail are urged to monitor Fortinet's official advisories for updates and patches. Vulnerability: CVE-2026-104286 Impact: Unauthorized code or command execution Status: Actively exploited in zero-day attacks Affected product: FortiMail Given the active exploitation, organizations should prioritize checking their FortiMail deployments and apply any available patches or mitigations as soon as they are released. Source: Unknown Is your organization running FortiMail, and if so, what steps are you taking to address this active threat?

Kiteworks has shipped security updates addressing 126 vulnerabilities across its product line, including a maximum-severity flaw in its Email Protection Gateway (EPG) solution. The most serious issue is a code injection vulnerability in Kiteworks EPG. Code injection flaws allow attackers to introduce and execute malicious code within a vulnerable application, which can potentially lead to data theft, service disruption, or broader compromise of the affected environment. The article does not specify a CVE identifier for this flaw. Given the volume of fixes and the severity rating of the EPG issue, administrators running Kiteworks products — particularly Email Protection Gateway — should prioritize reviewing the vendor's advisory and applying the available updates promptly. Affected product: Kiteworks Email Protection Gateway (EPG) Total vulnerabilities patched: 126 Highest severity: maximum Action: apply the latest Kiteworks security updates Source: BleepingComputer Does your organization run Kiteworks EPG, and if so, how quickly are you planning to roll out these patches?

Bitget has confirmed that the $387.5 million theft it suffered last week was carried out by attackers exploiting a zero-day vulnerability in third-party security products. The exchange cited findings from an ongoing investigation conducted by SlowMist. According to the investigation, malicious activity involving third-party security products was identified, including the zero-day flaw. Investigators also recovered a customized tool that the attacker had used during the intrusion. Key points from the disclosure: Confirmed stolen amount: $387.5 million Root cause: zero-day vulnerability in third-party security products Investigation led by SlowMist A customized attacker tool was recovered as part of the probe The exchange says its investigation remains ongoing. Notably, no specific CVE identifier has been disclosed for the zero-day at this time. Source: The Hacker News Does your organization rely on third-party security tooling in ways that could widen your exposure to a supply-chain-style zero-day like this?

Threat actors are actively exploiting a now-patched vulnerability in Zimbra Collaboration Suite (ZCS) to plant web shells and steal mailbox data, according to research from the Microsoft Security Research team. The flaw, tracked as CVE-2026-73570, carries a CVSS score of 8.9 and is described as an unauthenticated operating system command injection issue that can lead to remote code execution. The attack chain begins with the unauthenticated command injection, which allows adversaries to run arbitrary commands on exposed Zimbra instances. Once inside, attackers deploy web shells to maintain persistent access and go after authentication secrets and mailbox content. Key details to note: Affected platform: Zimbra Collaboration Suite (ZCS) Vulnerability type: unauthenticated OS command injection leading to remote code execution Identifier: CVE-2026-73570 Severity: CVSS 8.9 Status: patch is available; the flaw is now patched Observed post-exploitation activity: web shell deployment and mailbox data access If your organization runs Zimbra, confirm you are on a patched build and review your mail infrastructure for signs of unauthorized access, including unexpected web shells and suspicious authentication activity. Because the flaw is unauthenticated, any internet-facing ZCS instance that has not been updated should be treated as potentially exposed. Source: The Hacker News Has your organization already applied the Zimbra patch, and what steps are you taking to check for web shells or compromised credentials?

Cisco has disclosed a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager, the platform used to manage Cisco SD-WAN deployments, and warns that the flaw is already being exploited in the wild. The advisory was published on September 30. Tracked as CVE-2026-76504, the vulnerability is an authentication bypass that could let a remote attacker with no login credentials interact with the Manager's API with the privileges of the admin user. In other words, successful exploitation grants unauthenticated administrative access to the management interface. Key details: Affected product: Cisco Catalyst SD-WAN Manager Vulnerability type: Critical authentication bypass Impact: Remote, unauthenticated attacker can use the Manager's API as the admin user Exploitation status: Actively exploited in the wild Fix: Fixed releases are available Workaround: None — Cisco states there is no workaround Because no workaround exists, applying the fixed releases is the only remediation path. Organizations running Catalyst SD-WAN Manager should prioritize patching, and given the active exploitation and the administrative-level access this flaw provides, they should also review their environments for signs of unauthorized API activity. Source: The Hacker News Has your organization already applied the fixed releases, or are you still assessing exposure to CVE-2026-76504?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical vulnerability in MikroTik RouterOS that could allow remote code execution or trigger a denial-of-service condition. According to the advisory, the flaw can be exploited pre-authentication, meaning an attacker would not need valid credentials to target affected devices. Given the severity, administrators running MikroTik RouterOS are urged to review the advisory and apply any available mitigations or updates promptly. The pre-auth nature of the bug makes exposure especially risky for internet-facing routers, so prioritizing patching and restricting management access is strongly recommended. Source: BleepingComputer Is your organization running MikroTik RouterOS, and if so, how are you handling the risk from this pre-auth flaw?

TeamViewer has issued an urgent advisory urging customers to patch a set of high-severity vulnerabilities affecting its client and host software. The remote access company warned users on Tuesday to apply the fixes as soon as possible, signaling that the flaws pose a serious risk to unpatched systems. The affected software spans both the client and host components, meaning a wide range of installations could be exposed. TeamViewer has not disclosed full technical details publicly, but the severity rating and the company's urgent tone indicate that prompt action is essential. Recommended steps: Update TeamViewer client and host software to the latest available version immediately. Verify that automatic updates are enabled where feasible. Prioritize patching on internet-facing or business-critical endpoints. Monitor vendor communications for any further guidance or revised advisories. If your organization relies on TeamViewer for remote support or access, treat this as a priority maintenance window rather than a routine update. Source: BleepingComputer Has your organization already pushed the update, or are you waiting on change-management approval before patching?

Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations across North America and Europe. The activity was observed by Mandiant Consulting and the Google Threat Intelligence Group (GTIG) in September 2026. Targeted sectors include: Government Financial services Technology Education Legal and professional services The flaw is being exploited to gain root access on affected appliances, after which the attackers deploy the WHIPSHOT and SLAPSHOT payloads. If your organization runs NetScaler ADC or NetScaler Gateway, it is worth reviewing your exposure and confirming that the relevant patches are applied. Source: The Hacker News Has anyone seen signs of this activity in their environment, and how are you handling mitigation?

Cybersecurity researchers have published technical details on a critical flaw in Citrix NetScaler ADC and Gateway that has already seen active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772, carries a CVSS score of 9.5. It is a memory overflow bug in the handling of the Datagram Transport Layer Security (DTLS) protocol, with the root cause residing within NetScaler itself. Exploitation details released by researchers describe a pre-authentication path that can lead to shellcode execution, meaning an attacker may be able to trigger the flaw and run code without first logging in. Key points to note: Affected products: Citrix NetScaler ADC and NetScaler Gateway Vulnerability type: memory overflow in DTLS protocol handling Attack vector: pre-authentication, potentially leading to shellcode execution Status: patched, but actively exploited in the wild Given the pre-auth nature of the flaw, organizations running exposed NetScaler ADC or Gateway instances should treat this as high priority and confirm they are running a patched version. Source: The Hacker News Has your organization already applied the patch, or are you still assessing exposure on internet-facing NetScaler appliances?

Researchers from VUSec and Scuola Superiore Sant'Anna have disclosed a new Spectre-v2 variant that has been codenamed Branch Target Reuse (BTR). The vulnerability affects Just-In-Time (JIT) engines found in web browsers, language runtimes, and the operating system kernel, and it spans multiple CPU vendors. According to the researchers, the core insight behind the attack is that although modern CPUs are equipped with mitigations, those defenses can still be bypassed to leak Linux memory. The disclosure notes that existing protections are not sufficient to stop this class of attack. The technical details remain limited in the excerpt, but the affected surface is broad: Web browser JIT engines Language runtime JIT engines Operating system kernel JIT components Systems running on multiple CPU vendors Because the issue targets shared speculative execution behavior rather than a single product, users should watch for vendor advisories covering CPU microcode, kernel updates, and browser/runtime patches. No specific CVE ID or KB number was provided in the source material, so keep an eye on official channels for those identifiers as they are assigned. Source: The Hacker News Has your organization begun reviewing its JIT and speculative execution exposure in light of this disclosure?

Attackers have been exploiting a zero-day vulnerability in Citrix NetScaler to compromise exposed appliances and move deeper into victim networks. According to cybersecurity firms tracking the activity, the flaw is being used to deploy custom web shells and tunneling malware, granting attackers root-level access, enabling credential theft, and facilitating lateral movement into internal environments. The vulnerability is tracked as CVE-2026-88772 and has been exploited in the wild as a zero-day before patches or mitigations were available. Key points from the reporting: Citrix NetScaler appliances are the targets of the exploitation campaign. The vulnerability is identified as CVE-2026-88772. Attackers deployed custom web shells for persistent remote access. Tunneling malware was used to establish covert channels into internal networks. Successful exploitation allowed root access on affected systems. Stolen credentials were used to spread further within victim environments. Organizations running Citrix NetScaler should treat this as an urgent exposure risk. Until official patches or mitigations are confirmed, defenders should review appliance logs for signs of web shell deployment and unusual outbound tunneling activity, restrict management interface exposure where possible, and rotate credentials that may have been accessible from compromised systems. Source: Publication Name Has your organization reviewed its NetScaler appliances for signs of compromise since this campaign came to light?

Kiteworks has brought customer systems back online after patching a critical vulnerability that prompted a precautionary shutdown advisory. The American tech company had previously urged customers to take systems offline as a safety measure while it worked on a fix. With the patch now available, the shutdown warning has been lifted and normal operations can resume. The article does not disclose a specific CVE ID or detailed technical specifics about the flaw, so the exact nature of the vulnerability remains undisclosed in the public reporting. Key points: Kiteworks issued a precautionary advisory telling customers to shut down systems. A patch was developed and released to address the critical flaw. The shutdown warning has now been lifted, allowing systems to come back online. Administrators running Kiteworks environments should ensure the patch has been applied before restoring service, and confirm no systems were left running unpatched during the advisory window. Source: Unknown Were any of your Kiteworks instances affected during this advisory, and how did your team handle the downtime?

A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to authenticate to a legitimate service. The SDK maintainers detailed the issue in a security advisory. According to the advisory, affected versions transmitted the client secret, the authorization code, and the PKCE proof key to a token endpoint controlled by the attacker. This means a hostile server could capture credentials intended for a genuine service and potentially use them to impersonate the client or gain unauthorized access. Affected versions: MCP Python SDK releases prior to 1.30.0 The vulnerability is resolved in version 1.30.0. Users and developers running applications built on the SDK should upgrade to that version or later as soon as possible. Given the nature of the flaw, operators should also review any OAuth clients that may have connected to untrusted or third-party MCP servers, and consider rotating client secrets and authorization codes that could have been exposed. Source: The Hacker News Has your organization already patched to MCP Python SDK 1.30.0, or are you reviewing your OAuth integrations for exposure?

Apple has rolled out security updates to fix a CoreGraphics vulnerability affecting older versions of iOS, iPadOS, and macOS. The flaw, tracked as CVE-2026-86950, is an out-of-bounds write that could allow arbitrary code execution when a maliciously crafted file is processed. Apple says the issue may have been exploited in targeted attacks. Affected platforms: Older versions of iOS Older versions of iPadOS Older versions of macOS Users on older releases should apply the available updates as soon as possible to close the exposure window. Given that exploitation has possibly occurred in the wild, prompt patching is strongly advised. Source: The Hacker News Are you running any of the affected older iOS, iPadOS, or macOS versions in your environment, and how are you handling the update?

A placeholder domain that was never meant to resolve ended up referenced in roughly 1,700 repositories. Someone eventually registered it and began serving malicious lures from it, turning a long-forgotten assumption into live attack surface. It was that kind of week across the threat landscape, where weak service accounts, unpatched bugs, exposed systems, and phishing kits continued to do the heavy lifting for attackers. Among the headline incidents, a crypto theft totaling $387M drew significant attention, alongside active exploitation of Citrix flaws. The recap also covered AI agents behaving outside their intended instructions, adding a newer wrinkle to the usual mix of threats. Key themes from the week: A placeholder domain referenced across ~1,700 repositories was registered by a third party and used to host malicious lures A crypto hack resulting in $387M in losses Exploitation activity targeting Citrix products AI agents operating off-script, raising fresh concerns about autonomous tooling Continued reliance by attackers on weak service accounts, legacy bugs, exposed systems, and phishing kits The throughline is familiar: overlooked defaults and stale assumptions keep converting into working exploit paths, and attackers are happy to keep using them. Source: The Hacker News Does your organization have any exposure to the placeholder domain issue or the Citrix flaws mentioned this week?