ssvc

SSVC is CVSS backwards!

Public Key

npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshx

NIP-05 Address

Profile Code

nprofile1qqsxkpnxxsmyyqg2us2da08mt5venypqq8dlsr7cmtvp7r6xcy0v4pcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsntwv8k

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshx

Show more details

Last Notes

2026-10-30 17:45:57 UTC

- reply

For the last weekday of Cybersecurity Awareness Month, CISA added more CVEs to the KEV Catalog on a Friday :)<li>CVE-2026-111357 (8.8 high) Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability</li><li>CVE-2026-118527 (4.3 medium) Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability</li>
https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog
#CISA #KEV #Ivanti #zeroday

2026-10-30 15:26:25 UTC

- reply

Ivanti oh no bb what is u doin?
> At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible. Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.
New Ivanti zero-days: CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable filenames)
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
#ivanti #cve #zeroday #eitw

2026-10-30 12:19:06 UTC

CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.
> This vulnerability is being actively exploited in the wild.
https://www.drupal.org/sa-contrib-2026-254
#drupal #CVE #eitw

2026-10-29 15:24:05 UTC

- reply

*Notices new Ivanti CVE* owo what's this?
> Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
https://nvd.nist.gov/vuln/detail/cve-2026-111357
#ivanti #zeroday #cve #eitw

2026-10-29 15:08:01 UTC

placeholder: https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-three-known-exploited-vulnerabilities-catalog
#CISA #KEV

2026-10-29 13:31:49 UTC

On October 20 and 21, an attacker tried to exploit CVE-2026-97229 against Alpine Linux's GitLab instance.
> We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with.
https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
#GitLab #CVE #eitw

2026-10-28 20:19:08 UTC

Cisco zero-day: CVE-2026-76418 (8.6 high)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
> In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
#cisco #zeroday #eitw #CVE

2026-10-23 20:19:16 UTC

- reply

they solved the problem by putting a 0 at the end of their URL: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0

2026-10-23 20:06:54 UTC

CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE Server OS Command Injection Vulnerability was just added to the CISA KEV Catalog. TGIF
#CISA #KEV #CollaboraOnline

2026-10-23 18:49:58 UTC

- reply

So when CISA adds another CVE to the KEV Catalog later in the day, how should they handle it? 👀 They already published a "CISA adds one known exploited vulnerability to the Catalog" today, should they create a redirect to the new blog post?

2026-10-23 17:55:55 UTC

- reply

Placeholder for CISA blog post: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
#CISA #KEV #Arista

2026-10-22 16:29:02 UTC

Cybersecurity Awareness Month isn't over yet: Arista VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625 (CVSSv3.1: 9.9 critical , CVSS4: 9.4)
> This issue was detected by Arista and is known to be actively exploited.
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
#arista #zeroday #CVE #eitw

2026-10-22 13:56:40 UTC

lol. lmao even.
https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
#Linux #ZDI #CVE

2026-10-22 13:09:47 UTC

- reply

he who smelt it, dealt it 😤

2026-10-22 13:05:59 UTC

- reply

Canonical is the CNA for Ubuntu. This is a CNA issue and we shouldn't push for the CNA of last resort unless they don't respond.

2026-10-21 16:57:33 UTC

- reply

> We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.
https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619
#php2shell #php #CVE #eitw

2026-10-21 16:22:26 UTC

- reply

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.
https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
#eitw #php #php2shell #CVE

2026-10-21 15:49:13 UTC

- reply

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
#php #CISA #CVE

2026-10-21 13:57:33 UTC

- reply

#
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.https://www.php.net/archive/2026.php#2026-10-21-5
#php #CVE

2026-10-21 01:37:35 UTC

Notices **353** security fixes in Chrome
OwO what's this?
https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
No zero-days at least, but this amount of CVEs in one patch appears to be the new normal.
#Google #Chrome #CVE

2026-10-20 20:46:46 UTC

Get ready for PHP security updates tomorrow to address CVE-2026-109618 and CVE-2026-109619 (the leaked RCE CVEs with CVSSv4 9.2 scores)
https://www.php.net/archive/2026.php#2026-10-20-1
https://cert.europa.eu/publications/security-advisories/2026-018/
#PHP #CVE

2026-10-20 10:40:00 UTC

Symantec: APT28 (GRU Unit 26165) Targets Defense Firms in Two NATO Countries
https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets
#threatintel #Russia #cyberespionage #IOC

2026-10-19 20:50:21 UTC

- reply

"Threat actor? In my Siemens? It's more likely than you think"
> Siemens has reported that CVE-2026-110936 is being exploited in the wild.
https://www.cyber.gc.ca/en/alerts-advisories/siemens-security-advisory-av26-1063
#CVE #Siemens #eitw

2026-10-19 18:21:12 UTC

Active Exploitation of CVE-2026-110936 in Siemens Software Center
> Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.
https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
#eitw #cve #siemens

2026-10-19 16:17:13 UTC

- reply

For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:
https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/
#citrix #netscaler #threatintel #IOC #pitscaler

2026-10-19 13:22:57 UTC

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96652" target="_blank" rel="nofollow noopener">CVE-2026-96652</a> (5.3 med) Plex Media Server SSRF</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96654" target="_blank" rel="nofollow noopener">CVE-2026-96654</a> (6.9 med) Plex Media Server URL injection</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96655" target="_blank" rel="nofollow noopener">CVE-2026-96655</a> (5.3 med) Plex Media Server arbitrary-host SSRF</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96656" target="_blank" rel="nofollow noopener">CVE-2026-96656</a> (8.6 high) Plex Media Server arbitrary file write</li>
#threatintel #plex #IOC #eitw

2026-10-19 12:56:01 UTC

SiteGuard exploited zero-day: CVE-2026-106931 (CVSS4: 8.5 high) SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
English translation:
> A vulnerability (CVE-2026-106931) allowing OS command injection has been discovered in the statistics function of SiteGuard Server Edition. Exploitation has already been confirmed.
https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
#siteguard #eitw #CVE #zeroday

2026-10-16 17:34:28 UTC

- reply

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog<li>CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability</li><li>CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability</li>
#CISA #KEV #Beyondtrust #fortinet

2026-10-16 14:02:01 UTC

This one slipped through the cracks this past Patch Tuesday because the CVE started with 2025: CVE-2025-61624 (5.4 medium) path traversal > aribtrary write/delete
https://fortiguard.fortinet.com/psirt/FG-IR-26-122
Unit 42's blog post states it was exploited in the wild: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
> The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.
#threatintel #eitw #CVE #fortinet #ioc

2026-10-16 13:10:19 UTC

- reply

https://euvd.enisa.europa.eu/search?exploited=true

2026-10-16 01:31:01 UTC

BeyondTrust doing their darnedest not to explicitly say that there's an exploited zero-day vulnerability in their Remote Support product. CVE-2026-102769 (CVSS4: 9.3 critical) authentication bypass > remote attacker can perform file operations
> A suspected China-nexus espionage actor exploited a zero-day vulnerability.
https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
https://www.beyondtrust.com/blog/entry/bt26-05
https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/
#beyondtrust #china #zeroday #espionage #CVE #eitw #mandiant #ArmoryCastle #UNC5221

2026-10-15 12:09:23 UTC

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. "Adfection" was used to infect devices at Al Jazeera with Candiru’s spyware. Citizen Lab exposes company Discover-Tech which helps mercenary surveillance vendors track and hack devices around the world.
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
#Adfection #citizenlab #spyware

2026-10-14 23:25:38 UTC

- reply

I forgot to mention that Palo Alto listed these IOC for CVE-2026-0322 exploitation:<li>66.42.72.14</li><li>208.83.239.114</li><li>149.248.47.234</li>
Fanged for your pleasure. No open source information on them Vultr IPs outside of today's disclosure.
#threatintel #paloaltonetworks #zeroday #IOC #KEV

2026-10-14 20:30:41 UTC

Cisco zero-day: CVE-2026-76519 (CVSS3.1: 9.8 critical) Cisco Secure Email Gateway Arbitrary File Write Vulnerability
> In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
#Cisco #zeroday #CVE #KEV #CISA

2026-10-14 20:28:20 UTC

Palo Alto Networks zero-day: CVE-2026-0322 (CVSS4: 8.6 high)PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
> Very limited exploitation has been observed targeting the Palo Alto Networks management interface.
CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
#paloaltonetworks #zeroday #KEV #CISA #eitw

2026-10-13 20:03:51 UTC

- reply

Placeholder CISA blog post about Ivanti Connect Secure zero-day CVE-2026-104935 and Microsoft Windows Shell Security Feature Bypass zero-day CVE-2026-96951
https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
#CISA #KEV #eitw #zeroday #PatchTuesday

2026-10-13 19:04:40 UTC

Microsoft Patch Tuesday with an exploited zero-day: CVE-2026-96951 (8.8 high) Windows Shell Security Feature Bypass Vulnerability
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96951
Looks like 1408 CVEs for Patch Tuesday.
#microsoft #zeroday #CVE #PatchTuesday #eitw

2026-10-13 18:11:15 UTC

Fortinet has around 11 advisories.
Stand outs are <li>CVE-2026-106173 (9.4 critical) path traversal in FortiSIEM leads to RCE </li><li>CVE-2026-107656 (9.6 critical) authentication bypass in FortiSandbox GUI </li>
No exploitation
https://fortiguard.fortinet.com/psirt/FG-IR-26-180
https://fortiguard.fortinet.com/psirt/FG-IR-26-185
#fortinet #CVE #PatchTuesday

2026-10-13 15:32:39 UTC

- reply

CVE-2026-104935 is now live in CISA's KEV Catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2026-104935+&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=20&url=

2026-10-13 14:35:23 UTC

Ivanti Connect Secure zero-day CVE-2026-104935
> We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
#ivanti #ics #zeroday #eitw #cve

2026-10-12 13:28:50 UTC

GitLab security advisory. The standout CVE is a 10.0 critical CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
#gitlab #cve

2026-10-09 14:45:52 UTC

Microsoft dropped seven security advisories for their Cloud vulnerabilities. The worst is Microsoft Partner Center Elevation of Privilege Vulnerability CVE-2026-96207 (10.0 critical). None of them are publicly disclosed or exploited at least.<li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96207" target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96207</a> (10.0 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-94510" target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-94510</a> (9.9 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-77900" target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-77900</a> (9.8 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-88131" target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-88131</a> (9.8 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69435" target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69435</a> (9.6 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83943" target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83943</a> (8.7 high) </li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83947" target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83947</a> (7.7 high) </li>
#microsoft #CVE

2026-10-08 23:55:22 UTC

I thought it was a Sunday because Citrix posted another yet another NetScaler security advisory:
CVE-2026-107406 (9.5 critical) pre-auth memory overflow > RCE or DoS
> As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability.
https://support.citrix.com/external/article/CTX697191
https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
#citrix #netscaler #cve

2026-10-07 16:43:15 UTC

Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 from 10/6
CVE-2025-64393 (9.4 critical) low-privileged RCE
https://www.veeam.com/kb4934
#veeam #cve

2026-10-07 16:17:37 UTC

There are 14 Cisco security advisories that came out today. https://sec.cloudapps.cisco.com/security/center/publicationListing.x
A lot of 9.8 and even 10.0 across multiple products. While there's no mention of exploitation, there's zero-day disclosure pre-patch for Cisco Finesse Server-Side Request Forgery Vulnerability CVE-2026-20362 (7.2)
> The Cisco PSIRT is aware that a public announcement is available for the vulnerability that is described in this advisory.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS
#cisco #CVE

2026-10-06 21:52:49 UTC

- reply

geez I have to assume that this is what AI-enabled fuzzing will turn security advisories into. I noticed a lot of Google, but not Google Big Sleep. I don't know if they're using a different tool to fuzz vulnerabilities or just not crediting AI (or actual humans) for these CVEs.

2026-10-06 19:40:03 UTC

new SonicWall SMA1000 advisory. Check out CVE-2026-102255 (**10.0 critical**) Pre-authentication SSRF via unintended forward-proxy. No mention of exploitation, but it's not a good look that your Secure Mobile Access is not secure (including four known exploited vulnerabilities in the past 90 days)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
#sonicwall #sma1000 #cve

2026-10-05 00:00:26 UTC

- reply

[CISA adds CVE-2026-88779 to the KEV Catalog.](https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog ) The Citrix security advisory itself doesn't mention it, but [their blog post](https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/ ) states the following:
> Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service.
#CISA #KEV #Citrix #NetScaler #CVE #zeroday

2026-10-04 23:53:23 UTC

Our weekly Citrix NetScaler zero-day CVE-2026-88779. See you next Sunday I guess
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779
https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
#citrix #netscaler #zeroday #eitw

2026-10-03 03:17:16 UTC

Google Chrome published an empty blog post as a security advisory on Thursday afternoon. They filled it out in the past day, but don't make it easy to grasp the severity of their bugs.
For example, "Critical CVE-2026-103628: Out of bounds write in WebGL." is actually a CVSSv3.1: **9.6 critical** because it allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. You'd have to chase down those details yourself on cve.org or elsewhere.
https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html
#google #chrome #CVE

2026-10-02 19:53:10 UTC

- reply

this Christmas I'm gifting you Citrix NetScaler.

2026-10-02 18:08:02 UTC

- reply

October 2, 2026: CISA has updated this Alert to provide a SIGMA detection rule resource to help identify potentially suspicious activity.
https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
#CISA #citrix #netscaler #zeroday

2026-10-01 19:54:23 UTC

- reply

Placeholder: https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog
#CISA #KEV #zeroday #fortinet #cve

2026-10-01 19:39:17 UTC

Happy #zeroday FortiMail customers
CVE-2026-104286: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
> This has been reported to be exploited in the wild
https://fortiguard.fortinet.com/psirt/FG-IR-26-175
#fortinet #cve #vulnerability

2026-10-01 16:17:31 UTC

- reply

CNAs can be decertified apparently, and would be announced to the CNA mailing list. Document from August 2026: https://www.cve.org/Resources/General/Policies/Inactive-CNA-Policy.pdf

2026-09-30 22:38:43 UTC

- reply

Unit 42 provides attacker TTPs and malware analysis of Citrix NetScaler zero-day exploitation. IOC are listed.
https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
#threatintel #citrix #netscaler #IOC

2026-09-30 15:53:50 UTC

- reply

CERT-EU shares their insights on CVE-2026-88771 exploitation and provides threat hunting tips in different logs.
https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771
#threatintel #threathunting #citrix #netscaler

2026-09-29 20:40:22 UTC

- reply

We had first POC yes, but what about second POC? watchTowr breaks down CVE-2026-88772 and provides a "detection artifact generator"
https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/
#citrix #netscaler #poc #zeroday #kev

2026-09-29 20:25:25 UTC

Mandiant and Google Threat Intelligence Group describe in-the-wild exploitation CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway appliances globally. Indicators of compromise and YARA rules are included.
https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances?e=48754805
#threatintel #citrix #netscaler #kev #zeroday #ioc

2026-09-28 17:18:37 UTC

- reply

GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.
https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation
#threatintel #citrix #netscaler #zeroday #CVE

2026-09-28 12:52:10 UTC

- reply

> Truesec has observed these potential C2 IPs:
> 104.248.244[.]66
> 139.180.152[.]138
> 77.83.199[.]39
https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway
#threatintel #citrix #netscaler #zeroday #cve

2026-09-28 12:16:27 UTC

- reply

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.
https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
#CISA #KEV #Citrix #zeroday #CVE

2026-09-28 01:16:48 UTC

- reply

CISA working on a Sunday: Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-887712 were added to the Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
https://www.cisa.gov/news-event/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
#KEV #Citrix #NetScaler #zeroday #CVE

2026-09-27 15:56:01 UTC

Citrix NetScaler zero-days
> Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.
This is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @npub1yg8…ccz0
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
#citrix #netscaler #zeroday #cve

2026-09-14 16:31:59 UTC

ayy lmao Cisco CVE-2026-76461
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
> In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
#cve #cisco #zeroday #eitw

2026-09-12 19:02:21 UTC

- reply

> Nuclear triad
> The I stands for Intercontinental?

2026-09-11 21:27:10 UTC

- reply

> CTU researchers assess with high confidence that the 2026 Cyclops Blink activity has a Russian nexus and with moderate confidence that it is associated with the IRON VIKING threat group. The assessment is based primarily on the substantial implementation-level continuity between the analyzed implant and Cyclops Blink, which UK and U.S. government agencies previously attributed to the Russian GRU-linked Sandworm threat group. CTU researchers track that group as IRON VIKING.
https://www.sophos.com/en-us/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities
#threatintel #ironviking #sandworm #GRU #IOC

2026-09-11 20:20:10 UTC

- reply

no mention of exploitation from CNA GitLab
> CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE
> GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
> Impacted Versions: GitLab CE/EE: all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
> CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
> Thanks s3ntago for reporting this vulnerability through our HackerOne bug bounty program.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

2026-09-09 21:01:44 UTC

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operating system. Second, CVE-2026-20316 is a vulnerability that allows a remote attacker to log in using a low-privileged account.
https://blog.talosintelligence.com/fmc-ongoing-exploitation/
#threatintel #ransomware #Qilin #KEV #CVE

2026-09-09 20:37:11 UTC

ConnectWise ScreenConnect #zeroday CVE-2026-84869
Huntress article: https://www.huntress.com/blog/rogue-screenconnect-installations
Canadian Centre for Cyber Security: https://www.cyber.gc.ca/en/alerts-advisories/connectwise-security-advisory-av26-903
> Open-source reporting indicates that CVE-2026-84869 is being exploited in the wild.
ConnectWise is silent on exploitation status: https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
#connectwise #screenconnect #cve

2026-09-09 12:33:54 UTC

Google Chrome #zeroday
> Google is aware that an exploit for CVE-2026-87491 exists in the wild.
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
#Google #Chrome #CVE

2026-09-09 01:37:53 UTC

N-able didn't beat around the bush:
> Since our post 9/5/2026, 08:11:00 UTC a third independent researcher disclosed to N-able a new vulnerability— one that has been exploited in the wild and is unrelated to the previously disclosed CVEs.
> This critical zero-day vulnerability, CVE-2026-86218, could allow pre-authenticated access to the N-central server if exploited.<li><a href="https://www.n-able.com/blog/n-central-security-hotfix-september-5-2026" target="_blank" rel="nofollow noopener" translate="no">https://www.n-able.com/blog/n-central-security-hotfix-september-5-2026</a></li><li><a href="https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/" target="_blank" rel="nofollow noopener" translate="no">https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/</a></li><li><a href="https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog" target="_blank" rel="nofollow noopener" translate="no">https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog</a></li>
#nable #zeroday #KEV #CVE

2026-09-09 01:33:59 UTC

#Cisco only had one for #PatchTuesday? CVE-2026-20293 Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability
> The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.
It appears to be related to Eclypsium research into UEFI shell vulnerabilities from 2025:<li><a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW" target="_blank" rel="nofollow noopener" translate="no">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW</a></li><li><a href="https://kb.cert.org/vuls/id/718077" target="_blank" rel="nofollow noopener" translate="no">https://kb.cert.org/vuls/id/718077</a></li><li><a href="https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/" target="_blank" rel="nofollow noopener" translate="no">https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/</a></li>
#poc #UEFI

2026-09-02 19:39:38 UTC

Hello world!