Nostr notes by ssvc

For the last weekday of Cybersecurity Awareness Month, CISA added ...

2026-10-30T17:45:57Z

In reply to nevent1q…489s
_________________________

For the last weekday of Cybersecurity Awareness Month, CISA added more CVEs to the KEV Catalog on a Friday :)<li>CVE-2026-111357 (8.8 high) Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability</li><li>CVE-2026-118527 (4.3 medium) Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability</li>

https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #KEV #Ivanti #zeroday

Ivanti oh no bb what is u doin? > At the time of discovery of ...

2026-10-30T15:26:25Z

In reply to nevent1q…8666
_________________________

Ivanti oh no bb what is u doin?

> At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible. Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.

New Ivanti zero-days: CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable filenames)

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

#ivanti #cve #zeroday #eitw

CVE-2026-118539 Missing Authorization vulnerability in Drupal ...

2026-10-30T12:19:06Z

CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

> This vulnerability is being actively exploited in the wild.

https://www.drupal.org/sa-contrib-2026-254

#drupal #CVE #eitw

Notices new Ivanti CVE owo what's this? > Ivanti Connect ...

2026-10-29T15:24:05Z

In reply to nevent1q…5943
_________________________

*Notices new Ivanti CVE* owo what's this?

> Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

https://nvd.nist.gov/vuln/detail/cve-2026-111357

#ivanti #zeroday #cve #eitw

Nostr event nevent1qqst5dfpu0qngflx8tuvfy76ahdrec6cc2ka5wzmv0n343dtr7tl8rgzyp4sve35xepqzzhyzn0te76arxveqgqpm0uqlkx6mq0s73kprm9gwjyr75z

2026-10-29T15:08:01Z

placeholder: https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-three-known-exploited-vulnerabilities-catalog

#CISA #KEV

On October 20 and 21, an attacker tried to exploit CVE-2026-97229 ...

2026-10-29T13:31:49Z

On October 20 and 21, an attacker tried to exploit CVE-2026-97229 against Alpine Linux's GitLab instance.

> We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#GitLab #CVE #eitw

Cisco zero-day: CVE-2026-76418 (8.6 high) Cisco Secure Firewall ...

2026-10-28T20:19:08Z

Cisco zero-day: CVE-2026-76418 (8.6 high)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

> In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

#cisco #zeroday #eitw #CVE

they solved the problem by putting a 0 at the end of their URL: ...

2026-10-23T20:19:16Z

In reply to nevent1q…n2kp
_________________________

they solved the problem by putting a 0 at the end of their URL: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0

https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0

CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE ...

2026-10-23T20:06:54Z

CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE Server OS Command Injection Vulnerability was just added to the CISA KEV Catalog. TGIF

#CISA #KEV #CollaboraOnline

So when CISA adds another CVE to the KEV Catalog later in the ...

2026-10-23T18:49:58Z

In reply to nevent1q…guxg
_________________________

So when CISA adds another CVE to the KEV Catalog later in the day, how should they handle it? 👀 They already published a "CISA adds one known exploited vulnerability to the Catalog" today, should they create a redirect to the new blog post?

Placeholder for CISA blog post: ...

2026-10-23T17:55:55Z

In reply to nevent1q…whch
_________________________

Placeholder for CISA blog post: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog

#CISA #KEV #Arista

Cybersecurity Awareness Month isn't over yet: Arista ...

2026-10-22T16:29:02Z

Cybersecurity Awareness Month isn't over yet: Arista VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625 (CVSSv3.1: 9.9 critical , CVSS4: 9.4)

> This issue was detected by Arista and is known to be actively exploited.

https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

#arista #zeroday #CVE #eitw

lol. lmao even. ...

2026-10-22T13:56:40Z

lol. lmao even.

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

#Linux #ZDI #CVE

he who smelt it, dealt it 😤

2026-10-22T13:09:47Z

In reply to nevent1q…hu0c
_________________________

he who smelt it, dealt it 😤

Canonical is the CNA for Ubuntu. This is a CNA issue and we ...

2026-10-22T13:05:59Z

In reply to nevent1q…dqjy
_________________________

Canonical is the CNA for Ubuntu. This is a CNA issue and we shouldn't push for the CNA of last resort unless they don't respond.

> We are now seeing php2shell exploited in the wild at scale. ...

2026-10-21T16:57:33Z

In reply to nevent1q…2cxm
_________________________

> We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

watchTowr is observing active exploitation attempts of both ...

2026-10-21T16:22:26Z

In reply to nevent1q…rsqd
_________________________

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

CISA strongly urges organizations to immediately patch the ...

2026-10-21T15:49:13Z

In reply to nevent1q…4570
_________________________

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

# PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical ...

2026-10-21T13:57:33Z

In reply to nevent1q…7d9d
_________________________

#

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.https://www.php.net/archive/2026.php#2026-10-21-5

#php #CVE

Notices 353 security fixes in Chrome OwO what's this? ...

2026-10-21T01:37:35Z

Notices **353** security fixes in Chrome
OwO what's this?

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

No zero-days at least, but this amount of CVEs in one patch appears to be the new normal.

#Google #Chrome #CVE

Get ready for PHP security updates tomorrow to address ...

2026-10-20T20:46:46Z

Get ready for PHP security updates tomorrow to address CVE-2026-109618 and CVE-2026-109619 (the leaked RCE CVEs with CVSSv4 9.2 scores)

https://www.php.net/archive/2026.php#2026-10-20-1
https://cert.europa.eu/publications/security-advisories/2026-018/

#PHP #CVE

Symantec: APT28 (GRU Unit 26165) Targets Defense Firms in Two ...

2026-10-20T10:40:00Z

Symantec: APT28 (GRU Unit 26165) Targets Defense Firms in Two NATO Countries

https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets

#threatintel #Russia #cyberespionage #IOC

"Threat actor? In my Siemens? It's more likely than you ...

2026-10-19T20:50:21Z

In reply to nevent1q…kn5c
_________________________

"Threat actor? In my Siemens? It's more likely than you think"

> Siemens has reported that CVE-2026-110936 is being exploited in the wild.

https://www.cyber.gc.ca/en/alerts-advisories/siemens-security-advisory-av26-1063

#CVE #Siemens #eitw

Active Exploitation of CVE-2026-110936 in Siemens Software Center ...

2026-10-19T18:21:12Z

Active Exploitation of CVE-2026-110936 in Siemens Software Center

> Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.

https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/

#eitw #cve #siemens

For the DoS haters who don't want to patch their Citrix ...

2026-10-19T16:17:13Z

In reply to nevent1q…sr97
_________________________

For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:

https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/

#citrix #netscaler #threatintel #IOC #pitscaler

Plex2Shell chain exploited in the wild for cryptomining against ...

2026-10-19T13:22:57Z

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96652"; target="_blank" rel="nofollow noopener">CVE-2026-96652</a> (5.3 med) Plex Media Server SSRF</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96654"; target="_blank" rel="nofollow noopener">CVE-2026-96654</a> (6.9 med) Plex Media Server URL injection</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96655"; target="_blank" rel="nofollow noopener">CVE-2026-96655</a> (5.3 med) Plex Media Server arbitrary-host SSRF</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-96656"; target="_blank" rel="nofollow noopener">CVE-2026-96656</a> (8.6 high) Plex Media Server arbitrary file write</li>

#threatintel #plex #IOC #eitw

SiteGuard exploited zero-day: CVE-2026-106931 (CVSS4: 8.5 high) ...

2026-10-19T12:56:01Z

SiteGuard exploited zero-day: CVE-2026-106931 (CVSS4: 8.5 high) SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

English translation:

> A vulnerability (CVE-2026-106931) allowing OS command injection has been discovered in the statistics function of SiteGuard Server Edition. Exploitation has already been confirmed.

https://www.eg-secure.co.jp/siteguard/news/alert-202610-1

#siteguard #eitw #CVE #zeroday

Placeholder link ...

2026-10-16T17:34:28Z

In reply to nevent1q…pv69
_________________________

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog<li>CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability</li><li>CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability</li>

#CISA #KEV #Beyondtrust #fortinet

This one slipped through the cracks this past Patch Tuesday ...

2026-10-16T14:02:01Z

This one slipped through the cracks this past Patch Tuesday because the CVE started with 2025: CVE-2025-61624 (5.4 medium) path traversal > aribtrary write/delete
https://fortiguard.fortinet.com/psirt/FG-IR-26-122

Unit 42's blog post states it was exploited in the wild: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

> The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

#threatintel #eitw #CVE #fortinet #ioc

https://euvd.enisa.europa.eu/search?exploited=true

2026-10-16T13:10:19Z

In reply to nevent1q…zmls
_________________________

https://euvd.enisa.europa.eu/search?exploited=true

BeyondTrust doing their darnedest not to explicitly say that ...

2026-10-16T01:31:01Z

BeyondTrust doing their darnedest not to explicitly say that there's an exploited zero-day vulnerability in their Remote Support product. CVE-2026-102769 (CVSS4: 9.3 critical) authentication bypass > remote attacker can perform file operations

> A suspected China-nexus espionage actor exploited a zero-day vulnerability.

https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
https://www.beyondtrust.com/blog/entry/bt26-05
https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/

#beyondtrust #china #zeroday #espionage #CVE #eitw #mandiant #ArmoryCastle #UNC5221

This is the first-ever public confirmation of zero-click ...

2026-10-15T12:09:23Z

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. "Adfection" was used to infect devices at Al Jazeera with Candiru’s spyware. Citizen Lab exposes company Discover-Tech which helps mercenary surveillance vendors track and hack devices around the world.

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

#Adfection #citizenlab #spyware

I forgot to mention that Palo Alto listed these IOC for ...

2026-10-14T23:25:38Z

In reply to nevent1q…6cdy
_________________________

I forgot to mention that Palo Alto listed these IOC for CVE-2026-0322 exploitation:<li>66.42.72.14</li><li>208.83.239.114</li><li>149.248.47.234</li>

Fanged for your pleasure. No open source information on them Vultr IPs outside of today's disclosure.

#threatintel #paloaltonetworks #zeroday #IOC #KEV

Cisco zero-day: CVE-2026-76519 (CVSS3.1: 9.8 critical) Cisco ...

2026-10-14T20:30:41Z

Cisco zero-day: CVE-2026-76519 (CVSS3.1: 9.8 critical) Cisco Secure Email Gateway Arbitrary File Write Vulnerability

> In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog

#Cisco #zeroday #CVE #KEV #CISA

Palo Alto Networks zero-day: CVE-2026-0322 (CVSS4: 8.6 ...

2026-10-14T20:28:20Z

Palo Alto Networks zero-day: CVE-2026-0322 (CVSS4: 8.6 high)PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

> Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog

#paloaltonetworks #zeroday #KEV #CISA #eitw

Placeholder CISA blog post about Ivanti Connect Secure zero-day ...

2026-10-13T20:03:51Z

In reply to nevent1q…vjsy
_________________________

Placeholder CISA blog post about Ivanti Connect Secure zero-day CVE-2026-104935 and Microsoft Windows Shell Security Feature Bypass zero-day CVE-2026-96951

https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #KEV #eitw #zeroday #PatchTuesday

Microsoft Patch Tuesday with an exploited zero-day: ...

2026-10-13T19:04:40Z

Microsoft Patch Tuesday with an exploited zero-day: CVE-2026-96951 (8.8 high) Windows Shell Security Feature Bypass Vulnerability
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96951

Looks like 1408 CVEs for Patch Tuesday.

#microsoft #zeroday #CVE #PatchTuesday #eitw

Fortinet has around 11 advisories. Stand outs are ...

2026-10-13T18:11:15Z

Fortinet has around 11 advisories.
Stand outs are <li>CVE-2026-106173 (9.4 critical) path traversal in FortiSIEM leads to RCE </li><li>CVE-2026-107656 (9.6 critical) authentication bypass in FortiSandbox GUI </li>

No exploitation

https://fortiguard.fortinet.com/psirt/FG-IR-26-180
https://fortiguard.fortinet.com/psirt/FG-IR-26-185

#fortinet #CVE #PatchTuesday

CVE-2026-104935 is now live in CISA's KEV Catalog. ...

2026-10-13T15:32:39Z

In reply to nevent1q…hlds
_________________________

CVE-2026-104935 is now live in CISA's KEV Catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2026-104935+&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=20&url=

Ivanti Connect Secure zero-day CVE-2026-104935 > We are aware ...

2026-10-13T14:35:23Z

Ivanti Connect Secure zero-day CVE-2026-104935

> We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

#ivanti #ics #zeroday #eitw #cve

GitLab security advisory. The standout CVE is a 10.0 critical ...

2026-10-12T13:28:50Z

GitLab security advisory. The standout CVE is a 10.0 critical CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

#gitlab #cve

Microsoft dropped seven security advisories for their Cloud ...

2026-10-09T14:45:52Z

Microsoft dropped seven security advisories for their Cloud vulnerabilities. The worst is Microsoft Partner Center Elevation of Privilege Vulnerability CVE-2026-96207 (10.0 critical). None of them are publicly disclosed or exploited at least.<li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96207"; target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96207</a> (10.0 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-94510"; target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-94510</a> (9.9 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-77900"; target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-77900</a> (9.8 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-88131"; target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-88131</a> (9.8 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69435"; target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69435</a> (9.6 critical)</li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83943"; target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83943</a> (8.7 high) </li><li><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83947"; target="_blank" rel="nofollow noopener" translate="no">https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-83947</a> (7.7 high) </li>

#microsoft #CVE

I thought it was a Sunday because Citrix posted another yet ...

2026-10-08T23:55:22Z

I thought it was a Sunday because Citrix posted another yet another NetScaler security advisory:

CVE-2026-107406 (9.5 critical) pre-auth memory overflow > RCE or DoS

> As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability.

https://support.citrix.com/external/article/CTX697191
https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/

#citrix #netscaler #cve

Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 ...

2026-10-07T16:43:15Z

Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 from 10/6

CVE-2025-64393 (9.4 critical) low-privileged RCE

https://www.veeam.com/kb4934

#veeam #cve

There are 14 Cisco security advisories that came out today. ...

2026-10-07T16:17:37Z

There are 14 Cisco security advisories that came out today. https://sec.cloudapps.cisco.com/security/center/publicationListing.x

A lot of 9.8 and even 10.0 across multiple products. While there's no mention of exploitation, there's zero-day disclosure pre-patch for Cisco Finesse Server-Side Request Forgery Vulnerability CVE-2026-20362 (7.2)

> The Cisco PSIRT is aware that a public announcement is available for the vulnerability that is described in this advisory.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS

#cisco #CVE

geez I have to assume that this is what AI-enabled fuzzing will ...

2026-10-06T21:52:49Z

In reply to nevent1q…un5u
_________________________

geez I have to assume that this is what AI-enabled fuzzing will turn security advisories into. I noticed a lot of Google, but not Google Big Sleep. I don't know if they're using a different tool to fuzz vulnerabilities or just not crediting AI (or actual humans) for these CVEs.

new SonicWall SMA1000 advisory. Check out CVE-2026-102255 (**10.0 ...

2026-10-06T19:40:03Z

new SonicWall SMA1000 advisory. Check out CVE-2026-102255 (**10.0 critical**) Pre-authentication SSRF via unintended forward-proxy. No mention of exploitation, but it's not a good look that your Secure Mobile Access is not secure (including four known exploited vulnerabilities in the past 90 days)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

#sonicwall #sma1000 #cve

[CISA adds CVE-2026-88779 to the KEV ...

2026-10-05T00:00:26Z

In reply to nevent1q…m864
_________________________

[CISA adds CVE-2026-88779 to the KEV Catalog.](https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog ) The Citrix security advisory itself doesn't mention it, but [their blog post](https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/ ) states the following:

> Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service.

#CISA #KEV #Citrix #NetScaler #CVE #zeroday

Our weekly Citrix NetScaler zero-day CVE-2026-88779. See you next ...

2026-10-04T23:53:23Z

Our weekly Citrix NetScaler zero-day CVE-2026-88779. See you next Sunday I guess

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779

https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/

#citrix #netscaler #zeroday #eitw

Google Chrome published an empty blog post as a security advisory ...

2026-10-03T03:17:16Z

Google Chrome published an empty blog post as a security advisory on Thursday afternoon. They filled it out in the past day, but don't make it easy to grasp the severity of their bugs.

For example, "Critical CVE-2026-103628: Out of bounds write in WebGL." is actually a CVSSv3.1: **9.6 critical** because it allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. You'd have to chase down those details yourself on cve.org or elsewhere.

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html

#google #chrome #CVE

this Christmas I'm gifting you Citrix NetScaler.

2026-10-02T19:53:10Z

In reply to nevent1q…sq9w
_________________________

this Christmas I'm gifting you Citrix NetScaler.

October 2, 2026: CISA has updated this Alert to provide a SIGMA ...

2026-10-02T18:08:02Z

In reply to nevent1q…7fna
_________________________

October 2, 2026: CISA has updated this Alert to provide a SIGMA detection rule resource to help identify potentially suspicious activity.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #citrix #netscaler #zeroday

Nostr event nevent1qqsxrefvs4qzazsz9javpjef9mu2d8pp4j522y52dfg5728ggamfpqqzyp4sve35xepqzzhyzn0te76arxveqgqpm0uqlkx6mq0s73kprm9gwhpwam2

2026-10-01T19:54:23Z

In reply to nevent1q…mm4w
_________________________

Placeholder: https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog

#CISA #KEV #zeroday #fortinet #cve

Happy #zeroday FortiMail customers CVE-2026-104286: An improper ...

2026-10-01T19:39:17Z

Happy #zeroday FortiMail customers

CVE-2026-104286: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

> This has been reported to be exploited in the wild

https://fortiguard.fortinet.com/psirt/FG-IR-26-175

#fortinet #cve #vulnerability

CNAs can be decertified apparently, and would be announced to the ...

2026-10-01T16:17:31Z

In reply to nevent1q…3aqs
_________________________

CNAs can be decertified apparently, and would be announced to the CNA mailing list. Document from August 2026: https://www.cve.org/Resources/General/Policies/Inactive-CNA-Policy.pdf

Unit 42 provides attacker TTPs and malware analysis of Citrix ...

2026-09-30T22:38:43Z

In reply to nevent1q…3m8m
_________________________

Unit 42 provides attacker TTPs and malware analysis of Citrix NetScaler zero-day exploitation. IOC are listed.

https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/

#threatintel #citrix #netscaler #IOC

CERT-EU shares their insights on CVE-2026-88771 exploitation and ...

2026-09-30T15:53:50Z

In reply to nevent1q…vdx3
_________________________

CERT-EU shares their insights on CVE-2026-88771 exploitation and provides threat hunting tips in different logs.

https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771

#threatintel #threathunting #citrix #netscaler

We had first POC yes, but what about second POC? watchTowr breaks ...

2026-09-29T20:40:22Z

In reply to nevent1q…3l78
_________________________

We had first POC yes, but what about second POC? watchTowr breaks down CVE-2026-88772 and provides a "detection artifact generator"

https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/

#citrix #netscaler #poc #zeroday #kev

Mandiant and Google Threat Intelligence Group describe ...

2026-09-29T20:25:25Z

Mandiant and Google Threat Intelligence Group describe in-the-wild exploitation CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway appliances globally. Indicators of compromise and YARA rules are included.

https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances?e=48754805

#threatintel #citrix #netscaler #kev #zeroday #ioc

GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, ...

2026-09-28T17:18:37Z

In reply to nevent1q…aj22
_________________________

GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.

https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

#threatintel #citrix #netscaler #zeroday #CVE

> Truesec has observed these potential C2 IPs: > ...

2026-09-28T12:52:10Z

In reply to nevent1q…pqst
_________________________

> Truesec has observed these potential C2 IPs:
> 104.248.244[.]66
> 139.180.152[.]138
> 77.83.199[.]39

https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway

#threatintel #citrix #netscaler #zeroday #cve

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known ...

2026-09-28T12:16:27Z

In reply to nevent1q…dy5l
_________________________

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #KEV #Citrix #zeroday #CVE

CISA working on a Sunday: Citrix NetScaler zero-days ...

2026-09-28T01:16:48Z

In reply to nevent1q…hwsz
_________________________

CISA working on a Sunday: Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-887712 were added to the Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

https://www.cisa.gov/news-event/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

#KEV #Citrix #NetScaler #zeroday #CVE

Citrix NetScaler zero-days > Exploits of CVE-2026-88771 and ...

2026-09-27T15:56:01Z

Citrix NetScaler zero-days

> Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.

This is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t Taggart :ifin: (npub1yg8…ccz0)

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

#citrix #netscaler #zeroday #cve

ayy lmao Cisco CVE-2026-76461 A vulnerability in the email ...

2026-09-14T16:31:59Z

ayy lmao Cisco CVE-2026-76461
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

> In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

#cve #cisco #zeroday #eitw

> Nuclear triad > The I stands for Intercontinental?

2026-09-12T19:02:21Z

In reply to nevent1q…zuc7
_________________________

> Nuclear triad
> The I stands for Intercontinental?

> CTU researchers assess with high confidence that the 2026 ...

2026-09-11T21:27:10Z

In reply to nevent1q…dh5p
_________________________

> CTU researchers assess with high confidence that the 2026 Cyclops Blink activity has a Russian nexus and with moderate confidence that it is associated with the IRON VIKING threat group. The assessment is based primarily on the substantial implementation-level continuity between the analyzed implant and Cyclops Blink, which UK and U.S. government agencies previously attributed to the Russian GRU-linked Sandworm threat group. CTU researchers track that group as IRON VIKING.

https://www.sophos.com/en-us/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities

#threatintel #ironviking #sandworm #GRU #IOC

no mention of exploitation from CNA GitLab > CVE-2026-85706 - ...

2026-09-11T20:20:10Z

In reply to nevent1q…8329
_________________________

no mention of exploitation from CNA GitLab

> CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE

> GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

> Impacted Versions: GitLab CE/EE: all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
> CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

> Thanks s3ntago for reporting this vulnerability through our HackerOne bug bounty program.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

Cisco Talos is actively tracking the exploitation of two ...

2026-09-09T21:01:44Z

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operating system. Second, CVE-2026-20316 is a vulnerability that allows a remote attacker to log in using a low-privileged account.

https://blog.talosintelligence.com/fmc-ongoing-exploitation/

#threatintel #ransomware #Qilin #KEV #CVE

ConnectWise ScreenConnect #zeroday CVE-2026-84869 Huntress ...

2026-09-09T20:37:11Z

ConnectWise ScreenConnect #zeroday CVE-2026-84869

Huntress article: https://www.huntress.com/blog/rogue-screenconnect-installations

Canadian Centre for Cyber Security: https://www.cyber.gc.ca/en/alerts-advisories/connectwise-security-advisory-av26-903

> Open-source reporting indicates that CVE-2026-84869 is being exploited in the wild.

ConnectWise is silent on exploitation status: https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin

#connectwise #screenconnect #cve

Google Chrome #zeroday > Google is aware that an exploit for ...

2026-09-09T12:33:54Z

Google Chrome #zeroday

> Google is aware that an exploit for CVE-2026-87491 exists in the wild.

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

#Google #Chrome #CVE

N-able didn't beat around the bush: > Since our post ...

2026-09-09T01:37:53Z

N-able didn't beat around the bush:

> Since our post 9/5/2026, 08:11:00 UTC a third independent researcher disclosed to N-able a new vulnerability— one that has been exploited in the wild and is unrelated to the previously disclosed CVEs.

> This critical zero-day vulnerability, CVE-2026-86218, could allow pre-authenticated access to the N-central server if exploited.<li><a href="https://www.n-able.com/blog/n-central-security-hotfix-september-5-2026"; target="_blank" rel="nofollow noopener" translate="no">https://www.n-able.com/blog/n-central-security-hotfix-september-5-2026</a></li><li><a href="https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/"; target="_blank" rel="nofollow noopener" translate="no">https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/</a></li><li><a href="https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog"; target="_blank" rel="nofollow noopener" translate="no">https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog</a></li>

#nable #zeroday #KEV #CVE

#Cisco only had one for #PatchTuesday? CVE-2026-20293 Cisco UCS ...

2026-09-09T01:33:59Z

#Cisco only had one for #PatchTuesday? CVE-2026-20293 Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

> The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.

It appears to be related to Eclypsium research into UEFI shell vulnerabilities from 2025:<li><a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW"; target="_blank" rel="nofollow noopener" translate="no">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW</a></li><li><a href="https://kb.cert.org/vuls/id/718077"; target="_blank" rel="nofollow noopener" translate="no">https://kb.cert.org/vuls/id/718077</a></li><li><a href="https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/"; target="_blank" rel="nofollow noopener" translate="no">https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/</a></li>

#poc #UEFI

Nostr event nevent1qqst4gqu0pckdk3cq0u3acpc4qg03k0vkyze9aej5042mpcjat2htdqzyp4sve35xepqzzhyzn0te76arxveqgqpm0uqlkx6mq0s73kprm9gwumg6l9

2026-09-02T19:39:38Z

Hello world!