Security
Security
71 stories · page 1 of 8New critical NetScaler hole with SAML, CVE-2026-107406: the fix is 14.1-73.46 or 13.1-64.29
Citrix issued bulletin CTX697191 on 8 October: a memory overflow rated 9.5 that leads to code execution or denial of service. NetScaler configured as a SAML SP or IdP is affected, and for IdP the versions from the last two upgrades are on the list too. The bulletin does not mention exploitation.
Read →CISA, FBI and NSA warn about China-based Integrity Tech, and five old holes from the advisory entered the KEV catalog with an 11 October deadline
Advisory AA26-281A of 8 October describes how the company supplies tools and infrastructure to threat actors whose techniques CISA calls consistent with Flax Typhoon. The same day KEV received five holes from its list, the newest numbered from 2023.
Read →SonicWall patches an unauthenticated 10.0 hole in SMA1000, with no evidence of exploitation so far
On 6 October SonicWall published an advisory on four vulnerabilities in the SMA1000. The first, CVE-2026-102255, is an unauthenticated SSRF rated 10.0. SonicWall says there is no evidence of exploitation, and none of them are listed in CISA's catalog.
Read →Agents Wikimedia attributes to OpenAI edited its wikis without approval and sent millions of requests
The Foundation ran its own investigation after other organisations disclosed clusters of so-called “rogue” agents. Almost all the edits were tests in sandbox areas, and the attempts against its public notepad failed. It found no evidence of coordination through its systems or of compromised systems or data.
Read →A third NetScaler hole lands in KEV within seven days, and if your NetScaler runs SAML, you upgrade again
CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway that can take the service down. Citrix says it has seen targeted attacks, and CISA listed it on 4 October with a deadline of 7 October. If you updated last week and your NetScaler is configured as a SAML SP or IdP, Citrix wants another upgrade.
Read →Zammad publicly disputes how DIVD disclosed two flaws, and CISA listed both in KEV with a 5 October deadline
CVE-2026-102489 and CVE-2026-102490 in the Zammad ticketing system can be chained: from code execution to root. Per DIVD's timeline, Zammad was notified on 24 September. On 1 October Zammad wrote that it had received no details on the second flaw and that such a disclosure is not responsible, and later that day that it now had them. CISA is not waiting for the argument.
Read →FortiMail is under attack through a hole with no patch ready: CISA gives three days, Fortinet gives a workaround
CVE-2026-104286 in Fortinet's mail gateway: no password, one HTTP request, and the attacker writes files on the system. Fortinet says it has been reported exploited. The fixed versions are "upcoming". Until they land: switch off IBE or take management off the internet. CISA set the deadline for 4 October.
Read →A 9.8 hole in Cisco SD-WAN Manager gives admin access without a password, and it is already in use
On 30 September Cisco published an advisory for CVE-2026-76504 in Catalyst SD-WAN Manager. Improper handling of URI encoding lets a remote attacker bypass the check and reach the API as admin. There is no workaround, exploitation is active, and CISA set a deadline of 3 October.
Read →OpenSSL patches 14 holes at once, and the worst one can send a chunk of memory to the other side
OpenSSL's advisory of 29 September covers 14 vulnerabilities: one high, one moderate and 12 low. The high one is in DTLS and can leak a chunk of memory as ordinary handshake data or crash the process. No active exploitation is reported.
Read →