Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Snyk

What Is Agentic AppSec?

Sep 30, 2026 By Brendan Hann In Snyk
Agentic AppSec (agentic application security) is the practice of using a team of AI security agents to run an organization's entire application security program: understanding the application, modeling its threats, finding the vulnerabilities that matter, deciding what is worth fixing, generating and validating fixes, and proving those fixes hold. It applies continuously to both new code and the existing backlog.
Read Post
seal security

No Fixed Address: Log4Shell-Style JNDI Injection in Apache Axis 1.x

Sep 30, 2026 By Lev Pachmanov In Seal Security
Apache Axis 1.x is a SOAP engine whose last release came out in 2006. Twenty years later deps.dev counts 384 packages that still depend on 1.4, 83 of them directly, and that single version carries five published advisories. The worst of them turns the client-side service factory into a remote code execution primitive (tracked as CVE-2023-40743, NVD CVSS 9.8, critical).
Read Post
astra

Beyond the Scanner: How Verified PoC exploits Prove True Business Risk

Sep 29, 2026 By Keshav Malik In Astra
On September 1, OpenAI announced that its new model, GPT-6 Astra, had become the first to cross the “Critical” cybersecurity threshold in the company’s Preparedness Framework. Most coverage focused on the safety implications, and fairly so, but buried in the announcement sits a benchmark result that should change how every security leader reads their next vulnerability report.
Read Post
nucleus

FBI Winter SHIELD's Cybersecurity Controls Are Worth a Second Look

Sep 29, 2026 By Steve Carter In Nucleus
AI adoption is making everyone faster, including the attackers we as cybersecurity practitioners are competing with. While the attackers are getting faster thanks to AI, it’s not changing why most preventable breaches happen. That part is remaining consistent, for better or worse.
Read Post
detectify

Detectify Cyber Hygiene Index Report reveals that most critical vulnerabilities sit unfixed for months

Sep 29, 2026 By Detectify In Detectify
The Detectify Cyber Hygiene Index Report H2 2026 measures something most reports ignore: not what happened after an attack, but what’s exposed right now, before one occurs. We analyzed anonymized data from a sample of +1290 organizations across the US, UK, and Nordics to understand how effectively they’re finding, monitoring, and closing vulnerabilities across their external attack surfaces.
Read Post
seemplicity

CTEM Validation: How to Confirm What's Really Exploitable

Sep 29, 2026 By Kevin Swan In Seemplicity
CTEM validation is the fourth stage of continuous threat exposure management. It confirms whether a prioritized exposure is actually exploitable in your environment and whether existing defenses would stop an attack. Common methods include penetration testing, breach and attack simulation, attack path analysis, and automated exploitability analysis.
Read Post
Arctic Wolf

Critical Citrix NetScaler ADC and Citrix NetScaler Gateway Vulnerabilities

Sep 29, 2026 By Arctic Wolf Labs In Arctic Wolf
On September 27th 2026, Citrix disclosed multiple vulnerabilities affecting NetScaler ADC and NetScaler Gateway. Arctic Wolf tracking indicates that CVE-2026-88771 and CVE-2026-88772 have been exploited in attacks against NetScaler devices as zero-days. Additional CVEs are also disclosed in the Citrix Security Bulletin. CVE-2026-88771 is an unauthenticated remote code execution vulnerability caused by improper input validation that can allow arbitrary command execution.
Read Post
bitsight

CVE-2026-88771 and CVE-2026-88772: Two Critical Citrix NetScaler Flaws Under Active Exploitation

Sep 28, 2026 By Emma Stevens In BitSight
Citrix disclosed two critical vulnerabilities in NetScaler ADC and NetScaler Gateway that are already being exploited in the wild. CVE-2026-88771 allows unauthenticated attackers to run commands on an affected appliance, while CVE-2026-88772 can lead to remote code execution or denial of service when DTLS is turned on. Both received a CVSS v4.0 score of 9.5, and CISA added them to its Known Exploited Vulnerabilities catalog.
Read Post
Corelight

Hunting Citrix NetScaler Zero-Days with Corelight

Sep 28, 2026 By Ben Reardon In Corelight
Citrix’s security bulletin CTX697096, the NetScaler security blog, and WatchTowr’s vulnerability FAQ describe an urgent situation for organizations using NetScaler ADC and NetScaler Gateway. Two vulnerabilities (CVE-2026-88771 and CVE-2026-88772) are known to be exploited. CISA confirms active exploitation globally and has added both to its Known Exploited Vulnerabilities catalog.
Read Post
sophos

Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation

Sep 28, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On September 27, 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two of these vulnerabilities are critical (CVSS score of 9.5) and can allow an unauthenticated remote attacker to execute code: Citrix has observed exploitation against unmitigated NetScaler deployments, and the U.S.
Read Post
manageengine

Keep your Qualys vulnerability scanner: Fix what it finds with Patch Manager Plus

Sep 25, 2026 By Hari Prasadh Thennarasu In ManageEngine
Most organizations that run a vulnerability scanner have already made a significant investment. They chose Qualys, Tenable, Rapid7, or CrowdStrike based on their detection needs, their compliance requirements, and the way their security team works. That scanner is embedded in their workflows, audit processes, and reporting chain. Then they look at their vulnerability remediation times and realize the problem is not on the scanning side.
Read Post
forward

What CVE-2026-20079 Means for Every Network Team

Sep 24, 2026 By Forward Networks In Forward
On September 9, Cisco confirmed what earlier warning signs had already hinted at: a security flaw in its Secure Firewall Management Center (Secure FMC) software, the tool that configures and controls Cisco firewalls across a network, is being actively exploited. The flaw, tracked as CVE-2026-20079, received a maximum severity score of 10.0 on the CVSS scale, the industry-standard scale used to rate how serious a vulnerability is.
Read Post
nucleus

Automate Vulnerability Reporting for Auditors Without Creating More Work

Sep 24, 2026 By Doug Drew In Nucleus
Anyone who has participated in a cybersecurity audit knows the drill and has likely asked the same question. “Is there a way to automate any of this?” When an auditor requests evidence that vulnerabilities are being identified, prioritized, remediated, and tracked according to policy, the automation question is a fair one.
Read Post
cloudflare

How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

Sep 24, 2026 By Containers In Cloudflare
On September 4, 2026, Oren Yomtov, a security researcher from Accomplish, responsibly reported a vulnerability affecting Cloudflare Containers and Cloudflare Sandboxes (which is built on Containers), through Cloudflare’s bug bounty program. Cloudflare has fully remediated the vulnerability, and we have no evidence that customer data has been compromised.
Read Post
Snyk

Your Vulnerability Backlog Is No Longer Technical Debt, It's an Attack Surface

Sep 24, 2026 By Brendan Hann In Snyk
Every security program has one: a queue of a few thousand findings, or a few hundred thousand, that nobody has worked through and nobody expects to. Most teams file it under technical debt, a cost carried on purpose, paid down when there is room, and tolerable because the interest rate stays low. That accounting held for a long time, because it rested on a single assumption: almost nothing in the queue would ever be reached, or exploited, by anyone.
Read Post

Claude Mythos Explained: AI Finding Zero-Day Vulnerabilities and Chaining Exploits

Sep 23, 2026 By Forescout Technologies In Forescout
Claude Mythos is an AI model capable of finding and chaining zero-day vulnerabilities at scale. That changes how attacks happen, especially in environments where you can’t patch fast enough. The Forescout Vistaro platform with VistaroAI helps organizations respond with real-time visibility and dynamic control across all connected devices.
View Video
reach security

Vulnerability Management: A Complete Guide to the Process and Lifecycle

Sep 23, 2026 By John Dominguez In Reach Security
If your vulnerability management program runs on a fixed scan-and-patch cadence, whether monthly, quarterly, or tied to a compliance deadline, you are measuring your response time against an attacker timeline that continues to accelerate. Vulnerability management remains a foundational security discipline. It identifies real, exploitable flaws and gives teams a structured way to prioritize and remediate them.
Read Post
cycognito

Emerging Threat: (CVE-2026-94545) Next.js Remote Code Execution via ImageResponse SVG Injection

Sep 23, 2026 By Igal Zeifman In CyCognito
CVE-2026-94545 is a remote code execution vulnerability in the next/og ImageResponse API of Next.js, the React framework maintained by Vercel. ImageResponse generates images on the server, typically Open Graph preview cards, by rendering markup through the Satori library into SVG and then into a raster image.
Read Post
seemplicity

Streamline Prioritization in Your CTEM Program with Seemplicity

Sep 22, 2026 By Kevin Swan In Seemplicity
Prioritization in CTEM is the process of determining which exposures should be addressed first based on the risk they pose in your specific environment. Rather than relying on severity scores alone, effective prioritization combines internal business and asset context with external threat intelligence, then focuses teams on the fixes that reduce the most meaningful risk.
Read Post
cycognito

Emerging Threat: (CVE-2026-69197) Umbraco CMS Protected Content Disclosure via Delivery API Expansion

Sep 22, 2026 By Igal Zeifman In CyCognito
CVE-2026-69197 is an authorization flaw in the Content Delivery API of Umbraco CMS, an open source ASP.NET content management system. The Delivery API enforces member and Public Access checks on the node a caller directly requests, but it does not apply those same checks to nodes referenced through Content Picker or Multi-Node Tree Picker properties. The gap extends to pickers nested inside Block List, Block Grid, and Rich Text Editor blocks.
Read Post
Snyk

So I asked my agent instead...

Sep 22, 2026 By Nina Kanti In Snyk
Evo already knows which AI Assets your teams pulled into your repos, which MCP servers and skills are sitting on your developer machines, which of them carry risk, and which policies they break. Getting to any of it created friction: you leave the tool you are working in, filter a UI, export a CSV, and rebuild the chart you built last quarter, every time it’s needed.
Read Post

CVSS Measures Severity. Risk Requires Context.

Sep 19, 2026 By Forescout Technologies In Forescout
CVSS remains a valuable tool for understanding vulnerability severity, but severity and risk are not the same. In this video, we explore why effective risk management requires additional context, including asset reachability, business impact, remediation timelines, and an organization's ability to reduce exposure. CVSS can help start the conversation, but it shouldn't be the only factor driving prioritization decisions.
View Video
manageengine

How to secure Exchange Server beyond the CVE-2026-62911 fix

Sep 18, 2026 By Jeyarani Subburaj In ManageEngine
Remote access has always been a core part of how on-premises Exchange works. Users need OWA to read their email from outside the office. Their devices need Autodiscover to set themselves up automatically. Keeping both reachable means keeping Exchange accessible from the Internet, and that opens up more of the server than most organisations realise. CVE-2026-62911 is the latest example. Microsoft released the fix on August 11, 2026.
Read Post
indusface

CVE-2026-67401: SQL Injection in cPanel's EmailTrack Puts Shared Hosting Environments at Risk

Sep 18, 2026 By Bhargavi Pallati In Indusface
A critical SQL injection vulnerability has been identified in cPanel & WHM’s EmailTrack functionality. The vulnerability was disclosed by cPanel on September 8, 2026, affecting every supported release line. It allows an authenticated cPanel account holder with mail related privileges to ultimately achieve root-level code execution on the underlying host.
Read Post

CVSS Scores Alone Can Mislead Vulnerability Prioritization

Sep 18, 2026 By Forescout Technologies In Forescout
Not every high-severity vulnerability represents the highest risk. Learn why effective prioritization requires more than a CVSS score and how factors such as reachability, exploitability, active exploitation, and asset criticality provide the context needed to focus remediation efforts where they matter most.
View Video
foresiet

CVE-2026-16232: Check Point SmartConsole Zero-Day

Sep 17, 2026 By Foresiet In Foresiet
CVE-2026-16232 is a critical authentication bypass in the Check Point SmartConsole login process. An unauthenticated attacker who can reach the Management Server IP, and who faces no Trusted Clients restriction, can obtain an application login token and sign in with full administrative rights. That access is enough to change security policy and configuration.
Read Post
bitsight

While Defenders Watch the Zero-Day Clock, Attackers Are Looking Elsewhere

Sep 17, 2026 By Emma Stevens In BitSight
When Anthropic introduced Mythos Preview, the story practically wrote itself. Here was a frontier AI model taking work that once required researchers and threat actors a lot of time and compressing it into hours. Mythos demonstrated the ability to find and exploit vulnerabilities across major operating systems and browsers. In controlled testing, it produced a working Firefox code-execution exploit in less than an hour and developed eight in roughly 12 hours.
Read Post
bitsight

CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation

Sep 17, 2026 By Emma Stevens In BitSight
Cisco has disclosed a critical authentication bypass affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Tracked as CVE-2026-76460, the vulnerability allows an unauthenticated, remote attacker to send a crafted request to an affected API endpoint and bypass the web-based management interface. The vulnerability received the highest possible CVSS v3.1 score of 10.0.
Read Post
seemplicity

5 Ways to Address Claude Mythos Cybersecurity Risks

Sep 17, 2026 By Jessica Amado In Seemplicity
To address Claude Mythos cybersecurity risks, security teams need to adapt for a world where AI can accelerate the path from vulnerability discovery to exploitation. That means moving toward continuous exposure management, shortening the time from discovery to verified remediation, prioritizing based on real exploitability rather than severity alone, reassessing older software as new risks emerge, and making AI usage part of the organization’s broader exposure picture.
Read Post

Why Severity Scores Don't Tell the Full Risk Story

Sep 17, 2026 By Forescout Technologies In Forescout
Security teams have long relied on severity scores to prioritize vulnerabilities, but severity alone doesn't reveal which exposures pose the greatest immediate risk. This video explores why factors like asset criticality, reachability, and time-to-danger are becoming essential for effective vulnerability prioritization, helping teams focus on the risks that matter most.
View Video
seemplicity

Close the Discovery Gaps in Your CTEM Program with Seemplicity

Sep 16, 2026 By Kevin Swan In Seemplicity
CTEM Discovery is about more than finding assets. It’s about understanding what exists, what’s actually being scanned, and how data from different tools connects. Seemplicity correlates security, inventory, identity, and ownership data across sources to create a unified view of each asset, expose coverage gaps, and give security teams the context they need to prioritize, validate, and remediate exposures effectively.
Read Post
bitsight

From CVE Disclosure to Internet-Wide Exposure: How Bitsight Uses AI to Accelerate Product Fingerprinting

Sep 16, 2026 By Greg Keshian In BitSight
When a new CVE drops, getting notified is the easy part. The real challenge comes right after. Depending on how your organization is set up, different teams have to scramble to figure out if you're actually using the affected product, which specific versions are exposed, whether it's lurking anywhere in your subsidiaries or vendor ecosystem, and how urgently you need to patch it.
Read Post
cycognito

Emerging Threat: (CVE-2026-70756) Oracle WebLogic Server Takeover via T3 and IIOP

Sep 16, 2026 By Igal Zeifman In CyCognito
CVE-2026-70756 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over the T3 or IIOP protocols can compromise the server and take full control of it. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). Oracle rates it as easily exploitable, with no privileges and no user interaction required. Confidentiality, integrity, and availability impacts are all rated high.
Read Post
WatchGuard

More Vulnerabilities Are Being Found Than Ever Before. That's Good News.

Sep 16, 2026 By Tracy Hillstrom In WatchGuard
If you've glanced at a vulnerability tracker lately, the numbers look alarming. The Forum of Incident Response and Security Teams (FIRST) now projects roughly 66,000 CVEs will be published in 2026; up from a February forecast of 59,427 and closing in on 70,000 by some counts. That would follow a record 2025, which finished at roughly 48,000 disclosed CVEs, itself a sharp climb from about 40,000 the year before. It's tempting to read that curve as a sign that software is getting worse. It isn't.
Read Post
Arctic Wolf

UPDATE: Active Exploitation CVE-2026-32996 of Veeam Agent

Sep 16, 2026 By Arctic Wolf In Arctic Wolf
On September 14, 2026, public technical details and proof-of-concept (PoC) exploit code were released for CVE-2026-32996, increasing the likelihood of exploitation attempts against affected Veeam Agent for Microsoft Windows deployments. CVE-2026-32996 is a local privilege escalation vulnerability in Veeam Agent for Microsoft Windows version 13.0.1.2067 and affects all earlier version 13 builds.
Read Post
When Broken Links Become Security Vulnerabilities

When Broken Links Become Security Vulnerabilities

Sep 16, 2026 By SecuritySenses In SecuritySenses
Imagine a link on your website stops working. You notice the problem, add it to your backlog, and move on. A few months later, the link starts working again. At first glance, that sounds like good news. In reality, it could mean that someone else now controls the destination. Fortunately, this is not what usually happens. In most cases, a broken link is simply a maintenance issue. A page has been moved, deleted, or renamed. Visitors encounter an error, someone eventually fixes the link, and the story ends there.
Read Post
astra

Chaining Vulnerabilities into Attack Vectors with Autonomous Pentesting

Sep 15, 2026 By Keshav Malik In Astra
Your vulnerability report is sorted by severity. The adversary looking at the same environment is sorted by path. That mismatch is the whole problem. Open any scanner output, and you get a tidy hierarchy: criticals at the top, then highs, then a long tail of mediums and lows that most teams will never touch. To the person who wrote the ticket, that tail is noise. To someone who thinks in chains, it’s a roadmap. A page of “lows” is not a page of things you can ignore.
Read Post
nucleus

How AI Changes Exposure Management: From Static Findings to Continuous Risk Decisions

Sep 15, 2026 By Rob Gibson In Nucleus
Every security team knows the feeling. The quarterly vulnerability scan completes. The report lands, with thousands of findings, color-coded by CVSS severity, neatly timestamped. And the moment it’s printed, it’s already out of date. That is the fundamental flaw at the heart of traditional exposure management: it is built around a point in time.
Read Post
cycognito

Emerging Threat: (CVE-2026-76461) Cisco Secure Email Gateway Root RCE via Email Parsing

Sep 15, 2026 By Igal Zeifman In CyCognito
CVE-2026-76461 is a SQL injection vulnerability in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway, caused by insufficient validation of message content before it reaches a database query. An attacker who sends a crafted email message containing SQL statements can have those statements executed by the appliance as it processes the message. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).
Read Post
Arctic Wolf

CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required

Sep 15, 2026 By Arctic Wolf Labs In Arctic Wolf
CVE-2026-76461 is a pre-authentication SQL injection vulnerability in the email parsing logic of Cisco Secure Email Gateway (AsyncOS). This vulnerability enables unauthenticated remote threat actors to execute arbitrary code as root by sending crafted, malicious emails. This grants threat actors full control over the operating system, allowing data exfiltration, email surveillance, persistent access, and potential network pivoting, all without user interaction or credentials.
Read Post
sophos

Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation

Sep 15, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On September 14, 2026, Cisco disclosed a vulnerability in Cisco Secure Email Gateway. CVE-2026-76461 is a critical (CVSS score of 9.8) SQL injection flaw in the email parsing functionality of Cisco AsyncOS Software. Successful exploitation “could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.” Cisco confirmed exploitation of the vulnerability in the wild, and the U.S.
Read Post
acronis

OT vulnerability management for Windows and Linux workstations

Sep 15, 2026 By Subramani Rao, In Acronis
OT vulnerability management for Windows and Linux workstations means discovering, assessing, prioritizing and remediating, or deliberately mitigating, software flaws on the general-purpose computers that run supervisory control, historian and engineering functions inside a plant, without disrupting the physical process those computers support. That definition already implies a second, separate layer: the PLCs, RTUs and field devices that this same approach cannot safely touch.
Read Post
kovrr

Reporting a Vulnerability in Somebody Else's Code

Sep 14, 2026 By Kovrr In Kovrr
A vulnerability in an open-source library inside your product is your vulnerability to report. The duty follows the product to market rather than the code to its author, so integrating somebody else's component transfers the obligation to whoever ships it. ‍ The reporting is the visible half. The harder consequence is that the same regulation requires remediation across the product in its entirety, and the party who wrote the component may have no obligation to help you. ‍
Read Post
Arctic Wolf

CVE-2026-84869: ConnectWise ScreenConnect Client Vulnerability Critical Remote Session File Transfer Exploitation Risk

Sep 14, 2026 By Arctic Wolf Labs In Arctic Wolf
A critical security weakness (CVE-2026-84869) has been identified in the ConnectWise ScreenConnect client (prior to version 26.6.5), where missing authorization controls and improper privilege management allow file transfers and execution through active remote sessions without host confirmation.
Read Post
cycognito

Emerging Threat: (CVE-2026-78006) The Events Calendar Remote Code Execution via PHP Object Injection

Sep 14, 2026 By Igal Zeifman In CyCognito
CVE-2026-78006 is a deserialization of untrusted data vulnerability (CWE-502) in The Events Calendar, a WordPress plugin published by StellarWP, that allows an attacker to achieve remote code execution on the underlying host. The flaw sits in the is_safe_widget_instance function, whose guard against unsafe object data can be bypassed.
Read Post
Snyk

Is prevention essentially a solved problem?

Sep 10, 2026 By Ezra Tanzer In Snyk
Stopping new security issues in agent-generated code from being deployed is, architecturally, a solved problem. Prevention is the act of keeping a new vulnerability in code from reaching production at any point in the development and release process, including but not limited to preventing its introduction in a feature branch.
Read Post
cycognito

Emerging Threat: (CVE-2026-44756) SAP Remote Code Execution via Extended Passport Processing

Sep 10, 2026 By Igal Zeifman In CyCognito
CVE-2026-44756, tracked by SAP under the name OVERPASS, is a memory corruption vulnerability in the SAP kernel code that processes the Extended Passport (EPP), a standard SAP tracing structure used to follow call sequences across distributed system landscapes. The flaw stems from missing boundary validation during deserialization of EPP data, which causes unsafe memory behavior when the kernel processes externally supplied length fields. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).
Read Post
seemplicity

The Post-Mythos Era Is Here. Is Your Exposure Management Program Ready?

Sep 10, 2026 By Megan Horner In Seemplicity
As AI accelerates vulnerability discovery and exploitation, exposure management can’t stop at visibility and prioritization. Gartner’s post-Mythos outlook points toward more preemptive, autonomous security, and Seemplicity’s Response Options puts that into practice by giving teams multiple context-aware ways to reduce risk quickly, safely, and without waiting for the full fix.
Read Post
signmycode

OWASP Top 10 for Large Language Model Applications: Complete Guide to LLM Security Risks

Sep 9, 2026 By SignMyCode In SignMyCode
Companies rush to utilise the potential of large language models; however, every new use case of generative AI introduces attack vectors previously unknown in traditional web security. The present guide provides an overview of the official OWASP GenAI LLM Top 10 2026 list and explains the appearance of each vulnerability in practice along with mitigation recommendations.
Read Post
veracode

CISO Risk Intel Brief: Exploited Control Planes, Not Patch Volume, Define Residual Risk

Sep 9, 2026 By Andrea Mazzarini In Veracode
This executive intelligence briefing covers from the past week (2–9 September 2026) and the past month (approximately 10 August – 9 September 2026). CISOs, start here: do not open a 974-row spreadsheet. That queue is the failure mode. This week’s material risk sits in four places you can name before noon.
Read Post
aikido

Compromised Flutter package on pub.dev contains XCSSET malware

Sep 8, 2026 By Ilyas Makari In Aikido
Today, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case of someone deliberately targeting this package.
Read Post
foresiet

Telegram Zero-Day: Malicious Sticker Crash Explained

Sep 8, 2026 By Foresiet In Foresiet
On 6 September 2026, researchers publicly described a Telegram zero-day crash. A group owner said a chat they own became unreachable: opening it crashed official clients on iOS, Android, Desktop and Web. A second researcher posted a short recording of a script sending one specially prepared sticker into a test chat. The harm is availability, not account takeover. If the sticker stays in chat history, the crash can happen again every time someone opens that conversation.
Read Post
apono

Vulnerability Assessments in an Agentic World: Step-by-Step Guide

Sep 8, 2026 By The Apono Team In Apono
An old package or a misconfigured cloud storage bucket can be identified by a legacy scanner, but it does not account for the unique risk profile of autonomous systems. It cannot confirm that an AI agent with access to your production environment can chain together a CRM read, an email send and a production write using inherited credentials. Your agents are dynamic: they plan, call tools, and act across multiple environments, and some may retain context or long-term memory beyond the original request.
Read Post
WatchGuard

When Vulnerability Databases Are No Longer Enough

Sep 8, 2026 By Manu Santamaría Delgado In WatchGuard
The NIST’s changes in how the National Vulnerability Database (NVD) operates have fundamentally shifted how organizations interpret the vulnerabilities published in this go-to registry. In the past, the NVD provided vulnerability enrichment data, such as CVSS scores, affected products, CWE classifications, and reference links.
Read Post
Arctic Wolf

CVE-2026-86218: Active Exploitation of N-able N-central: Critical Pre-Auth Remote Code Execution (RCE) Vulnerability

Sep 8, 2026 By Arctic Wolf Labs In Arctic Wolf
A maximum-severity (CVSS 10.0) vulnerability CVE-2026-86218 has been discovered in N-able N-central prior to build 2026.3.1.14. This flaw allows unauthenticated attackers to execute arbitrary code on the N-central server before authentication enabling remote takeover of the platform. The vulnerability is classified as static code injection (consistent with CWE-96) in a public-facing application endpoint.
Read Post
foresiet

Magento Zero-Day: Unpatched Adobe Commerce RCE Is Backdooring Online Stores

Sep 8, 2026 By Foresiet In Foresiet
On 4 September 2026, attackers began exploiting an unpatched remote code execution flaw in Magento Open Source and Adobe Commerce. Dutch e-commerce security firm Sansec disclosed the issue on 5 September and named it StyleSmuggler. The company said it published early because stores were being compromised in real time.
Read Post
tanium

Hunt or be Hunted: ShieldBreak Zero-Day

Sep 8, 2026 By HuntIQ Team In Tanium
On August 11, 2026, a security researcher publicly released a proof-of-concept called ShieldBreak, a full bypass of Microsoft’s own July patch (RoguePlanet) for a Windows Defender privilege-escalation flaw, with a reported 100% success rate against Windows 11 25H2 and Windows Server 2025. No vendor fix existed for the bypass. The only real defense was whoever moved first.
Read Post
cycognito

Emerging Threat: (CVE-2026-67281) MikroTik RouterOS Unauthenticated File Read via WebFig

Sep 7, 2026 By Igal Zeifman In CyCognito
CVE-2026-67281 is an unauthenticated file read vulnerability in WebFig, the web-based management interface in MikroTik RouterOS. A newly allocated session on the /jsproxy path retains a stale, uninitialized principal pointer that WebFig then uses for file authorization decisions. The vulnerability carries a CVSS v4.0 base score of 8.7 (High). A CVSS v3.1 base score has not been assigned in the CVE record at the time of writing.
Read Post
Arctic Wolf

CrowdStrike Falcon Sensor Local Privilege Escalation Zero-Day (FalconFlank)

Sep 4, 2026 By Arctic Wolf Labs In Arctic Wolf
On September 3, 2026, a security researcher known as Nightmare Eclipse/Chaotic Eclipse publicly disclosed a zero-day dubbed ‘FalconFlank’ which abuses the Office malicious macro remediation workflow in CrowdStrike Falcon Sensor. The attack leverages a time-of-check to time-of-use (TOCTOU) race condition, allowing an attacker with code execution on a vulnerable system to hijack the Falcon macro remediation routine. This results in DLL side-loading and execution as NT AUTHORITY\SYSTEM.
Read Post
foresiet

Falcon Flank: Public Privilege-Escalation Claim Against CrowdStrike Falcon

Sep 4, 2026 By Foresiet In Foresiet
What security teams need to know about an unverified local elevation-of-privilege proof of concept published against Falcon Sensor, and how to respond without overreacting. On 3 September 2026, an independent researcher publishing as MSNightmare / Chaotic Eclipse / Nightmare Eclipse released a public GitHub repository named FalconFlank. The project is described as a local privilege-escalation proof of concept against CrowdStrike Falcon Sensor on Windows.
Read Post
aikido

Stop breaking SLAs: how to patch vulnerabilities before the fix even ships

Sep 4, 2026 By Shaun Brown In Aikido
You're almost out of time on an SLA on a critical dependency vulnerability, but you have no room in the current sprint for the manual testing needed to make sure you don't break production. Missing the remediation deadline itself is a finding in your next SOC 2 or ISO 27001 report, but the risk of exploitation is also growing with advancing AI models.
Read Post
indusface

CVE-2026-0768: Critical RCE in Langflow AI Agent Builder

Sep 4, 2026 By Bhargavi Pallati In Indusface
A critical remote code execution vulnerability has been identified in Langflow. The vulnerability was first reported to the vendor in mid-2025 and disclosed publicly as a zero-day in January 2026. Exploitation attempts rose sharply in late August 2026, moving from isolated probing to continuous, multi-source scanning within days.
Read Post
seemplicity

Response Options Combats "Patch or Wait" in the Age of Frontier AI

Sep 3, 2026 By Megan Horner In Seemplicity
When a vulnerability is urgent but the full fix isn’t immediately safe to deploy, security teams need another way to reduce risk fast. Seemplicity’s Response Options uses AI to identify and rank multiple ways to neutralize a threat – including patches, configuration changes, compensating controls, and network-level mitigations — based on risk reduction, effort, and operational impact.
Read Post
nucleus

Exploitability Without Exploitation: When Attention Is the Signal

Sep 3, 2026 By Ryan Cribelar In Nucleus
Nucleus Insights flagged 14 vulnerabilities with real-world exploitation activity that looked risky before CISA added them to KEV. The key takeaway: all 14 were later listed in KEV. Acting on those signals would have been the right call every time, just earlier.
Read Post
cloudflare

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Sep 3, 2026 By Artificial Intelligence In Cloudflare
Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? To answer that question, Cloudflare is announcing early access to Vulnerability Discovery and Remediation, now part of Cloudflare Managed Defense. Vulnerability Discovery and Remediation is a new, invitation-only Cloudflare service that helps customers detect and mitigate vulnerabilities in their codebases.
Read Post
seemplicity

Response Options: Multiple Methods to Mitigate Risk

Sep 2, 2026 By Kevin Swan In Seemplicity
Seemplicity’s new Response Options feature gives teams multiple ways to respond to a confirmed finding, not just a single full-fix recommendation. AI Analysts surface and rank fix, neutralization, and mitigation paths based on security impact, deployment risk, and effort, helping teams reduce exposure faster while making safer, more informed remediation decisions. Every exposure management program eventually hits the same wall.
Read Post
astra

CVE-2026-49481: Vulnerability in UpSnap

Sep 2, 2026 By Ephrim Holyson In Astra
On 26/05/2026, a security researcher at Astra Security found a critical Remote Code Execution (RCE) vulnerability in UpSnap, a web-based wake-on-LAN(WoL). The root cause is an OS Command Injection vulnerability(CWE-78) that exists in UpSnap’s device management functionality due to unsafe template interpolation of the IP and MAC fields.
Read Post
cycognito

Emerging Threat: (CVE-2026-81891) elFinder Remote Code Execution via ZIP Extraction MIME Bypass

Sep 2, 2026 By Igal Zeifman In CyCognito
CVE-2026-81891 is an unrestricted file upload vulnerability in Studio 42 elFinder, an open source web file manager embedded in a wide range of PHP applications and content management systems. The flaw sits in the checkExtractItems() function in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize().
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.