“CISA”

Critical CVE-2026-21589 in Atlassian Data Center products is being targeted within hours of PoC publication.

FBI and Secret Service warn FortiBleed remains active, harvesting Fortinet credentials and locking out admins; urgent mitigations required.

Roundup: Pentagon data breach, ShinyHunters arrests, Citrix NetScaler mass hacks, passport exposures, and more high-impact security incidents.

Warlock (Longlegs/Storm-2603) exploits SharePoint vulnerabilities to deploy ransomware against water and telecom operators.

Microsoft SharePoint CVE-2026-65660 is being exploited in active attacks; CISA added it to the KEV catalog.

Two critical NetScaler RCE zero-days are being exploited; Citrix released emergency patches and CISA issued alerts.

cPanel CalDAV/CardDAV flaw allows any hosting account to execute code as root and fully compromise servers.

CISA warns ransomware actors are exploiting a critical JetBrains TeamCity vulnerability patched in July to gain footholds.

Active exploitation of a critical F5 BIG-IP OAuth/APM zero-day enables unauthenticated remote code execution; immediate patching required.

CISA orders federal agencies to patch an actively exploited Zyxel GS1900 switch vulnerability used for data theft.

CVE-2026-76460 authentication bypass in Cisco ISE scored 10/10 CVSS, exposing API endpoints to unauthenticated access.

CISA added multiple Linux kernel CVEs (including CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV for immediate remediation.

ISC patched 14 BIND 9 vulnerabilities, including unauthenticated DoH crash and cache-poisoning risks affecting DNS servers.

Critical unauthenticated vulnerability in Check Point Security Management and Log Servers allows remote root code execution.

Threat actors exploit a maximum-severity GitLab path traversal (CVE-2026-85706) to risk supply-chain and repo compromises.

CISA warns ransomware gangs are exploiting a critical VMware vCenter RCE to spread ransomware; patch vCenter immediately.

Critical GitLab path traversal (CVE-2026-85706) is under active exploitation, enabling arbitrary file reads on self-hosted servers.

Malware tied to F5 BIG-IP APM intrusions injects PHP web shell into memory to evade disk-based detection and persistence.

Cisco and CISA warn CVE-2026-20079 in Secure FMC is exploited in the wild to gain elevated access and persist.