Surge in Exploitation Attempts on Hikvision Cameras Triggers Security Concerns
PremiumIncreased scanning and RCE attempts targeted unpatched Hikvision CVE-2021-36260 surveillance devices, especially in Ukraine.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesFriday, October 9
Sungrow Inverter Flaw Exposed Solar Plants to Unauthorized Access
PremiumCritical Sungrow inverter flaw allowed access to iSolarCloud without valid passwords, risking control of solar plants and battery systems.
Atlassian Data Center Vulnerability Under Exploitation
PremiumCritical CVE-2026-21589 in Atlassian Data Center products is being targeted within hours of PoC publication.
Wednesday, October 7
Inside the Vulnerabilities of Public MCP Servers: A Wake-Up Call for Security
OX Security found critical MCP protocol vulnerabilities in thousands of public servers exposing AI agent infrastructure risk.
Critical Vulnerabilities in WordPress Plugins Lead to Security Breaches
Stored XSS in Ninja Forms and WPC Product Bundles exploited to install backdoors and create rogue WordPress admin accounts.
Cling Botnet Exploits Realtek SDK Flaw Using STUN Protocol
Exploit attempts against Realtek Jungle SDK attempt to deliver Cling botnet that uses STUN-based command-and-control channels.
FBI Severs Ties with Contractor After Data Breach Reveals Security Lapse
FBI removed an Accenture contractor after a missed patch contributed to a ShinyHunters breach exposing bureau employee data.
Citrix Urges Urgent Updates as NetScaler Vulnerability Exploited
Critical NetScaler zero-day is actively exploited, causing DoS and federal risk advisories; immediate updates recommended.
Monday, October 5
Apache Releases Critical Update for HTTP Server Vulnerabilities
PremiumApache released HTTP Server 2.4.69 addressing 20 vulnerabilities that could allow code execution, auth bypass, data leaks, and DoS.
Legal Challenges and Security Threats: OpenAI and Cisco Face New Hurdles
PremiumSANS NewsBites highlights OpenAI agent accountability lawsuit, exploited Cisco SD-WAN flaw, and Zammad zero-days used against DIVD.
Microsoft Urges Rapid Update for Critical Exchange Server Flaw
PremiumMicrosoft reissued Exchange Server V2 updates to fix CVE-2026-96940, an authz flaw allowing intra-org mailbox access and exfiltration risks.
Fortra Addresses Critical Vulnerabilities in BoKS With Urgent Patches
PremiumFortra released patches for BoKS vulnerabilities that could allow authentication bypass, shell execution, and memory corruption.
Debian Patches Over 1,300 Security Flaws in Major Update
PremiumDebian released a large kernel/security update addressing 1,313 CVEs that risk privilege escalation, DoS, and information leaks.
Dutch Cybersecurity Institute Targeted by Zero-Day Exploit and AI Attack
PremiumTwo zero-days were exploited against the Dutch Institute for Vulnerability Disclosure (DIVD), leveraging Zammad flaws and agentic AI elements.
Dell Patches Critical Vulnerabilities in Container Storage Modules
PremiumDell patched critical Container Storage Module vulnerabilities allowing unauthenticated attackers to gain full administrative control of storage environments.
Vercel Uncovers KVM Zero-Day Vulnerability Allowing VM Escape
PremiumVercel confirmed a KVM zero-day allowing VM escape and host root access, raising sandbox containment concerns for untrusted workloads.
Warlock Ransomware Targets SharePoint, Compromises Critical Sectors
PremiumWarlock exploited SharePoint vulnerabilities to deploy ransomware against water, telecom, and government organizations.
Critical Security Update: GitLab Addresses Major Vulnerability in AI Gateway
PremiumGitLab patched a critical AI Gateway RCE affecting self-hosted gateways; immediate upgrades to specified versions advised.
Citrix Urgently Patches NetScaler SAML Flaw Amid Reports of Reboots
PremiumCitrix released emergency NetScaler SAML patches, but customers report appliance reboots after installing the update.
Critical FortiMail Vulnerability Actively Targeted by Attackers
PremiumCritical FortiMail zero-day (CVE-2026-104286) is actively exploited enabling arbitrary file writes; urgent patching required.
Get these articles delivered to your inbox.
Subscribe free