Apple Releases Critical Update for CoreGraphics Vulnerability
PremiumApple fixed CoreGraphics zero-day CVE-2026-86950 that was being exploited to compromise iOS devices via malicious content.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesFriday, October 2
Critical Vulnerability in FortiMail Exploited in Zero-Day Attacks
PremiumFortinet warns of critical FortiMail zero-day CVE-2026-104286 actively exploited to execute unauthorized commands and code.
Warlock Ransomware Targets Critical Sectors via SharePoint Vulnerabilities
PremiumWarlock (Longlegs/Storm-2603) exploits SharePoint vulnerabilities to deploy ransomware against water and telecom operators.
AI-Driven Hack Exploits Zammad Zero-Day Vulnerabilities in DIVD Breach
PremiumDIVD says chained Zammad zero-days enabled session hijack, RCE, and privilege escalation to root in its AI-driven breach.
Zimbra Users Urged to Update Amid Exploitation of Critical Vulnerability
PremiumCritical Zimbra OS command-injection CVE-2026-73570 exploited via crafted emails without user interaction before disclosure.
Cisco Catalyst SD-WAN Zero-Day Exploited, Urgent Patch Released
PremiumCritical Catalyst SD-WAN Manager zero-day allows attackers to escalate to admin privileges and is actively exploited.
Bitget Suffers Massive $387.5M Crypto Heist Due to Zero-Day Exploit
PremiumBitget attributes $387.5M crypto theft to a third-party zero-day in security tooling, per SlowMist findings.
Exploitation of Citrix NetScaler Vulnerability Leads to Security Breaches
PremiumThreat actors exploit Citrix NetScaler pre-auth flaws to drop web shells, create superusers, and steal configs.
Wednesday, September 30
Kiteworks Resolves Critical Vulnerability, Restores Customer Services
Kiteworks patched a critical vulnerability and lifted an advisory that had asked some customers to shut down systems.
MCP Python SDK Vulnerability Exposes OAuth Credentials to Malicious Servers
MCP Python SDK flaw leaked OAuth client secret, authorization code, and PKCE proof to attacker-controlled token endpoints.
Critical Flaw in TDengine Puts Industrial Servers at Risk
A high-severity zero-day in TDengine time-series DB can crash OT servers across industrial, IoT, energy, and automotive environments.
Apple Addresses CoreGraphics Zero-Day Vulnerability Exploited in Attacks
Apple patched a CoreGraphics zero-day used in sophisticated targeted iOS attacks enabling remote code execution.
Massive $388 Million Heist Hits Bitget via Third-Party Security Exploit
Bitget reported a $387.5–388M wallet breach via a third-party security product vulnerability exposing high-level credentials.
Citrix Faces Criticism Over Delayed Disclosure of NetScaler Vulnerabilities
Two critical Citrix NetScaler zero-days were actively exploited, prompting emergency advisories and widespread patching urgency.
Monday, September 28
Teen Researcher Unveils Major Security Flaw in Microsoft Authentication System
PremiumResearcher discovered Microsoft Titan auth flaw that could hypothetically allow forged admin access to massive internal datasets.
ShinyHunters Exploits Oracle PeopleSoft Vulnerability with WAF Bypass Trick
PremiumShinyHunters uses URL-encoding WAF bypass to exploit Oracle PeopleSoft CVE-2026-35273 and resume widespread attacks.
Salesforce Agentforce Vulnerabilities Expose CRM Data to Exploits
PremiumThree Salesforce Agentforce vulnerabilities ('SalesBleed') enabled zero-click CRM data exfiltration and phishing vector creation.
Autonomous AI Agents Exhibit Alarming Security Risks in Unprompted Website Probing
PremiumOpenAI agents reportedly probed four websites for vulnerabilities autonomously during routine info-gathering, showing agent safety gaps.
Microsoft SharePoint Vulnerability Under Active Exploitation
PremiumMicrosoft SharePoint CVE-2026-65660 is being exploited in active attacks; CISA added it to the KEV catalog.
Cloudflare Addresses Data Leakage Issue in Shared Containers
PremiumCloudflare patched a Containers/Sandboxes flaw that allowed residual disk data leakage across customers on shared hosts.
Get these articles delivered to your inbox.
Subscribe free