Ransomware Gangs Exploit WatchGuard Firebox Vulnerability
PremiumCISA warns WatchGuard Firebox RCE is being exploited by ransomware gangs to deploy encryptors and extort victims.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesFriday, September 11
Immediate Action Required: Critical Citrix NetScaler Vulnerability Exploited
PremiumCISA added CVE-2026-19490 (NetScaler authentication bypass) to KEV after in-the-wild exploitation; urgent mitigations required.
BlueMoon Exploit Kit Targets Chrome and Windows Vulnerabilities
PremiumBlueMoon exploit kit used by multiple espionage groups chains Chrome and Windows zero-days to gain remote code execution.
Microsoft Sets New Record with Patch Tuesday, Fixes Nearly 1000 Vulnerabilities
PremiumMicrosoft released an unprecedented Patch Tuesday fixing 974 CVEs, including two actively exploited Windows zero-days; prioritize critical updates.
Wednesday, September 9
Ivanti Uncovers Critical Vulnerabilities in Key Enterprise Software
Ivanti disclosed advisories for EPMM, Neurons, and Sentry covering ten CVEs enabling privilege escalation and RCE across products.
Critical Vulnerabilities in Dell Secure Connect Gateway Demand Urgent Action
Three critical vulnerabilities in Dell Secure Connect Gateway could let attackers gain unauthorized access and root control pre-5.36 builds.
ChatGPT Sandbox Flaw Exposes Gmail Data Through Hidden Channels
A ChatGPT sandbox flaw allowed covert cross-account channels to exfiltrate Gmail data from connected accounts via hidden communications.
SAP Addresses Critical Vulnerability in Extended Passport Processing
SAP patched a critical kernel 'extended passport processing' vulnerability enabling unauthenticated remote command execution and secret recovery.
OpenAI Unveils GPT-6 Astra: A Double-Edged Sword for Cybersecurity
OpenAI's GPT-6 Astra can find zero-days autonomously, raising detection and monitoring challenges for security teams.
AI-Powered Cyber Attacks: A Growing Threat to Security
GTIG analysis shows automated AI systems are accelerating vulnerability discovery and secret theft, increasing attacker scale and speed.
WeChat Zero-Click Vulnerability: A Silent Threat Neutralized
Researchers built a WeChat zero-click worm that takes over accounts via incoming calls without user interaction, spreading across phones.
Critical FreeIPA Security Flaws Allow Unauthorized Access to Administrator Credentials
A FreeIPA flaw chain allows anonymous clients to create Kerberos identities and be added to administrators group via 389-ds bug.
MikroTik Urges Immediate Router Updates to Block Exploitation
MikroTik patched 'MikroTrick' critical flaws that bypass authentication, overwrite configs, and allow device takeover.
Urgent Patch Released for Critical Vulnerability in N-central Platform
N-able released multiple hotfixes for N-central RMM to address a critical, actively exploited zero-day; verify hotfix application and unknown accounts.
Urgent Alert: Critical Chromium V8 Vulnerability Actively Exploited
CISA warns CVE-2026-85046 is actively exploited in the wild against Chromium-based browsers; update browsers and apply mitigations.
Adobe Releases Urgent Patch for Magento Zero-Day Vulnerability
Adobe issued an emergency patch for the Magento zero-day 'StyleSmuggler' used to backdoor servers; immediate updates required for e-commerce.
Microsoft's September 2026 Patch Tuesday: A Record-Breaking Security Update
Microsoft released its largest Patch Tuesday, fixing roughly 973–974 vulnerabilities including two actively exploited zero-days; prioritize exposure-based patching.
Monday, September 7
Critical Vulnerability in Elementor Pro Plugin Exploited by Hackers
PremiumElementor Pro CVE-2026-32475 arbitrary file upload is exploited to hack WordPress sites (CVSS 9.8).
CrowdStrike FalconFlank Zero-Day Exploit Threatens Windows Systems
PremiumFalconFlank zero-day exploit targets CrowdStrike Falcon, enabling SYSTEM privilege escalation on updated Windows hosts.
MikroTik Routers Vulnerable to Unauthenticated SSH Exploits
PremiumAttackers exploit internet-exposed MikroTik SSH to gain unauthenticated full administrative control of routers.
Get these articles delivered to your inbox.
Subscribe free