VulnHub

A serious vulnerability in Roundcube Webmail, identified as CVE-2026-48842, is currently being exploited by attackers. This SQL injection flaw, which has a CVSS score of 8.1, allows unauthorized access to databases on unpatched webmail servers. The Canadian Centre for Cyber Security has issued a warning about this active exploitation, emphasizing the urgency for users to secure their systems. Organizations running Roundcube Webmail should take immediate action to protect their data and prevent potential breaches, especially since the patch for this vulnerability was released four months ago. Failure to apply this update could lead to significant data compromise.

Citrix has confirmed that two serious vulnerabilities in its NetScaler ADC and NetScaler Gateway products were exploited by attackers before any patches were available. These flaws allow remote code execution, meaning that attackers could potentially gain control of the affected appliances. This situation puts many organizations at risk, especially those relying on these products for application delivery and security. Users need to take this threat seriously and apply the patches as soon as they are released to avoid potential breaches. The vulnerabilities were exploited in the wild, making immediate action critical for affected systems.

Citrix has confirmed that two serious vulnerabilities in its NetScaler product, identified as CVE-2026-88771 and CVE-2026-88772, are currently being exploited in attacks. These vulnerabilities allow remote code execution, which means that attackers could potentially take control of affected systems. Organizations using NetScaler should prioritize applying the security updates released by Citrix to mitigate these risks. The situation is urgent, as the vulnerabilities are actively being exploited, putting many businesses at risk of unauthorized access and data breaches. Users are advised to stay vigilant and ensure their systems are up to date with the latest patches.

The latest Security Affairs Malware newsletter covers significant developments in the malware landscape, including a case where a Malware-as-a-Service platform exploited GitHub to distribute malicious software across forty different companies. One notable threat discussed is the PAYLOAD ransomware, which has been found to weaponize Active Directory Group Policy Objects (GPO), making it easier for attackers to infiltrate and control networks. Additionally, researchers are tracing a Node.js Remote Access Trojan (RAT) named ChainScript, which is being used in various cyber attacks. These incidents highlight the evolving tactics of cybercriminals and the need for organizations to stay vigilant against sophisticated malware techniques that can compromise their systems and sensitive data.

The Cybersecurity and Infrastructure Security Agency (CISA) has reported eight critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway products, specifically CVE-2026-88771 through CVE-2026-88778. Among these, CVE-2026-88771 and CVE-2026-88772 are particularly concerning as they are zero-day vulnerabilities, meaning they are actively being exploited by attackers. CISA has confirmed that these vulnerabilities allow for remote code execution, which poses a significant risk to organizations using these systems. Citrix has published advisories and indicators of compromise to help users assess their exposure and take necessary actions. Organizations are urged to check for signs of compromise before applying patches, as doing so may erase critical forensic evidence.

The Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability in Microsoft SharePoint, identified as CVE-2026-65660, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw is currently being exploited in the wild, prompting CISA to issue a patching deadline for federal agencies by September 28. Organizations using SharePoint should prioritize applying the necessary updates to mitigate potential risks. The urgency of this situation lies in the fact that attackers can leverage this vulnerability for unauthorized access, which could lead to data breaches and other security incidents. It's crucial for users to stay informed and act quickly to secure their systems.

Last week, a significant data breach involving Gyazo was reported, exposing the personal information of 23.6 million users. The breach has raised concerns about the security of user data on the popular screenshot-sharing platform. Attackers managed to access sensitive information, including email addresses and user-generated content, which could lead to identity theft or phishing attacks. This incident underscores the importance of robust security measures for online services that handle sensitive user data. Users of Gyazo are advised to change their passwords and monitor their accounts for any suspicious activity.

Security researchers have identified two serious unpatched vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that can allow attackers to execute remote code. These zero-day flaws are currently being exploited in the wild, raising concerns among IT administrators. Citrix has not yet acknowledged the vulnerabilities or provided a fix, leading some organizations to proactively take their appliances offline to prevent potential attacks. The situation is urgent as these vulnerabilities could expose sensitive data and systems to unauthorized access. Companies using affected Citrix products should monitor for updates and consider temporary mitigation strategies until a patch is released.

Researchers at Manifold Security discovered a significant issue involving placeholder domains that were found in 359,000 GitHub files and linked to 349 AI agent skills. These domains are being used to redirect users to various scams, which could lead to financial losses and data theft. This situation raises concerns about the security of AI integrations and the potential for users to fall victim to these scams. It highlights the importance of scrutinizing third-party skills and applications, especially those that rely on external domains. Users and developers need to be vigilant about the sources of the tools they use to avoid being exploited by malicious actors.

A new malware called Lunex, which is part of a broader malware-as-a-service model, is targeting Ukrainian-speaking users through compromised websites. The attack involves a four-stage process starting with a fake CAPTCHA page designed to lure victims. Once engaged, the malware exploits an AMD driver to disable security monitoring, making it easier to steal sensitive information, such as browser credentials. This is particularly concerning as it highlights the tactics used by cybercriminals to bypass security measures and compromise user data. The findings from the cybersecurity firm Ontinue emphasize the need for increased vigilance among users, especially in regions facing heightened cyber threats.

Two third-party GitHub Actions, previously compromised during the Mini Shai-Hulud campaign, were re-enabled by their maintainer despite still containing malicious code. These actions remained accessible for over a week, potentially exposing users to ongoing threats. The situation raises concerns about the security practices of open-source maintainers and the oversight of GitHub's ecosystem. Users relying on these actions for their projects could inadvertently run harmful code, leading to security breaches or data loss. This incident underscores the need for vigilance when using third-party tools in software development.