Citrix has confirmed that two serious vulnerabilities in its NetScaler ADC and NetScaler Gateway products were exploited by attackers before any patches were available. These flaws allow remote code execution, meaning that attackers could potentially gain control of the affected appliances. This situation puts many organizations at risk, especially those relying on these products for application delivery and security. Users need to take this threat seriously and apply the patches as soon as they are released to avoid potential breaches. The vulnerabilities were exploited in the wild, making immediate action critical for affected systems.
The Cybersecurity and Infrastructure Security Agency (CISA) has reported eight critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway products, specifically CVE-2026-88771 through CVE-2026-88778. Among these, CVE-2026-88771 and CVE-2026-88772 are particularly concerning as they are zero-day vulnerabilities, meaning they are actively being exploited by attackers. CISA has confirmed that these vulnerabilities allow for remote code execution, which poses a significant risk to organizations using these systems. Citrix has published advisories and indicators of compromise to help users assess their exposure and take necessary actions. Organizations are urged to check for signs of compromise before applying patches, as doing so may erase critical forensic evidence.
Security researchers have identified two serious unpatched vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that can allow attackers to execute remote code. These zero-day flaws are currently being exploited in the wild, raising concerns among IT administrators. Citrix has not yet acknowledged the vulnerabilities or provided a fix, leading some organizations to proactively take their appliances offline to prevent potential attacks. The situation is urgent as these vulnerabilities could expose sensitive data and systems to unauthorized access. Companies using affected Citrix products should monitor for updates and consider temporary mitigation strategies until a patch is released.
Google has issued a warning about a surge in attacks exploiting a serious vulnerability in Oracle PeopleSoft, identified as CVE-2026-35273. This flaw has a CVSS score of 9.8, indicating a high risk of unauthorized remote code execution. The attacks are linked to the ShinyHunters group and are targeting various sectors worldwide. Organizations using Oracle PeopleSoft should take immediate action to secure their systems, as the vulnerability is currently being exploited in the wild. This situation underscores the need for companies to stay vigilant and apply necessary patches to mitigate the risk of exploitation.
Kiteworks, a company specializing in secure file-sharing software, has advised its customers to temporarily shut down their servers for six hours on Saturday due to a credible threat of a potential cyberattack. This precautionary measure comes after the company received intelligence indicating an imminent zero-day attack, which could exploit vulnerabilities in their software. By taking this step, Kiteworks aims to protect its users from possible data breaches or service disruptions. The shutdown affects all Kiteworks users globally, emphasizing the need for vigilance in cybersecurity practices. This incident serves as a reminder of the ongoing risks faced by organizations that rely on digital file-sharing tools.
Arista Networks has addressed a zero-day vulnerability in the VeloCloud Orchestrator (VCO) On-Prem deployments, which is currently being exploited by attackers. This flaw poses a significant risk, as it allows unauthorized access to the system, potentially compromising sensitive data and network operations. Users of the VCO should apply the security patches released by Arista immediately to protect their systems. The urgency of this patching process is underscored by the fact that the vulnerability is actively being exploited in the wild. Organizations relying on VeloCloud Orchestrator must prioritize this update to mitigate the risk of an attack and safeguard their network infrastructure.
The hacking group ShinyHunters claims to have obtained personal information on thousands of FBI employees by exploiting a zero-day vulnerability in PeopleSoft, a software commonly used for human resources and finance applications. This breach, if confirmed, raises significant concerns about the security of sensitive government data and the potential for misuse of the information. ShinyHunters is known for past data breaches involving various organizations, which adds to the credibility of their claims. The implications of such a hack could be severe, potentially endangering the privacy and safety of FBI personnel and compromising sensitive investigations. As of now, the FBI has not publicly confirmed the breach, and it remains to be seen how they will respond to this alarming claim.
Arista Networks has issued an urgent warning about a critical security flaw in its Virtual Cloud Optimizer (VCO) software that allows remote attackers to access sensitive internal features. This vulnerability poses a significant risk as it could enable unauthorized users to exploit internal functionalities, potentially leading to serious breaches. Companies using VCO are advised to act quickly to patch this vulnerability to prevent exploitation. The situation is serious, as the flaw is already being actively exploited in the wild, increasing the urgency for affected users to secure their systems. Prompt remediation is crucial to safeguard sensitive data and maintain operational integrity.
F5 Networks has reported a serious vulnerability in its BIG-IP Access Policy Manager (APM) that allows attackers to execute arbitrary code on systems without authentication. This flaw, identified as CVE-2026-94127, specifically impacts systems where APM functions as an OAuth authorization server, which is responsible for generating access tokens for applications. F5 disclosed this issue on September 22, 2023, and has since released hotfixes to address the vulnerability. Organizations using affected versions of BIG-IP APM are urged to apply these updates promptly to protect against potential exploitation. The situation is critical as attackers are actively taking advantage of this flaw, posing significant risks to the security of OAuth servers.
A Chinese hacking group known as UTA0565 has been exploiting a recently discovered exploit chain affecting Google Chrome and Microsoft Windows. The attacks, which took place on September 3 and 4, 2026, take advantage of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one in Windows (CVE-2026-85880). By using fake websites, the attackers are able to deploy a malware variant named CLEANGULP. This is concerning as it indicates a coordinated effort to target users of these widely-used platforms, potentially compromising sensitive information and system integrity. Users of both Chrome and Windows should be vigilant and consider updating their systems promptly to mitigate the risks associated with these vulnerabilities.
A serious vulnerability in F5's BIG-IP application delivery controller has been identified, allowing unauthenticated attackers to send malicious traffic that could lead to remote code execution. This issue poses a significant risk as it can be exploited without authentication, making it easier for attackers to gain control of affected systems. Organizations using BIG-IP products need to act quickly to secure their systems, as this vulnerability is being actively exploited in the wild. F5 has not specified which versions are affected, but the urgency of the situation calls for immediate attention from IT departments to prevent potential breaches. Users should stay updated on patches and security advisories from F5 to mitigate this risk.
F5 Networks has issued urgent security updates to fix a serious vulnerability in its BIG-IP APM (Access Policy Manager) product. This zero-day flaw allows attackers to execute remote code, which means they can potentially take control of affected systems. The vulnerability is actively being exploited in the wild, posing a significant risk to organizations using the software. Users of BIG-IP APM are advised to apply the patches immediately to safeguard their systems. Without these updates, organizations remain vulnerable to exploitation, which could lead to data breaches or unauthorized access to sensitive information.
The ShinyHunters hacking group has claimed responsibility for a breach involving the FBI, exploiting a zero-day vulnerability in Oracle's PeopleSoft software. They reportedly accessed internal FBI systems and stole sensitive information related to employees and job applicants. This incident raises significant concerns about the security of government data and the potential misuse of the stolen information. As cybercriminals continue to target high-profile organizations, it highlights the urgent need for robust security measures to protect sensitive data. The FBI has not confirmed the breach, but if true, it could have serious implications for national security and public trust.
On July 23, attackers exploited a zero-day vulnerability in Check Point's Security Management Server, identified as CVE-2026-93616. This flaw allows unauthorized users to execute scripts on the server's web service without needing to log in, posing a significant risk to organizations using this system. Check Point, which oversees firewall policies through this server, confirmed that the vulnerability was part of targeted attacks. To address this issue, the company released a patch on September 22, aimed at securing the affected systems. Organizations utilizing Check Point's Security Management Server should prioritize applying this update to mitigate potential exploitation.
Check Point Software has issued urgent hotfixes to fix a serious vulnerability in its Security Management Server. This flaw allows attackers to execute arbitrary scripts, which could potentially lead to unauthorized access and control of affected systems. The vulnerability has been actively exploited in the wild, putting various organizations at risk. Users of the Security Management Server need to apply the latest patches immediately to protect their infrastructure. This incident emphasizes the importance of timely updates in cybersecurity practices, especially for critical management systems.