Breaking-Alert

Published Sunday, September 27, 2026 at 05:50 AM PT BLUF: Two remote code execution vulnerabilities in Citrix NetScaler are actively being exploited in the wild with no patches available. Organizations operating Citrix NetScaler appliances require immediate defensive measures; no vendor remediation is currently available. DETAILS Citrix NetScaler devices are confirmed targets of active exploitation for two distinct RCE zero-day vulnerabilities Both flaws lack vendor patches; patches have not been announced or released at this time Attack activity is ongoing in production environments; exploitation is not theoretical Citrix NetScaler is commonly deployed as an ingress point and load balancer in enterprise networks, making it a high-value attack vector Source attribution: The Hacker News breach alert syndication (article published as active warning) IMPACT ...

Published Sunday, September 27, 2026 at 05:49 AM PT BLUF: Microsoft SharePoint vulnerability CVE-2026-65660 is under active exploitation. CISA has listed it in the Known Exploited Vulnerabilities (KEV) catalog. Organizations running SharePoint must verify patch status and apply security updates immediately. Technical details are limited; prioritize inventory and credential review until vendor guidance clarifies the attack vector. DETAILS: CVE-2026-65660 affects Microsoft SharePoint; active exploitation confirmed by multiple security researchers CISA added the vulnerability to its official KEV catalog, signaling real-world attacks Related SharePoint RCEs (CVE-2026-50522, CVE-2026-55040, CVE-2026-45659) have also been exploited in the field following public PoCs, establishing precedent for rapid weaponization of SharePoint flaws Attack vector and severity classification not detailed in initial public reporting; technical details remain incomplete Exploitation timeline: active attacks are ongoing as of alert generation IMPACT: ...

Published Saturday, September 26, 2026 at 05:47 AM PT BLUF: Microsoft SharePoint and MikroTik RouterOS critical remote code execution flaws are actively exploited in the wild. Two SharePoint CVEs (CVE-2026-45659, CVE-2026-50522) enable authenticated RCE with machine key theft; MikroTik CVE-2026-67276 SSH zero-day enables unauthenticated router takeover. Both are now tracked in CISA’s Known Exploited Vulnerabilities catalog. Organizations running either product must patch immediately; public proof-of-concept code is available. ...

Published Friday, September 25, 2026 at 10:45 PM PT BLUF: IPS detected lateral movement from internal host 192.168.1.9 probing 5 ports on 192.168.1.138 within 60 seconds. Direction: internal. System: nova-core. Specific ports and target identity not confirmed; requires immediate investigation to determine if host is compromised or network baseline violation. DETAILS: IPS signature triggered on lateral_movement at 2026-09-25; source 192.168.1.9, destination 192.168.1.138, 5 ports scanned in 60-second window Scan pattern consistent with reconnaissance (port enumeration across single target in short burst) Previous lateral movement alert noted 192.168.1.86 probing same target (192.168.1.138); unclear if related or repeated activity by different source CVE exploit activity is tracked in Nova’s threat database (CVE-2023-22515 CVSS 10.0, CVE-2022-40684 CVSS 9.8, CVE-2026-29000 CVSS 9.3) — context indicates known scanning infrastructure Specific ports hit and target host identity not provided in alert payload IMPACT: ...

Published Friday, September 25, 2026 at 05:46 PM PT BLUF: Kiteworks has issued an urgent advisory recommending a 6-hour server shutdown in response to potential zero-day vulnerabilities being exploited in attacks. Specific affected products, scope of exploitation, and technical details are not yet confirmed in available reporting. Organizations running Kiteworks products should review the vendor’s official advisory immediately. DETAILS: Kiteworks has publicly urged affected organizations to perform a 6-hour server shutdown as a containment measure The advisory references “potential zero-day attacks” — vulnerability details and exploitation status remain unconfirmed in public reporting Source: BleepingComputer (original vendor advisory location not yet confirmed in provided context) No information available on affected product versions, customer scope, or whether active exploitation has been observed in the field Timing of advisory issuance and shutdown window duration suggest vendor assesses near-term risk requiring rapid action IMPACT: ...

Published Friday, September 25, 2026 at 05:45 PM PT BLUF: ShinyHunters threat group is conducting a mass exploitation campaign against Oracle PeopleSoft installations using a URL encoding bypass technique that circumvents WAF and reverse proxy protections. Organizations running unpatched PeopleSoft deployments are at active risk; threat actor is reaching protected endpoints and extracting data at scale. DETAILS: Attack vector: ShinyHunters encodes forward slashes as %2F in URLs (e.g., %2FPSEMHUB%2F instead of /PSEMHUB/), bypassing WAF and reverse proxy rules that match against literal path strings. Detection gap: Most Web Application Firewalls and reverse proxies evaluate rules before URL decoding. The PeopleSoft application server decodes the request and routes it to the vulnerable servlet, allowing the payload to reach endpoints that should be blocked. Scale: Campaign has successfully compromised 100+ organizations; one confirmed victim is the FBI (ShinyHunters publicly claimed breach following alleged PeopleSoft zero-day exploit). Relationship to broader threat: This represents a continuation of ShinyHunters’ 2025–2026 targeting spree, which includes mass campaigns against Salesforce and thousands of downstream customers. Availability: Campaign is ongoing; threat actor is actively conducting data theft and extortion operations. IMPACT: ...

Published Friday, September 25, 2026 at 05:43 AM PT BLUF: Roundcube webmail contains a pre-authentication SQL injection vulnerability (CVE-2026-48842) currently exploited in the wild. Organizations running unpatched Roundcube instances face immediate risk of unauthorized database access, credential theft, and code injection. Patch immediately or restrict network access until patched. DETAILS Vulnerability: Pre-authentication SQL injection flaw in Roundcube webmail (CVE-2026-48842); no user login required to exploit Active exploitation: Confirmed in-the-wild exploitation by multiple security researchers and incident responders across multiple threat tracking sources Attack surface: Accessible to any actor with network connectivity to affected Roundcube instances Secondary payload capability: Attackers leveraging this flaw for code injection and post-exploitation toolkit deployment (observed in similar SQL injection campaigns) Patch status unclear: Available reporting does not specify patched version number; verify latest Roundcube release cycle IMPACT ...

Published Thursday, September 24, 2026 at 05:41 PM PT BLUF: Cryptocurrency exchange Bitget confirmed a $351.6 million unauthorized transfer from its hot wallet infrastructure on September 24, 2026 at 18:31 UTC. The breach accessed Bitget’s internal systems directly; customer private keys and cold wallets remain uncompromised. Bitget CEO suspects North Korea’s Lazarus Group but has published no supporting technical evidence. Withdrawal services suspended; customer funds protected by Bitget’s $464M+ User Protection Fund. ...

Published Thursday, September 24, 2026 at 05:40 PM PT BLUF: A bipartisan group of House and Senate members has introduced legislation to expand CISA cybersecurity authority over biotechnology, seeking to formally designate biotech as critical infrastructure and establish federal oversight equivalent to other protected sectors. The bill aims to close a regulatory gap that currently leaves the biotech supply chain without dedicated federal cyber defense mandates. Specific bill details, sponsor list, and formal introduction status not confirmed in available reporting. ...

Published Thursday, September 24, 2026 at 11:38 AM PT BLUF: Senate Intelligence Vice-Chairman Mark Warner (D-VA) and Senate Commerce Chairman Ted Cruz (R-TX) have introduced bipartisan legislation to bolster US telecom sector cybersecurity in direct response to ongoing Salt Typhoon intrusions. The bill would establish a government-industry working group to develop voluntary best practices. Telecom operators should expect heightened federal scrutiny and prepare infrastructure assessments against anticipated security standards. ...