Breaking-Alert

Published Thursday, September 24, 2026 at 11:38 AM PT BLUF: Arista Networks’ on-premises VeloCloud Orchestrator is actively being exploited via a CVSS 10.0 zero-day vulnerability affecting SD-WAN management deployments. Patches exist but not all vulnerable versions have been updated. Organizations running unpatched on-premises VCO must apply fixes immediately. DETAILS Vulnerability: Maximum-severity (CVSS 10.0) flaw in on-premises VeloCloud Orchestrator enables remote attackers to gain unauthorized access to the SD-WAN management platform and its controlled edge devices. Exploitability: Active in-the-wild exploitation confirmed; certificate-based VCO configurations confirmed as attack vector. Affected scope: On-premises VCO deployments only; cloud-hosted instances status not explicitly confirmed in available material, though Arista’s advisory applies to on-premises. Patch status: Arista has issued patches, but as of advisory, not all vulnerable versions have been remediated — deployment versions vary across customer installations. Access implications: Successful exploitation grants attackers direct access to the platform that orchestrates SD-WAN subscriptions and controls all connected edge appliances. IMPACT ...

Published Thursday, September 24, 2026 at 05:37 AM PT BLUF: SolarWinds has released patches for two critical remote code execution vulnerabilities (CVE-2026-28324, CVE-2026-28325) affecting its Observability Self-Hosted platform. Both flaws allow unauthenticated exploitation and require immediate patching. Organizations running self-hosted deployments must update immediately; patch status is unknown for cloud-hosted variants. DETAILS: Two critical RCE vulnerabilities identified in SolarWinds Observability Self-Hosted, tracked as CVE-2026-28324 and CVE-2026-28325. CVSS scoring and specific version ranges not yet confirmed in advisory. No authentication required — both flaws are exploitable by unauthenticated remote attackers, bypassing credential checks. Patches available — SolarWinds has released fixes; specific patch versions not confirmed in available source material. Self-hosted scope confirmed — advisory explicitly references self-hosted deployments; status of cloud-hosted SolarWinds Observability customers not stated. Active disclosure — multiple security sources (SecurityWeek, The Hacker News) covering the advisory as of 2026-09-24; no confirmed active exploitation in the wild noted in provided sources. IMPACT: ...

Published Thursday, September 24, 2026 at 05:36 AM PT BLUF: Schneier on Security reports observation of sophisticated malware variant with technical characteristics consistent with nation-state capability; no attribution confirmed. Active CAPTCHA-based social engineering variant in circulation. Tracking — details insufficient for immediate action guidance. DETAILS Malware sophistication assessed as matching nation-state capability level (Schneier direct observation); no direct evidence of attribution available CAPTCHA-themed social engineering variant confirmed in circulation — frames malware payload as CAPTCHA challenge to trick users into execution No confirmed CVE, target sector, affected systems, or geographic focus provided in available material Detection/mitigation techniques not yet documented Schneier assessment: insufficient evidence to attribute or identify specific threat actor IMPACT ...

Published Thursday, September 24, 2026 at 05:35 AM PT BLUF: CISA and FBI issued formal guidance to critical infrastructure operators on managing risks from third-party Industrial Control Systems integrations. Key recommendations: enforce least-privilege access and restrict remote access capabilities for all third-party connections to ICS environments. DETAILS CISA and FBI jointly issued guidance directed at operators of critical infrastructure protecting industrial control systems. Primary focus: risks inherent in third-party ICS components and remote vendor access arrangements. Recommended controls: least-privilege access policies for all third-party vendor interactions with ICS networks; strict limits on remote access capabilities and connectivity. Guidance aligns with broader CISA hardening campaign; related advisories address insider threats, internet exposure reduction, and router security in critical infrastructure contexts. Full advisory text truncated in available material; core message and recommendations confirmed. IMPACT ...

Published Wednesday, September 23, 2026 at 11:34 PM PT BLUF: Organizations deploying AI agents across enterprise systems face critical exposure to sensitive data leakage through ticketing systems, CRM platforms, and shared drives. OpenAI recently contained an AI agent breach in its research environment. Security experts recommend immediate data-path auditing within 90 days. Affected organizations: any enterprise with agents connected to customer records, internal communications, or credential stores. ...

Published Wednesday, September 23, 2026 at 11:33 PM PT Check Point Security Gateway and Security Management products are under active exploitation. Multiple critical vulnerabilities—including unauthenticated remote code execution and full admin privilege escalation in SmartConsole—are being exploited in the wild. Affected organizations must patch immediately or implement strict network access controls on management interfaces until patches are available. DETAILS: • Check Point has disclosed active exploitation of multiple vulnerabilities in Security Gateway and Security Management products; attackers are gaining unauthorized access to critical perimeter infrastructure ...

Published Wednesday, September 23, 2026 at 05:32 PM PT BLUF: F5 released a patch for CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager enabling unauthenticated remote code execution. The flaw is actively exploited in the wild; organizations running BIG-IP APM as an OAuth authorization server face immediate risk and must patch now. DETAILS: Vulnerability: CVE-2026-94127 — unauthenticated remote code execution in F5 BIG-IP APM via heap buffer overflow Attack vector: Malicious network traffic sent directly to BIG-IP instances configured as OAuth authorization servers; no credentials required Exploitation status: Confirmed active exploitation occurring before patch availability Patch release: F5 published security advisory and fixes on September 22, 2026 Affected scope: OAuth server deployments; standard BIG-IP APM instances in other configurations may not be impacted IMPACT: Any F5 BIG-IP APM deployment functioning as an OAuth authorization server can be compromised remotely without authentication. Attack surface includes all internet-facing or network-accessible instances. Active exploitation means threat actors are already weaponizing this flaw. ...

Published Wednesday, September 23, 2026 at 05:31 PM PT BLUF: F5 has released a patch for CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager (APM) allowing unauthenticated remote code execution. Active exploitation in the wild confirmed. Organizations running vulnerable BIG-IP APM instances should patch immediately. DETAILS Vulnerability: CVE-2026-94127 — heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) Attack vector: Unauthenticated; attackers can send malicious traffic to achieve RCE without authentication Active exploitation: Confirmed in-the-wild attacks; disclosed as zero-day with public exploits available Affected component: F5 BIG-IP APM (particularly OAuth server deployments) Patch status: F5 published security advisory and patches on 22 September 2026 IMPACT ...

Published Wednesday, September 23, 2026 at 11:30 AM PT BLUF: WordPress has released an emergency patch for CVE-2026-87902, a critical vulnerability in WordPress Core that allows unauthenticated attackers to load arbitrary local PHP files and achieve remote code execution under specific server and theme conditions. Organizations running WordPress must patch immediately. DETAILS Vulnerability: CVE-2026-87902 in WordPress Core permits unauthenticated actors to load arbitrary local PHP files on affected systems. Severity: Critical; conditional RCE possible if server and theme configuration match specific criteria (exact conditions not yet fully disclosed). Authentication: No authentication required to trigger the vulnerability; exploitation requires no user account. Vendor Response: WordPress has released an emergency security update; no timeline for active wild exploitation confirmed at this time. Scope: Affects WordPress Core installations; exploitation surface varies by server configuration and active theme. IMPACT ...

Published Wednesday, September 23, 2026 at 11:29 AM PT BLUF: F5 BIG-IP Access Policy Manager (APM) is vulnerable to a critical, unauthenticated remote code execution zero-day (CVE-2026-94127) that is actively being exploited in the wild. Affected organizations running BIG-IP APM must immediately inventory instances, isolate systems from untrusted networks, and monitor for exploitation attempts. Patch availability status is currently unknown. ...