Microsoft Sets a New Record in September Patch Tuesday With 974 Vulnerabilities Fixed
Microsoft's September 2026 Patch Tuesday update set an all-time record, fixing between 972 and 974 vulnerabilities across its software portfolio, including more than 110 flaws classified as critical and 20 "wormable" bugs. The issues fixed include two zero-day vulnerabilities actively exploited in real-world attacks. One of these is CVE-2026-69414 (known as ShieldBreak), a privilege escalation vulnerability in Microsoft Defender. Just…
Read the article →
Brevo supply chain attack exposes over 100,000 websites
Brevo, the French marketing and communications platform formerly known as Sendinblue, suffered a supply chain attack that may have affected more than 100,000 websites. On September 10, the attackers reportedly exploited a vulnerability in…
Read the article →
Foreign Hackers Manipulate the Operational Systems of Two Colorado Water Utilities
Foreign actors breached the OT systems of two small private water utilities in Colorado in late August, altering plant settings, pumping cycles, and alarm configurations. The intruders also temporarily disabled remote access, but the…
Read the article →
Theft of Over $351 Million from Bitget Attributed to North Korean Actors
Cryptocurrency exchange Bitget detected unauthorized transfers on September 24 from a limited number of hot and warm wallets, with a reported value of at least $351.6 million. Some sources initially estimated the losses at…
Read the article →
Exploitation of New Citrix NetScaler Zero-Days Becomes Widespread
Two serious vulnerabilities in Citrix NetScaler ADC and Gateway products are creating an emergency for organizations that expose these devices to the Internet. CVE-2026-88771, which can be exploited remotely in vulnerable default configurations, was…
Read the article →
FortiBleed Campaign Compromises Over 86,000 Fortinet Firewalls Globally
The FBI and the U.S. Secret Service have issued a joint alert regarding 'FortiBleed,' a massive credential-harvesting campaign that has already compromised 86,644 Fortinet FortiGate devices and SSL VPN gateways across 194 countries. The…
Read the article →
Active Exploitation of Critical Vulnerabilities in MikroTik Routers (CVE-2026-67276, CVE-2026-86060)
Attackers are actively exploiting a chain of vulnerabilities known as 'MikroTrick' in MikroTik RouterOS routers with the SSH service exposed to the Internet. CERT Polska and expert Costin Raiu revealed that the attacks combine…
Read the article →
N-able Releases Fourth Emergency Hotfix for Critical RCE Flaw in N-central (CVE-2026-86218)
N-able has urgently released the fourth hotfix in five weeks for its N-central remote monitoring and management (RMM) platform. The update fixes vulnerability CVE-2026-86218, rated with the maximum severity score (CVSS 10.0), which allows…
Read the article →
CISA Flags Five Actively Exploited Vulnerabilities in Artifactory, ScreenConnect, and RouterOS
The U.S. Cybersecurity and Infrastructure Security Agency has added five vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog. Their inclusion confirms that the flaws are already being…
Read the article →
GitLab: Critical CVE-2026-85706 Vulnerability Exploited Within 24 Hours
GitLab has disclosed CVE-2026-85706, a path traversal vulnerability with a CVSS score of 10.0 in the repository commits API. An unauthenticated attacker can send a single specially crafted HTTP request to read arbitrary files…
Read the article →
Critical Zero-Day in Cisco Catalyst SD-WAN Manager Actively Exploited
Critical FortiMail zero-day actively exploited and added to the KEV catalog
New Attack Vector Against Citrix NetScaler After Initial Patches
Critical Atlassian Vulnerability Exploited Hours After Details Were Published
Critical Pre-Authentication Vulnerability in Orkes Conductor Actively Exploited
Citrix NetScaler zero-day exploited to take SAML deployments offline
An OpenAI agent bypassed the controls of an Australian healthcare portal
FBI and DOJ Disrupt Flax Typhoon Infrastructure Targeting Critical NetworksCritical Zero-Day in Cisco Catalyst SD-WAN Manager Actively ExploitedCritical FortiMail zero-day actively exploited and added to the KEV catalogNew Attack Vector Against Citrix NetScaler After Initial PatchesCritical Atlassian Vulnerability Exploited Hours After Details Were PublishedCritical Pre-Authentication Vulnerability in Orkes Conductor Actively ExploitedCitrix NetScaler zero-day exploited to take SAML deployments offlineAn OpenAI agent bypassed the controls of an Australian healthcare portalFBI and DOJ Disrupt Flax Typhoon Infrastructure Targeting Critical Networks- Critical VM-Escape Vulnerability Fixed in VMware Workstation and Fusion
- Historic Record for September 2026 Patch Tuesday With 973 Vulnerabilities Fixed
- GitLab fixes CVSS 10 vulnerability already targeted by hostile scans
- Cisco Secure Email Gateway: critical vulnerability actively exploited to gain root privileges
- Cisco Fixes a Wide Range of Vulnerabilities in ISE, Including an Already Exploited Flaw
- Two critical Citrix NetScaler zero-days exploited before patches became available
- Two Citrix NetScaler Zero-Days Exploited Globally
- Citrix NetScaler zero-day exploited to gain root access