Vercel Confirms KVM Zero-Day Behind Claimed Guest-to-Host Root Escape
Vercel has confirmed a KVM zero-day reported through its Sandbox bounty program after a researcher claimed a full guest-to-host escape. Technical details, affected versions and remediation guidance remain...
Citrix Rushes Emergency Patches as Hackers Actively Exploit NetScaler SAML Zero-Day
Citrix has shipped emergency fixes for CVE-2026-88779, a memory-overflow flaw in NetScaler ADC and Gateway's SAML components that attackers are actively exploiting to knock appliances offline. Administrators running...
Apple Patches CoreGraphics Zero-Day Used in Spyware-Style Attacks on iPhones and iPads
Apple's iOS 26.7.1 and iPadOS 26.7.1 updates close CVE-2026-86950, an out-of-bounds write in CoreGraphics that attackers used in what Apple describes as an extremely sophisticated attack against specifically...
Researchers Warn of Two More Unpatched NetScaler Zero-Days Already Under Attack
Security firm watchTowr says it has uncovered two additional, undisclosed remote-code-execution vulnerabilities in Citrix NetScaler during forensic investigations, and that both appear to have been exploited in real-world...
Actively Exploited FortiMail Zero-Day Lets Attackers Write Files Without Login
Fortinet says attackers are exploiting a critical FortiMail flaw that permits unauthenticated file writes through crafted web requests. With patches still pending for several branches at disclosure, administrators...
Citrix NetScaler Zero-Days Under Active Attack: Google Uncovers Hidden Web Shell Campaign
Google's threat intelligence team says attackers have been exploiting two critical, now-patched Citrix NetScaler zero-days since early September to plant a stealthy PHP web shell and pivot deep...
Two Reported NetScaler Zero-Days Put Internet-Facing Gateways on Emergency Watch
Researchers say two undisclosed Citrix NetScaler remote-code-execution flaws are already being used in attacks, although vendor confirmation and technical indicators remain pending. Defenders should inventory exposed appliances, preserve...
Actively Exploited F5 BIG-IP OAuth Zero-Day Enables Unauthenticated RCE
F5 is warning that attackers are exploiting a critical BIG-IP APM zero-day that can provide unauthenticated remote code execution on certain OAuth authorization-server deployments. Organizations should identify exposed...