Researchers Warn of Two More Unpatched NetScaler Zero-Days Already Under Attack
Security firm watchTowr says it has uncovered two additional, undisclosed remote-code-execution vulnerabilities in Citrix NetScaler during forensic investigations, and that both appear to have been exploited in real-world...
Actively Exploited FortiMail Zero-Day Lets Attackers Write Files Without Login
Fortinet says attackers are exploiting a critical FortiMail flaw that permits unauthenticated file writes through crafted web requests. With patches still pending for several branches at disclosure, administrators...
Citrix NetScaler Zero-Days Under Active Attack: Google Uncovers Hidden Web Shell Campaign
Google's threat intelligence team says attackers have been exploiting two critical, now-patched Citrix NetScaler zero-days since early September to plant a stealthy PHP web shell and pivot deep...
Two Reported NetScaler Zero-Days Put Internet-Facing Gateways on Emergency Watch
Researchers say two undisclosed Citrix NetScaler remote-code-execution flaws are already being used in attacks, although vendor confirmation and technical indicators remain pending. Defenders should inventory exposed appliances, preserve...
Actively Exploited F5 BIG-IP OAuth Zero-Day Enables Unauthenticated RCE
F5 is warning that attackers are exploiting a critical BIG-IP APM zero-day that can provide unauthenticated remote code execution on certain OAuth authorization-server deployments. Organizations should identify exposed...
Check Point Confirms In-the-Wild Attacks on Critical Management Server Zero-Day
A critical, pre-authentication flaw in Check Point's Management Server software was exploited in the wild weeks before a fix existed, letting attackers upload and run code on systems...
Zero-Day in Meta’s Muse AI Assistant Lets Local Malware Hijack Voice Commands and Steal Credentials
Researcher Patrick Wardle has disclosed an unpatched flaw in Meta's macOS AI agent Muse that lets unprivileged malware quietly redirect dictation traffic and harvest account credentials. The bug...
Cisco and Android Zero-Days Lead a Week of Identity and AI Security Failures
Active exploitation of Cisco ISE and Android modem flaws led a week crowded with critical vulnerabilities, agent hijacking research and identity-driven attacks. Defenders should prioritize exposed control planes,...