Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: two edge RCE flaws attacked before a fix existed Citrix published fixes for two NetScaler flaws on 2026-09-27 after watchTowr reported unpatched remote code execution bugs under active exploitation. Both flaws are rated 9.5 under CVSS v4. The two…
Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). [...]
If you use Legcord as your Discord client, a script running in the Discord page can break out of the Electron sandbox entirely. CVE-2026-105293 (CVSS 8.1) — Path Traversal to RCE Theme IPC handlers (themes.install, themes.uninstall, themes.folder) accept identifiers without sanitizing ../…
A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG)…
Microsoft's September Patch Tuesday landed a record-setting pile of roughly 970 new CVEs, and two of them are already being exploited. Buried in that pile is the one I would patch first: CVE-2026-69730, a CVSS 9.8 remote code execution in the Windows DNS Server role. No authentication, no user…
Redis RCE identifiers in August 2026: a use-after-free and a fix that left work behind Three remote code execution identifiers in one month is an unusual run for any infrastructure component, and the Redis sequence during August 2026 reads better as one story than as three separate advisories.…
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]
This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is…
