Topic
Vulnerabilities
-
News Security & privacy
A fifth exploited Citrix NetScaler flaw since August; US agencies get until 7 October to act
The flaw lets an attacker knock NetScaler ADC and Gateway appliances offline without logging in. Versions fixed for September's flaws are still affected.
-
News Security & privacy
Zammad flaws used to breach a security nonprofit are listed as exploited; US agencies must act by 5 October
The Dutch Institute for Vulnerability Disclosure says the attack on it in September was carried out by an AI agent. Zammad says one flaw affects only old versions and it cannot yet verify the other.
-
News Security & privacy
Attackers are exploiting a FortiMail flaw before a fix exists; US agencies get three days to act
Fortinet says an unauthenticated attacker can write files on its email-security appliances. Fixed releases are listed as upcoming, so for now it offers a workaround: switch off one feature.
-
News Security & privacy
An exploited Cisco flaw lets attackers into SD-WAN Manager as admin; US agencies get three days to act
Cisco says an unauthenticated attacker can reach the network-management system's API with admin rights, and there is no workaround. It is the ninth Cisco SD-WAN flaw CISA has listed as exploited this year.
-
News Security & privacy
Apple fixed an exploited flaw in iPhones, iPads and Macs, and US agencies were given until 2 October to patch
Apple says it may have been used in an extremely sophisticated attack on specific people. The US cyber agency listed it as exploited a day after the fix.
-
News Security & privacy
Two new Citrix NetScaler flaws are being exploited, and US agencies were given three days to act
One lets an unauthenticated attacker run commands on the widely used remote-access and load-balancing appliances. It is the third NetScaler flaw CISA has listed as exploited this month.
-
News Security & privacy
Attackers are exploiting a flaw in WordPress itself, US cyber agency says; fixes go back to version 4.7
The flaw can let an unauthenticated attacker run code on some sites, depending on the theme and server set-up. WordPress released fixes on 22 September; CISA listed it as exploited on 25 September.
-
News Security & privacy
Critical flaws in F5 and Check Point security products were exploited on the day they were disclosed
Both let an unauthenticated attacker run code: one in F5's BIG-IP access gateway when it acts as an OAuth server, the other in Check Point's management server.
-
News Security & privacy
Three Linux kernel flaws are being exploited, US cyber agency says, including one scored 9.8
The flaws are in the kernel's TLS, crypto-socket and network-bridge code. CISA notes the kernel is used in many products, some of which may no longer get fixes.
-
News Security & privacy
A flaw in Pixel phones' cellular modem is being exploited; Google's 5 September patch level fixes it
Google says there are signs of limited, targeted attacks. The US cyber agency added the flaw to its exploited list a day after Google's bulletin.
-
News Security & privacy
Attackers are exploiting flaws in GitLab and JFrog Artifactory, where companies keep their code and builds
The GitLab flaw, scored 10 out of 10, let an unauthenticated user read any file on a self-managed server. US agencies were given three days to patch it.
-
News Security & privacy
Cisco says state-backed hackers and a ransomware group are exploiting its firewall management software
One flaw, scored 10 out of 10, gives root access without logging in. Cisco's researchers found a variant of malware previously attributed to Russia's Sandworm on one compromised system.
-
News Security & privacy
Chrome had two flaws exploited by attackers within a week; update to version 153 fixes the second
Both were in V8, Chrome's JavaScript engine, and let a crafted web page run code inside the browser's sandbox. Chrome 153 also fixed 229 other security bugs.
-
News Security & privacy
US agencies must now fix the riskiest exploited flaws in under three days, under a new CISA directive
BOD 26-04 replaces the old fixed deadlines with ones based on risk, and adds forensic checks. In September, 33 of the 41 flaws CISA listed as exploited carried 3-day deadlines.