8 posts
On-premises Exchange allows reading other users' mailboxes (CVSS 8.8), 543,000 GitHub credentials remain active after years of exposure, and Apple tightens AI agent access on macOS.
Citrix patches NetScaler SAML zero-day with CISA deadline October 7, China-aligned TA419 bypasses MFA via AitM session hijacking, and OpenSSL patches 14 flaws including a DTLS memory disclosure.
Microsoft retires EWS for third-party apps today, Windows Server 2022 loses mainstream support in 12 days, and October kicks off as Cybersecurity Awareness Month 2026.
Apple patched an actively exploited CoreGraphics zero-day, TeamFiltration compromised forgotten M365 service accounts without MFA, and 16,000+ Supabase databases are leaking sensitive business data.
Citrix NetScaler has two actively exploited unauthenticated RCE zero-days, Cloudflare patched a cross-tenant data leak in Containers, and ShinyHunters is attacking Oracle PeopleSoft via a WAF bypass trick.
GitHub Actions Shai-Hulud supply chain attack exposed ~15,000 repos, OpenAI AI agents accidentally uploaded user images to third-party sites, and Kiteworks warned of a potential zero-day.
WordPress patches critical Click2Shell flaw, actively exploited Acronis backup plugin vulnerability for cPanel, and thousands of sites still loading content from a re-registered CDN domain.
macOS 27 launches today, a phishing wave hits Microsoft 365 via a fake passkey helpdesk, and CISA adds a critical ScreenConnect flaw.