Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 8 items in Exploited vulnerabilities. Show all 52 items

October 2026

1 item

  • Exploited vulnerabilities

    Ivanti Connect Secure zero-day chain gave attackers root on fully patched VPNs

    On 13 October 2026 Ivanti disclosed and patched CVE-2026-104935, an authentication bypass in Connect Secure that lets a remote unauthenticated attacker execute arbitrary commands, and said a limited number of customers were affected. Volexity found it being exploited by a previously undocumented actor it tracks as UTA0576. According to Volexity, the actor chained it with a privilege escalation flaw to get unauthenticated root-level code execution on an appliance running 22.8R2.4, the latest release at the time. Ivanti fixed the remaining chained flaws, CVE-2026-111357 and CVE-2026-118527, on 29 October, and CISA added both to its KEV catalogue the next day.

    • Network & infrastructure testing
    • Incident response
    • Red team & purple team

September 2026

4 items

  • Exploited vulnerabilities

    Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 exploited for weeks

    Citrix released fixes on 27 September 2026 for eight NetScaler ADC and NetScaler Gateway vulnerabilities, CVE-2026-88771 through CVE-2026-88778, and said exploits of CVE-2026-88771 and CVE-2026-88772 had been observed on unmitigated deployments. Attackers used them to deliver web shells. According to CyberScoop, Mandiant said the earliest known exploitation of CVE-2026-88772 was on 3 September, that it was aware of dozens of impacted organisations, and attributed the attacks to advanced and suspected state-sponsored threat actors. CISA added both flaws to its Known Exploited Vulnerabilities catalogue the same day, and added a third exploited flaw, CVE-2026-88779, a denial-of-service bug that affects only appliances with SAML enabled, on 4 October.

    • Network & infrastructure testing
    • Incident response
    • Red team & purple team
  • Exploited vulnerabilities

    Eight SharePoint flaws added to CISA's exploited list between March and September 2026

    According to the catalogue's 6 November edition, CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalogue between 18 March and 25 September 2026. Microsoft's security update data marks CVE-2026-32201 (April) and CVE-2026-56164 (July) as exploited, and CISA added both on the day their fixes were released. Microsoft changed its record for CVE-2026-58644 to exploited one day after documenting it on 14 July, noting that the fix had shipped in June without the CVE being listed. CISA warned in July that the exploited flaws can be used for remote code execution and post-exploitation activity, including stealing IIS machine keys, to gain persistence and deploy malware.

    • Web application testing
    • Application security audit
    • Incident response
  • Exploited vulnerabilities

    Check Point confirms exploitation of VPN flaw CVE-2026-85102 and management zero-day

    Check Point said on 22 September 2026 that attackers were exploiting two flaws rated CVSS 9.8. The first, CVE-2026-85102, is a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling. It was disclosed and fixed on 9 September, and Check Point saw exploitation attempts against Spark customers from 12 September. The second, CVE-2026-93616, is a pre-authentication path traversal in the management web service, which Check Point said was used in a handful of pinpointed attacks on 23 July 2026, before a fix existed. CISA added both to its Known Exploited Vulnerabilities catalogue the same day.

    • Network & infrastructure testing
    • Incident response
  • Exploited vulnerabilities

    Magento StyleSmuggler zero-day exploited before patch; BlockStrap bypass followed

    Sansec reported on 5 September 2026 that attackers had been exploiting StyleSmuggler (CVE-2026-75650), an unauthenticated code injection flaw in the Magento and Adobe Commerce template system, since 4 September to install a Rust-based Linux backdoor, including on stores running the July and August 2026 patches. Adobe released hotfix VULN-39341 under bulletin APSB26-146 on 7 September, and the flaw is rated CVSS 10.0. On 13 October Adobe fixed a related CVSS 10.0 template injection, CVE-2026-103849, in APSB26-153; Sansec, which calls it BlockStrap and published its analysis on 15 October, says the September hotfix alone does not stop it.

    • Website security audit
    • Incident response
    • Application security audit

August 2026

1 item

  • Exploited vulnerabilities

    VMware vCenter flaw CVE-2026-59310 exploited days after Broadcom's emergency patch

    On 29 July 2026 Broadcom disclosed CVE-2026-59310, a CVSS 9.8 directory traversal flaw in the vCenter Syslog server that lets an unauthenticated attacker with network access to vCenter execute arbitrary code. It was one of five VMware vulnerabilities in the advisory, and BleepingComputer reported at the time that there was no indication of exploitation. Incident response firm QUIRSO reported that compromised systems began connecting to attacker infrastructure on 3 August and counted 361 victim IP addresses across 47 countries by 7 August, with the open-source reverse_ssh framework deployed for persistence. CISA added the flaw to its KEV catalogue on 18 August with a three-day deadline and later flagged it as used in ransomware campaigns.

    • Network & infrastructure testing
    • Cloud configuration review
    • Incident response

June 2026

1 item

  • Exploited vulnerabilities

    Oracle PeopleSoft zero-day CVE-2026-35273 exploited in ShinyHunters data theft

    On 10 June 2026 Oracle issued an out-of-band Security Alert for CVE-2026-35273, a CVSS 9.8 vulnerability in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 that can be exploited remotely without authentication and may result in remote code execution. Mandiant reported zero-day exploitation between 27 May and 9 June 2026 and attributed it to UNC6240 (ShinyHunters); 68% of the more than 100 organisations it notified were in higher education. On 25 September Google reported a renewed wave in which the actor got past path-based WAF rules and deployed web shells on dozens of systems.

    • Application security audit
    • Web application testing
    • Database security audit

December 2025

1 item

  • Exploited vulnerabilities

    React2Shell: React Server Components RCE exploited within hours of disclosure

    The React team disclosed CVE-2025-55182 on 3 December 2025, an unauthenticated remote code execution flaw rated CVSS 10.0 in how React decodes payloads sent to Server Function endpoints, affecting React Server Components packages in versions 19.0 to 19.2.0 and frameworks built on them, including Next.js. AWS reported exploitation attempts by China state-nexus groups within hours of disclosure. SecurityWeek reported that CISA added the flaw to its Known Exploited Vulnerabilities catalogue and that researchers observed attempted theft of AWS configuration and credential files, as well as attempts to deliver cryptocurrency miners and Mirai malware.

    • Web application testing
    • Application security audit
    • Incident response

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works