Citrix patched two NetScaler remote code execution zero-days that CISA says are being exploited in the wild, a cluster of critical flaws landed in Joomla, WordPress, Froxlor, hMailServer and Kyverno components, and Arizona's court system confirmed that intruders copied personal data.
🔴 CRITICAL (1)
Citrix patches two NetScaler RCE zero-days already exploited in the wild Confirmed
Citrix released fixes for eight NetScaler ADC and NetScaler Gateway flaws, two of which are being exploited in attacks and were added to CISA’s Known Exploited Vulnerabilities catalog on 27 September. CVE-2026-88771 (CVSS 9.5) is an input validation flaw that lets an unauthenticated attacker run arbitrary commands, and it affects every affected deployment including default configurations with no extra feature enabled; CVE-2026-88772 (CVSS 9.5) is a memory overflow that needs DTLS, which is enabled by default on VPN virtual servers. CISA says partner threat intelligence confirms global exploitation, and the other six flaws include an HTTP request smuggling bug, CVE-2026-88773, rated 9.3. Fixed builds are 14.1-73.37 and later, 13.1-64.23 and later of 13.1, 14.1-73.37 FIPS, and 13.1.37.279 for 13.1-FIPS and 13.1-NDcPP. Because these appliances sit on the internet edge, patching alone is not enough: preserve logs, look for unexpected files and configuration changes, and treat any unpatched, internet-facing NetScaler as potentially compromised.
🟠 HIGH (5)
Joomla UP plugin CVE-2026-97163 rated CVSS 10.0 allows unauthenticated code installation Confirmed
CVE-2026-97163, published on 26 September, is an unauthenticated remote code installation flaw in the lomart.fr UP extension for Joomla, present in versions 5.0.0 to 5.2.0 and 6.0.0 to 6.0.29 and scored 10.0. The extension mishandles access control and path handling, so anyone who can reach a site running an affected version can install and execute code with the web server’s privileges, with no login and no user interaction. No exploitation has been confirmed, but Joomla extensions of this kind are routinely scanned and attacked at scale once a CVE is public. Update to a fixed release or uninstall the extension, and where it has been internet facing, review administrator accounts, template files and recently changed PHP files for tampering.
Sources CVE Brief|CVEfeed (NVD record)
WordPress plugin Ultra Addons for Contact Form 7 CVE-2026-82901 has a public exploit Confirmed
CVE-2026-82901 is an unauthenticated arbitrary file upload in the Ultra Addons for Contact Form 7 WordPress plugin, rated 9.8, caused by weak file type validation in the mail components function when the PDF Generator module is enabled. Affected versions run up to and including 3.5.50, and a public proof of concept exists, which puts unpatched sites on a short clock: an uploaded file can be turned into remote code execution on the host. Update to 3.5.51 or later, or disable the PDF Generator module until you can, and check upload directories and web server logs for unexpected executable files and POST requests to the plugin’s endpoints.
Sources CVE Brief
Froxlor hosting panel patches three critical flaws up to CVSS 9.9 Confirmed
Froxlor, the server management panel widely used on shared and reseller hosting, disclosed three critical vulnerabilities fixed in version 2.3.12. CVE-2026-100717 and CVE-2026-100716 are both 9.9, and the top issue is a CRLF injection where a low-privileged authenticated user can smuggle newline characters into the userinfo part of a URL during subdomain creation, injecting arbitrary web server configuration directives that are then processed with root privileges. That turns ordinary customer-level access on a hosting box into root on the host: arbitrary file reads, traffic hijacking or full remote code execution. CVE-2026-100714 is rated 9.1. Hosting providers running Froxlor should update to 2.3.12 or later now, review generated web server configuration files for unexpected directives, and restrict who can create subdomains until the patch is applied.
Sources CVE Brief
hMailServer CVE-2026-100741 allows unauthenticated remote code execution Confirmed
CVE-2026-100741 is an eval injection flaw in the JScript event script dispatcher of hMailServer, rated 9.8 and fixed in version 6.3.4. Affected builds are 6.0.0 through 6.3.3, and an unauthenticated attacker can execute arbitrary JScript with the mail service account’s privileges by injecting payloads into password fields or protocol responses when the vulnerable JScript handlers (OnClientValidatePassword, OnExternalAccountDownload, OnDeliveryFailed) are in use. That is full control of the mail server and a useful pivot into the internal network. Upgrade to 6.3.4, or switch those handlers to VBScript, or remove them, and review mail logs for authentication attempts containing backslashes and apostrophes.
Sources CVE Brief
Arizona court system confirms intruders copied personal data on many residents Under investigation
Arizona’s Supreme Court said the state court system was targeted by criminal hackers or automated bots that copied personally identifiable information belonging to many Arizonans, and notifications are under way. Officials have not said which courts or databases were reached, and the FBI is assisting. The detail residents fear most is that people with protective orders or domestic cases may have had addresses or location data exposed, since those records are exactly the kind that can put someone at physical risk. This is a reminder for any organisation holding court, case management or order records to review who can query them, log those queries and test whether bulk exports are silently possible.
🟡 MEDIUM (5)
miniOrange OTP Login plugin CVE-2026-85984 bypasses WordPress authentication Confirmed
CVE-2026-85984, rated 9.8, is an authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin affecting versions up to and including 5.5.5. A missing guard in the login function means an unauthenticated attacker can authenticate as an administrator by supplying a username with the plugin’s login intent parameter, with no password and no valid one time code, when the affected configuration is in place. That is complete site takeover. Update to 5.5.6 or later, or deactivate the plugin, and check for unexpected administrator accounts and logins from unfamiliar addresses.
Sources CVE Brief
Kyverno CVE-2026-100706 lets a namespace tenant escalate to cluster admin Confirmed
CVE-2026-100706 is a 9.9 severity flaw in Kyverno, the Kubernetes policy engine, fixed in 1.19.1. Validation of the apiCall urlPath in policies is incomplete, so an authenticated user with only namespace level access can use percent-encoded traversal sequences to make requests as the admission controller service account, sidestepping namespace clamping and reaching cluster administrator rights. Any cluster where tenants are trusted to write Kyverno policies is affected. Upgrade to 1.19.1, limit who may create or modify policies in the meantime, and review audit logs for the admission controller service account doing things it should not.
Sources CVE Brief
Obot AI agent platform ships with authentication disabled and an MCP access control bypass Confirmed
Two vulnerabilities affect Obot, an open source AI agent and MCP platform. CVE-2026-101065 (CVSS 9.8) is a deployment problem rather than a coding bug: the Docker quickstart command documented in the project README starts the container listening on all interfaces with authentication disabled, and with authentication off every request is mapped to a synthetic user holding Owner and Admin roles, so anyone who can reach the port has full administrative control of the API and UI. CVE-2026-101084 (CVSS 9.6) is an authorization bypass on the MCP connect endpoint in versions before v0.21.1, letting any authenticated user connect to restricted MCP servers using stored OAuth credentials and reach backend systems behind them. If you run Obot, bind it to localhost or put it behind authentication, upgrade to v0.21.1 or later, and review which credentials the platform holds.
Seetong cameras rated CVSS 10.0 with a public exploit and no vendor response Confirmed
CVE-2026-100886 affects Seetong T8108, T8108P, T8116 and T8232 cameras on build 4.6.1.4-build202604241011. The flaw is improper authentication in the debug service, CVSS 10.0, reachable over the network and with exploit code already published, and the researcher says the vendor was contacted early and never replied. These are consumer and small business IP cameras, so the practical exposure is whatever they can see and whatever network segment they sit on. If you cannot patch (there is no fix), remove them from the internet, isolate them on a separate VLAN with no route to management networks, and block inbound access to the debug service at the firewall.
Sources NVD
Bitget attacker starts laundering funds through CoinJoin as withdrawals restart Confirmed
The attacker behind the Bitget wallet compromise has begun obfuscating the proceeds. AMLBot traced a route from a Bitget linked TRON wallet through USDT0, Ethereum and THORChain into roughly four bitcoin that then entered a Wasabi CoinJoin round, and it blacklisted the addresses involved. Bitget has revised the total taken to about $387.5 million, up from $351.6 million, after adding Zcash and TRON transfers to the accounting, and says the flaw was a compromised backend system that spoofed transaction data rather than stolen private keys. Withdrawals resume in phases from 28 September, starting with bitcoin, and the CEO has pointed to IP addresses and on-chain patterns consistent with a North Korea linked group, which remains an unconfirmed attribution. Exchanges and compliance teams should treat the listed addresses as tainted and watch for deposits from the CoinJoin outputs.
Sources CoinDesk|CryptoNews (AMLBot tracing)|CoinNews (withdrawal schedule)
⚪ WATCH (4)
Wireshark 4.6.9 fixes 19 vulnerabilities in the network analysis tool Confirmed
Wireshark 4.6.9 was released on 27 September, fixing 19 vulnerabilities and 16 bugs. No exploitation has been reported, but packet analysers parse hostile input by design, so a malformed capture or live stream can crash the tool and, in some classes of dissector bug, do worse. Security teams that keep Wireshark on analyst workstations and in incident response kits should roll the update out on the usual cadence rather than waiting for a quarterly refresh.
Sources SANS ISC
The sandbox escape series continues as Cloudflare's Containers flaw is published Confirmed
Cloudflare published a joint write-up with researchers from Accomplish on a cross-tenant data exposure flaw in Containers and Sandboxes, reported on 4 September and fixed across the fleet by 19 September. A Workers Paid account could recover residual disk blocks left behind by other customers’ containers on the same host, including directory structures, database pages and complete SQLite databases, because thin provisioning was configured to skip zeroing reused blocks. Cloudflare says there is no evidence anyone else used the technique, and customers need to do nothing. The wider point is the pattern: the same researchers describe this as their sixth published sandbox or isolation escape since July, following work on agent and coding tool sandboxes at Anthropic, Cursor, Docker and OpenAI. Anyone running untrusted, agent generated code on shared infrastructure should assume isolation is a control to be tested, not a guarantee.
Sources Accomplish|Cloudflare|Decrypt
Bitcoin quantum research moves from theory toward logistics Confirmed
Three separate developments this week moved the quantum risk to bitcoin out of the purely theoretical column: a reported cost breakthrough for the required hardware, a new privacy oriented design that would change how addresses are used, and a custody playbook for migrating holdings. Q-Day remains hypothetical, and no working attack exists against bitcoin’s signature scheme today. For organisations holding digital assets, the useful action now is inventory: know which wallets use exposed address types, who holds the keys, and how a migration would be executed if a hard deadline ever appeared.
Sources Decrypt
SEC staff guidance says token buybacks do not by themselves create a security Confirmed
New SEC staff guidance says announcing a token buyback on a functioning network is not a promise that turns the token into a security, a position one attorney described as making securities law look opt-in. No technology is affected and no attack is implied here; it matters to crypto businesses and their advisers because buyback programmes are a common way projects support a token price, and the compliance reading of when that crosses a line has just shifted. Teams planning or running such programmes should have counsel re-read the guidance against their specific structure before acting.
Sources Decrypt
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.