CyberWatch Newsroom Live Intel

Critical CVE-2026-88771 Help Net Security

2026-10-04 Help Net Security

Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data A flaw in Titan, an internal Microsoft analytics service, could have let an attacker read employee records and Bing search analytics, a 16-year-old security re…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-104286 Help Net Security

2026-10-02 Help Net Security

Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)

Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway. Fortinet says the flaw has been reported to be exploited in the wild, and urges customers to apply the workaround it shared until fixes are available. About CVE-2026-104286 “An Improper Limitation of a Pathname to a…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-10-01 Help Net Security

AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

An agentic AI-powered attack that hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21 exploited two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system. “Used together, [the two flaws] allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-76504 Help Net Security

2026-10-01 Help Net Security

New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)

For the fifth time this year, Cisco revealed attackers have exploited a vulnerability (CVE-2026-76504) in its SD-WAN solution in zero-day attacks. The vendor’s incident responders became aware of active exploitation of this vulnerability in September 2026, after getting pinged and resolving a Cisco Technical Assistance Center (TAC) support case. Cisco has ye…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-10-01 Help Net Security

Sentinel Envelope Plus adds software protection without source code changes

Thales has announced Sentinel Envelope Plus, a new addition to its Sentinel Envelope software protection solution that significantly hardens compiled applications against AI-assisted reverse engineering, automated zero-day vulnerability discovery, and automated exploit generation. Sentinel Envelope Plus applies multiple layers of protection to software appli…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-88772 Help Net Security

2026-09-30 Help Net Security

Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)

“Advanced and suspected state-sponsored threat actors” are likely to be behind the initial targeted intrusions that leveraged CVE-2026-88772, one of the two recently disclosed NetScaler vulnerabilities that have been exploited as zero-days, says Mandiant CTO Charles Carmakal. Mandiant and Google Threat Intelligence Group (GTIG) know of dozens of impacted org…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-88771 Help Net Security

2026-09-29 Help Net Security

NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

The hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated. What started as stealthy targeting via zero-day exploits has now become widespread “spray and pray” exploitation, fueled by the publication of a root-cause analysis and a proof-of-concept exploit for CVE-2026-88771, which is remotely exploitable on unpatch…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-28 Help Net Security

FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day

The FBI’s online portals for job applicants (at apply.fbijobs.gov) and special agent applicants (at fbijobs.gov/special-agents) are still unavailable, following what appears to be successful compromises by the ShinyHunters cyber extortion group. Last week, the United States’ domestic intelligence and security service confirmed it was investigating ShinyHunte…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-88771 Help Net Security

2026-09-28 Help Net Security

Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices. Rumors about their existence and active exploitation popped up on Reddit on Friday, fueled by warnings from IT suppliers, w…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-24 Help Net Security

What to do first when you get 90 days to secure AI agent data

In this interview with Help Net Security, Kelly Herrell, CEO at Nol8, explains where AI agents create exposure inside organizations. The first thing to examine is the data path: what an agent can reach, what enters its context, and where results go. Ticketing systems, CRM platforms and shared drives hold years of sensitive context that agents can pull togeth…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-23 Help Net Security

DarkMe RAT trades zero-days for plain phishing emails

DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been simplified: instead of leveraging zero-day exploits, attackers are betting on a simple email to convince targets to run it …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-93616 Help Net Security

2026-09-23 Help Net Security

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026. The company also confirmed that a pre-authentication remote code execution (RCE) vulnerability (CVE-2026-85102) in Check Point (Quantum) Security Gateway for which it released patc…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-22 Help Net Security

Somewhere in your traffic logs, a bot is doing more than looking

Akamai has watched verified AI crawlers, ChatGPT among them, move from reading web pages to sending high-frequency POST requests. In a 30-day analysis of its global customers, ecommerce accounted for 44.8% of those AI bot POST transactions, and travel climbed to 30% in a single month. A GET request asks a website for a page. A POST request tells the site to …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-20 Help Net Security

Week in review: Cisco patches exploited email gateway 0-day, Revolut breach

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What we know about the Revolut data breach so far Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. The bank confirmed the incident on Saturday, September 12. DeepZero: Op…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-18 Help Net Security

98% of fraudulent hires have company credentials by the time they’re caught

A 90-day period between hiring and onboarding is creating a blind spot in enterprise identity security, according to HYPR’s State of HR Identity Fraud Detection report. “Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT,” said Bojan Simic, CEO of HYPR. “Human intuition is n…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-76460 Help Net Security

2026-09-17 Help Net Security

Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)

Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE). About CVE-2026-76460 Cisco ISE is an identity-based network access control and policy platform. It checks connecting users’ iden…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-87886 Help Net Security

2026-09-16 Help Net Security

Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)

A Linux privilege escalation vulnerability (CVE-2026-87886) affecting Acronis’ backup extensions for cPanel, WebHost Manager (WHM), and Plesk, is being leveraged by attackers, the backup and recovery company warns. “Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM dep…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-76461 Help Net Security

2026-09-15 Help Net Security

Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)

Attackers have leveraged a zero-day SQL injection vulnerability (CVE-2026-76461) to compromise Cisco Secure Email Gateway appliances, Cisco confirmed on Monday. The vendor’s Product Security Incident Response Team became aware of active exploitation of this vulnerability in September 2025, and has shared indicators of compromise that organizations can look f…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-14 Help Net Security

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

The EU Agency for Cybersecurity switched on the Cyber Resilience Act‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporting obligations started binding manufacturers. ENISA built the tool and runs its day-to-day operations, a job Article 16(1) of the CRA hands to the agency. Anyone placing a product with digital elements on the EU…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory