The Debrief

First Contact 27 September 2026

NetScaler zero-days: attacked for weeks before Citrix named them

NetScaler appliances were being attacked before Citrix named the flaws on 27 September. Until that bulletin landed there was no build list, no patch and no indicators, only advice to power them off.

5 min read

First Contact 27 September 2026

SharePoint CVE-2026-65660: Microsoft called it spoofing, it was code execution

A SharePoint flaw shipped as a moderate spoofing issue in August. Six weeks later it was exploited as remote code execution. It needed any account and a server that would answer.

5 min read

First Contact 23 September 2026

F5 BIG-IP APM CVE-2026-94127: a zero-day in the OAuth server itself

F5 disclosed an unauthenticated code execution flaw in BIG-IP APM on 22 September and confirmed it was already exploited. The affected configuration is the one acting as an OAuth authorization server.

5 min read

Threat Landscape 21 September 2026

Your security stack cannot outpace an AI attacker

AI agents scan, find and exploit exposed systems around the clock. Patching, MFA and detection engage after the first contact. Nothing you run today closes that gap alone.

7 min read

First Contact 20 September 2026

Eight Latin American governments, one unnamed Exchange flaw

ESET says a China-aligned espionage group reached governments across Latin America by exploiting publicly reachable Exchange servers. No CVE was named. The first step was still reachability.

5 min read

First Contact 18 September 2026

WSO2 CVE-2026-5430: forged admin tokens, four months after the patch

WSO2 patched a pre-authentication JWT bypass in May. On 13 September, watchTowr reported forged administrator tokens arriving at its honeypot network. The four months in between were a reachability problem.

5 min read

First Contact 16 September 2026

Eight scripts fingerprinted the SSL-VPN before any exploit ran

An attacker's own open directory exposed an intrusion at a Thai broadband provider, including eight scripts written to fingerprint one SSL-VPN appliance running firmware older than the flaw aimed at it.

5 min read

First Contact 13 September 2026

Palo Alto scored one flaw twice, and reachability was the variable

An unauthenticated PAN-OS flaw gives root on hardware firewalls, with no workaround. The advisory scores it lower where the management interface answers only trusted addresses.

5 min read

First Contact 9 September 2026

Cisco Secure FMC CVE-2026-20079: root on the box that writes firewall policy

Cisco Talos tied real intrusions to remote access against Secure FMC. The management interface had a smaller legitimate audience than the internet.

5 min read