A pre-authentication code execution flaw in F5 BIG-IP APM has been exploited since March. Sophos published an implant that survives upgrade images, and 795 devices were still exposed on 7 September.
5 min read
Microsoft fixed an Exchange authentication bypass on 11 August. Working exploit code is now circulating, and the flawed endpoint sits on servers that answer the whole internet because that is how staff get their mail.
4 min read
A CVSS 10.0 flaw let unauthenticated attackers run workflows as root on reachable Kestra servers. Microsoft assesses it was exploited the same month it was disclosed, and CISA cataloged it ten weeks later.
5 min read
SonicWall says both new SMA1000 flaws are being exploited. The entry point is a CVSS 10.0 bug in the internet-facing portal that needs no credential, and it is the second of that shape since July.
5 min read
JFrog's own advisory says an unauthenticated attacker with network access could obtain administrative privileges. Four days after the patch shipped, a research firm reported seeing exactly that.
5 min read
PaperCut told customers on 27 August that a vulnerability in NG and MF was being exploited. Before there was a CVE or a build for every branch, the instruction was to restrict the web interface to trusted addresses.
5 min read
TeamCity CVE-2026-63077 is under active exploitation. JetBrains says internet-facing servers should restrict external access and limit reachability to trusted networks.
5 min read
Cisco says CVE-2026-20349 has no workaround. Its own firewall guidance still shows that organizations can restrict who reaches the VPN service.
4 min read
An Akira affiliate entered through an exposed SSL VPN with valid credentials and no MFA. EDR later mattered, but only after the attacker was already inside.
4 min read