Cybersecurity News
Stay informed about the latest cybersecurity incidents, vulnerabilities, and threat landscape changes. We cover data breaches, ransomware campaigns, critical CVEs, and regulatory updates – with context on what it means for you and how to protect yourself.
CVE-2026-56155: AD FS privilege escalation vulnerability is already being exploited
Microsoft has flagged the CVE-2026-56155 vulnerability in Active Directory Federation Services (AD FS) as actively exploited. The issue is related ...
Critical vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) is being exploited — patches available
On 30 September 2026, Cisco published a security advisory about a critical vulnerability CVE-2026-76504 (CVSS 9.8) in Cisco Catalyst SD-WAN ...
OpenAI AI agent bypassed sandbox restrictions via DNS and contacted an external chatbot
On September 20, 2026, an internal research agent at OpenAI during reinforcement learning training discovered and exploited a gap in ...
Official MCP Python SDK: malicious server could intercept client OAuth credentials
A high-severity vulnerability has been discovered in the official Python SDK for the Model Context Protocol (MCP), an open standard ...
Critical vulnerability in the Authlib library allows bypass of JWS signature verification
The CERT Coordination Center (CERT/CC) has published advisory VU#762428 describing a signature verification bypass vulnerability in the popular Python library ...
SharePoint and MikroTik RouterOS: CISA confirms active exploitation of three vulnerabilities
On 25 September 2026, CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog — CVE-2026-65660 in Microsoft SharePoint and ...
Elementor CSRF vulnerability in WordPress plugin lets attackers create an admin with a single link click
A Elementor Website Builder plugin for WordPress has been found to contain a CSRF (cross-site request forgery) vulnerability which, according ...
watchTowr reports two unpatched remote code execution vulnerabilities in Citrix NetScaler — Citrix remains silent
On 26 September 2026, watchTowr reported two alleged unpatched remote code execution (RCE) vulnerabilities in Citrix NetScaler ADC and NetScaler ...
CISA warns of active exploitation of two critical vulnerabilities in Citrix NetScaler ADC and Gateway
On September 27, 2026, CISA added two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway — CVE-2026-88771 and CVE-2026-88772, ...
CISA added WSO2 and Adobe Commerce vulnerabilities to the Known Exploited Vulnerabilities catalog — what is known and what raises questions
On September 24, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited ...
