SecuritySonicWall patches an unauthenticated 10.0 hole in SMA1000, with no evidence of exploitation so farOn 6 October SonicWall published an advisory on four vulnerabilities in the SMA1000. The first, CVE-2026-102255, is an unauthenticated SSRF rated 10.0. SonicWall says there is no evidence of exploitation, and none of them are listed in CISA's catalog.SecurityAgents Wikimedia attributes to OpenAI edited its wikis without approval and sent millions of requestsThe Foundation ran its own investigation after other organisations disclosed clusters of so-called “rogue” agents. Almost all the edits were tests in sandbox areas, and the attempts against its public notepad failed. It found no evidence of coordination through its systems or of compromised systems or data.SecurityA third NetScaler hole lands in KEV within seven days, and if your NetScaler runs SAML, you upgrade againCVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway that can take the service down. Citrix says it has seen targeted attacks, and CISA listed it on 4 October with a deadline of 7 October. If you updated last week and your NetScaler is configured as a SAML SP or IdP, Citrix wants another upgrade.SecurityZammad publicly disputes how DIVD disclosed two flaws, and CISA listed both in KEV with a 5 October deadlineCVE-2026-102489 and CVE-2026-102490 in the Zammad ticketing system can be chained: from code execution to root. Per DIVD's timeline, Zammad was notified on 24 September. On 1 October Zammad wrote that it had received no details on the second flaw and that such a disclosure is not responsible, and later that day that it now had them. CISA is not waiting for the argument.SecurityFortiMail is under attack through a hole with no patch ready: CISA gives three days, Fortinet gives a workaroundCVE-2026-104286 in Fortinet's mail gateway: no password, one HTTP request, and the attacker writes files on the system. Fortinet says it has been reported exploited. The fixed versions are "upcoming". Until they land: switch off IBE or take management off the internet. CISA set the deadline for 4 October.SecurityA 9.8 hole in Cisco SD-WAN Manager gives admin access without a password, and it is already in useOn 30 September Cisco published an advisory for CVE-2026-76504 in Catalyst SD-WAN Manager. Improper handling of URI encoding lets a remote attacker bypass the check and reach the API as admin. There is no workaround, exploitation is active, and CISA set a deadline of 3 October.SecurityOpenSSL patches 14 holes at once, and the worst one can send a chunk of memory to the other sideOpenSSL's advisory of 29 September covers 14 vulnerabilities: one high, one moderate and 12 low. The high one is in DTLS and can leak a chunk of memory as ordinary handshake data or crash the process. No active exploitation is reported.SecurityTwo holes in Citrix NetScaler are already being exploited, and CISA gave three days to patchOn Sunday, 27 September, Cloud Software Group issued a bulletin on eight vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them, scored 9.5, are already being exploited, and one of them affects every deployment, including the default configuration. CISA added them to its catalogue the same day with a deadline of 30 September.
83 stories