[f5]

September 24, 2026

• F5 BIG-IP APM CVE-2026-94127 gets its root cause. watchTowr diffed the hotfixes and found the patch simply adds size checks on the OAuth Authorization header — an oversized header drives an unauthenticated heap overflow to RCE, and only deployments where APM acts as an OAuth authorization server are affected (watchTowr Labs). F5 confirmed exploitation in the wild in its 22 September advisory; CERT-SE has issued a Swedish-language alert calling it critical and unauthenticated (CERT-SE) and CERT-EU urges immediate action (CERT-EU 2026-013) (earlier coverage). · Vulnerabilities & Exploits
• CERT-DK says AI bug hunters have produced a record year for patches (CERT.dk) — a trend watchTowr frames from the defender's side in its F5 write-up, warning that LLM-generated "slop" payloads showing up in access logs are not evidence of exploitation. · AI-Enabled Threat Activity

in The Exploit Is Public, the Ubuntu Patch Isn't

September 23, 2026

• F5 BIG-IP APM CVE-2026-94127, a heap overflow, joined KEV alongside both Check Point flaws and VeloCloud; the federal BOD 26-04 remediation date is 25 September (CISA). · Exploited in the Wild

in Attack Chains That Run Themselves

September 10, 2026

One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

BlueMoon exploit kit chains Chrome and Windows zero-days within days of patch publication, with four suspected China-linked espionage groups weaponizing the same toolkit on US and Southeast Asian targets from late August onward. Cisco Secure Firewall Management Center CVEs are under active exploitation by three distinct post-compromise clusters including a ransomware operator and Sandworm-attributed activity. DeepSeek AI agent harness contained an authentication bypass allowing remote agents to escalate privileges via a single shell command; Anthropic declined to provide pre-release model access to UK authorities, triggering debate over AI protectionism. Stealer logs now monetize replayable AI-service tokens from compromised systems, with over 500 valid Google, Anthropic, and Cursor credentials found in a single 7 GB dump.

June 20, 2026

• F5 shipped out-of-band fixes for two critical NGINX Open Source RCE flaws, including CVE-2026-42530 (CVSS 9.2), a use-after-free in the HTTP/3 QUIC module triggerable by a remote unauthenticated attacker. No exploitation reported yet, but the QUIC path warrants prompt patching. The Hacker News, CVE · Vulnerabilities & Exploits

in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

June 19, 2026

• F5 shipped out-of-band patches for two critical NGINX Open Source flaws, including CVE-2026-42530 (CVSS 9.2), a use-after-free in the HTTP/3 QUIC module (ngx_http_v3_module) that a remote unauthenticated attacker can trigger for code execution (The Hacker News, BleepingComputer). · Vulnerabilities & Exploits

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk