kyber.today

daily cyber × ai intelligence

← index

tagged

[watchtowr]

8 editions · 9 items

October 9, 2026

  • Citrix shipped a fix for CVE-2026-107406, another unauthenticated RCE in NetScaler on the same SAML code path as two flaws exploited in the wild over the past month (Kevin Beaumont), who adds that Citrix patched its hosted cloud offering the same day and then marked it not vulnerable. Separately, watchTowr published the aftermath of CVE-2026-88771 exploitation it has tracked for 11 days — backdoors through bulk credential theft — with hunting IoCs (watchTowr) (earlier coverage). · Vulnerabilities & Exploitation
  • Atlassian CVE-2026-21589 exploitation now has numbers: Previdian honeypots logged 190 attempts from 32 IP addresses in 10 countries as of 8 October, starting hours after watchTowr's PoC on 6 October; CISA has not added it to KEV. The dangerous path is Jira integrated with Crowd, where the readable config file holds plaintext Crowd application credentials (SecurityWeek). @vuln_tracker notes the fixed builds are Confluence 9.2.26 and Bitbucket 9.4.26 / 10.2.8 / 10.5.1, with a Tomcat RewriteValve rule as a stopgap (earlier coverage). · Vulnerabilities & Exploitation

in Third NetScaler RCE in a Month Lands on the Same SAML Surface

October 3, 2026

  • Citrix NetScaler exploitation has resumed against patched appliances. Citrix published guidance covering a newly observed security issue in customer-managed deployments using SAML authentication with Gateway or AAA functionality, flagging configurations containing add authentication samlAction or add authentication samlIdPProfile patterns (Citrix). Kevin Beaumont reported patched 13.1 and 14.1 honeypots crashing from multiple source IPs with nsaaad process restarts, and one honeypot running a downloaded malware binary — on a box without even a valid SSL certificate, indicating indiscriminate spraying (@GossiTheDog). watchTowr Labs says it has now successfully reproduced the vulnerability, having initially been unclear whether this was "DoS via bad patch" or another SAML bug (watchTowr). Beaumont notes the support-provided mitigations don't appear to work and admins are resorting to firewall-blocking known threat-actor IPs (@GossiTheDog). This continues the CVE-2026-88772 thread (earlier coverage). · Edge Devices Under Fire

in NetScaler Round Two: Patched Appliances Crashing Again as a New SAML Bug Gets Reproduced

July 18, 2026

  • "wp2shell" pre-auth RCE in WordPress core chains CVE-2026-63030 (REST /batch/v1 route-confusion SQL injection) and CVE-2026-60137 (author__not_in SQLi in WP_Query) to unauthenticated code execution on WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1, per reporter searchlight cyber/assetnote (SL Cyber, Rapid7, The Hacker News). A public PoC and a non-destructive detector + Docker lab are already out; watchTowr says it is "rapidly reacting" across its client base. Patch to the fixed releases immediately per the WordPress advisory. · Vulnerabilities & Exploits

in A Pre-Auth RCE Lands in WordPress Core, Proof-of-Concept and All

July 11, 2026

  • Progress Software emailed ShareFile customers urging them to immediately power down Windows servers running Storage Zone Controllers after identifying a "credible external security threat," and has temporarily disabled affected accounts. watchTowr says it is tracking rumors of active zero-day exploitation against exposed on-prem controllers and has notified clients with internet-facing instances. Treat any exposed Storage Zone Controller as potentially compromised. The Hacker News, BleepingComputer · Vulnerabilities & Exploits

in Progress Orders ShareFile Storage Controllers Offline Over Active Zero-Day Threat