Stay updated with the latest cybersecurity news. This roundup covers actively exploited zero-days, major crypto theft, enterprise software flaws now in CISA’s Known Exploited Vulnerabilities catalog, WordPress and webmail takeovers, and a rare cloud isolation failure — all from the past few days.
1. Citrix Confirms Two NetScaler RCE Zero-Days Under Active Exploitation
Published: 2026-09-27
Citrix confirmed that two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway — CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5) — were exploited as zero-days before patches were public. CVE-2026-88771 is an unauthenticated command-execution bug that affects every deployment on vulnerable versions, including default configurations; CVE-2026-88772 is a memory-overflow issue that can lead to RCE or denial of service when DTLS is enabled (on by default for VPN virtual servers).
2. Bitget Reports ~$352M Wallet Drain; North Korea Suspected
Published: 2026-09-25
Cryptocurrency exchange Bitget said attackers moved about $351.6 million from portions of its hot and warm wallets on September 24 after a backend compromise that spoofed transfers rather than stealing private keys. CEO Gracy Chen said investigator-identified IP and VPN patterns resemble prior North Korean activity; withdrawals were frozen while Mandiant and SlowMist assist, and later on-chain accounting pushed some tallies higher as additional chains were included.
3. CISA Flags Actively Exploited SharePoint RCE and MikroTik RouterOS Flaws
Published: 2026-09-26
CISA added Microsoft SharePoint CVE-2026-65660 and a MikroTik RouterOS flaw to its Known Exploited Vulnerabilities catalog after evidence of in-the-wild attacks. The SharePoint issue was upgraded from a lower-severity spoofing rating to an 8.8 remote code execution path; federal civilian agencies face a short patch deadline (September 28 for the SharePoint KEV item in some reporting).
4. ShinyHunters Resume PeopleSoft Attacks With a WAF Bypass
Published: 2026-09-26
Google and multiple incident reports say ShinyHunters-linked operators are again mass-exploiting Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8), an unauthenticated remote code execution bug, using URL-encoding tricks to slip past WAF rules that many defenders thought had contained the wave. Successful attacks have been used to drop web shells and steal data across multiple sectors.
5. Elementor CSRF Flaw Lets Attackers Create WordPress Admin Accounts
Published: 2026-09-25
A high-severity CSRF bug in Elementor Website Builder 4.3.0 and 4.3.1 (tracked in some reports as CVE-2026-62062) disabled WordPress REST CSRF/nonce checks when a crafted string appeared in the request URI. An unauthenticated attacker who tricks a logged-in admin into opening a malicious link can create a rogue administrator and take over the site; the issue is fixed in 4.3.2.
6. Roundcube Pre-Auth SQL Injection Now Exploited in the Wild
Published: 2026-09-25
CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail versions before 1.6.16 and 1.7.1, is being actively exploited according to national CERTs and CISA-adjacent reporting. Attackers can inject SQL without logging in and expose credentials or escalate into code-injection follow-ons; patches have been available since May 2026, so remaining internet-facing instances are now easy targets.
7. Cloudflare Fixes Cross-Tenant Container Disk Exposure
Published: 2026-09-25
Cloudflare patched a Containers and Sandboxes isolation bug that let a Workers Paid customer recover residual disk data left by another customer’s container on the same physical host (tied to how thin-provisioned block devices handled zeroing). Cloudflare said it remediated the fleet and that customers do not need to take action, but the case is a reminder that multi-tenant “serverless” isolation can fail below the application layer.
8. ShinyHunters Deface Clop Leak Site via Grav CMS Path Traversal
Published: 2026-09-25
The Clop ransomware group moved its Tor leak site after ShinyHunters compromised and defaced the previous server. BleepingComputer reported the entry point as an unauthenticated path-traversal flaw in Grav CMS; Clop confirmed the prior host was taken over. The episode is unusual even by ransomware standards: one extortion crew using a CMS bug to hijack another crew’s leak infrastructure.
Bonus watch items from the same window
- Salesforce Agentforce “SalesBleed”: researchers disclosed zero-click / prompt-injection style weaknesses that could expose CRM data via agent workflows (September 25).
- Carbonato Docker worm: malware targeting unauthenticated Docker daemons on TCP 2375 to install an AI-agent stack and hunt for cloud/API keys (September 24).
- Kiteworks precautionary shutdown: the managed file-transfer vendor told customers to power systems down for several hours after threat intel of a possible imminent attack, with no confirmed compromise at the time of the advisory (September 25–26).
Stay Vigilant
Edge appliances (NetScaler, MikroTik), collaboration stacks (SharePoint, PeopleSoft, Roundcube), and WordPress plugins remain the fastest path from disclosure to mass exploitation this week. Prioritize internet-facing VPN/ADC gear, apply CISA KEV items first, rotate credentials after any PeopleSoft or webmail exposure, and treat AI-agent and container isolation bugs as first-class identity problems rather than novelty research. Subscribe for the next daily drop — the patch window on several of these is already measured in hours, not weeks.