The flood of new CVEs can make it hard to know what matters. But there are tools to help find our way.

Last Updated: 2026-09-29T14:53:55Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 There’s also an associated blog post. Affected Versions Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279 Indicato...

Last Updated: 2026-09-27T15:49:52Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Vulnerability Severity (CVSS 4) Preconditions CVE-2026-88771 9.5 None CVE-2026-88772 9.5 DTLS config enabled (enabled by default on VPN) CVE-2026-88773 9.3 HTTP Configuration enabled CVE-2026-88774 7.0 Any policy with HTTP URL-based expression CVE-2026-88775 8.8 ADC or Gateway configured as Gateway/A...

Last Updated: 2026-09-26T23:22:28Z (UTC) What’s Happening On 2026-09-26T07:00:00Z (UTC), a Reddit posts in the Citrix community indicated that the presence of two 0-day vulnerabilities in Citrix Netscaler devices. The poster was apparently advised to shut down external devices. Research firm WatchTowr corroborated the report, as did researcher Kevin Beaumont. Both Beaumont and WatchTowr doubled down on the claim later in the day. WatchTowr, while unable to confirm sourcing, stated t...

A not-for-profit organization dedicated to the teaching of best practices in cyber threat intelligence, and the mutual sharing of timely, actionable, and relevant intelligence among the community.

Last Updated: 2026-09-22T22:18:11Z (UTC) Arista published a security advisory today regarding its VeloCloud Orchestrator. The perfect-10 CVSS vulnerability: …may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Yes, it “may” indeed. It’s now confirmed exploited and on CISA’s KEVs as of today. Ther...

Last Updated: 2026-09-22T20:36:25Z (UTC) What’s Happening A F5 advisory published 2026-09-22 details CVE-2026-94127 (CVSSv3 9.8). When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). It is unknown how common this configuration is as of this writing. Affected Products/Versions The affected product is BIG-IP APM (Access Policy Manager), versions: 21.1.0, patched in Hotfix-BIGIP-21.1.0...

Last updated: 2026-09-22T19:41:29Z (UTC) CVSSv3: 9.8 What’s Happening In what’s-old-is-new-again news, two CVEs were released today for Checkpoint Security Gateway management toolsets, including a pre-auth remote code execution and a path traversal in the management web service. Here are Check Points internal support center details: Since I started writing this Check Point posted notification of exploitation on their blog. Actions Check the advisories above for affected versions and o...

Ogham daily oracle. The gooseberry hides its sweetest fruit behind a cage of thorns — a cache protected by pain. The reward exists, but i... Try all 7 divination systems free.

Last Updated: 2026-09-18T12:35:00Z (UTC) What’s Happening According to the Rust language security response working group, maintainers of rust-lang (the repo comprising the Rust language itself) and popular packages (crates) are being targeted by social engineering attacks intended to compromise the repository. Per the post: A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that’s used as a vector to either g...

The Independent Federated Intelligence Network

Hey folks, Been tracking the Blackfile passkey/mfa campaign for weeks or months now. Saw a recent listing from Unit42 that was missing a few domains I have, and had a few domains I missed. blackfile_0909 is the 32 domains I’ve got with high confidence they’re part of the ongoing Blackfile campaign. blackfile_adjacent is dozens more domains seen on the same/similar infra that look shady enough to block ASAP. blackfile_adjacent_0909.csv (155.5 KB) blackfile_0909.csv (59.5 KB)