N-able shipped an emergency hotfix for a maximum-severity flaw in its N-central platform on September 6, 2026. The N-able N-central vulnerability, CVE-2026-86218, is a pre-auth remote code execution zero-day rated a perfect 10.0 CVSS. N-able's incident notice says the flaw has been observed exploited in the wild. Why this matters N-central is a remote monitoring and management (RMM) platform used by managed service providers.

Researchers at watchTowr published a working exploit for a Citrix NetScaler RCE flaw this week. The bug, CVE-2026-8452, lets an unauthenticated attacker run code as root on the appliance. watchTowr released both the technical write-up and proof-of-concept code publicly. So, the barrier to attack just dropped sharply. Why It Matters NetScaler ADC and Gateway sit at the edge of thousands of enterprise networks.

TL;DR: A public proof-of-concept now targets CVE-2026-61511, a vBulletin preauth RCE. The bug lets an unauthenticated attacker run PHP on the server through a math-parsing flaw. vBulletin fixed it in version 6.2.2. Why This vBulletin Preauth RCE Matters vBulletin powers many high-traffic forums. This flaw needs no login and no user interaction. Therefore, any exposed 6.x board becomes a direct target.

TL;DR WordPress shipped 7.0.2 on July 17, 2026 to fix a critical flaw chain. The bug is a WordPress pre-auth RCE tracked as CVE-2026-63030, built on an SQL injection issue, CVE-2026-60137. Technical details and a working proof-of-concept are now public. Why it matters WordPress runs a large share of the web. Searchlight Cyber estimates over 500 million sites use it. This WordPress pre-auth…