Daily News
Spectre v2 Branch Target Reuse vulnerability
Researchers disclosed a new Spectre v2 Branch Target Reuse vulnerability on September 29 that lets an attacker recover a Linux system’s root password hash in minutes, on a fully patched Intel machine, by abusing a gap between how CPUs and just-in-time compilers handle recycled memory. The flaw touches Intel, AMD and Arm processors alike, and…
Read MoreSalesforce Agentforce AI Agent Vulnerability
A Salesforce Agentforce AI agent vulnerability, publicly disclosed September 24 by research firm Zenity Labs under the name “SalesBleed,” let an attacker plant a hidden instruction in an ordinary sales lead form and later exfiltrate CRM data with zero clicks, once an employee simply asked their AI agent to look at the newest lead. Salesforce…
Read MoreCitrix NetScaler unauthenticated RCE vulnerability
Citrix confirmed on September 27 that a Citrix NetScaler unauthenticated RCE vulnerability, tracked as two separate CVEs, was already being exploited in the wild before any patch existed. CVE-2026-88771 lets an attacker with no credentials run arbitrary commands on any NetScaler ADC or Gateway appliance in a vulnerable version, default configuration included. Its sibling flaw,…
Read MoreArista VeloCloud Orchestrator vulnerability
An Arista VeloCloud Orchestrator vulnerability, CVE-2026-93952 (CVSS 10.0), lets an attacker reach privileged internal functions on the on-premises controller for an entire SD-WAN fabric without any credentials at all. Arista confirmed active exploitation and shipped a patch on September 22. This is the second maximum-severity CVE in this exact product line in 2026, after the…
Read MoreEU Cybersecurity Incident Response Gaps Exposed
A new European Court of Auditors report finds serious EU cybersecurity incident response gaps at the very top of the escalation ladder: no EU member state has ever formally classified a cyber incident as “large-scale,” the tier that triggers cross-border EU crisis coordination, since that classification system existed from 2016. Not WannaCry. Not NotPetya. Not…
Read More