SecurityThree days after the patch, CISA confirmed attacks on the WordPress hole, along with SharePoint and MikroTikOn 25 September the catalogue of actively exploited vulnerabilities gained CVE-2026-87902 in the WordPress core, CVE-2026-65660 in SharePoint and CVE-2026-67279 in MikroTik's RouterOS. MikroTik comes with a catch: the versions that fix it carry an incomplete fix for another of the holes.SecurityA hole in Adobe Commerce and Magento entered the catalogue of actively exploited vulnerabilitiesOn 24 September CISA added CVE-2026-71362 to the KEV catalogue: incorrect authorisation in Adobe Commerce and Magento that can lead to privilege escalation without user action. The NVD record dates from 11 August. Adobe's bulletin did not open when we checked, so the facts rest on CISA and NVD.SecurityOpenAI gives Ukraine its vulnerability-hunting models to protect hospitals, power and telecomsOn 23 September OpenAI announced that the Ukrainian government gets access to the Daybreak programme for finding and fixing vulnerabilities. In the same announcement the company points to CERT Polska, which used its models to help find six holes in router software; per the Poles' own bulletin, it is MikroTik's.SecurityWordPress 7.1.2 closes a critical hole that can let outside code in without an accountThe urgent release of 22 September fixes CVE-2026-87902: an attacker with no password can make WordPress load a chosen PHP file from the server. With certain themes and server settings this can lead to remote code execution. The fix has been backported all the way to version 4.7.SecurityTwo holes in Check Point and one in Arista are being used in attacks, and part of on-premises Arista has no fix yetOn 22 September CISA added three critical vulnerabilities to its catalogue of actively exploited ones. Check Point confirms attacks and has patches for both of its own. Arista says the hosted versions of VeloCloud Orchestrator are already patched, while for customer-installed ones fixes exist so far only for some release trains.SecurityThree holes in the Linux kernel went onto the exploited list, and their fixes are months oldCISA added three kernel vulnerabilities already used in attacks on 18 September, with a deadline of 21 September. Their NVD entries date from September and October 2025 and June 2026. The problem is the machines that never got the fix.SecurityThree holes in one day on the exploited list: Cisco ISE, the Pixel modem and Acronis backup for cPanelCISA added three vulnerabilities already used in attacks on 16 September, with a patch deadline of 19 September. Closest to small business is the third - the backup plugin in hosting control panels.SecurityA hole in Cisco's email gateway gives root with a single email, and CISA gave agencies three daysCVE-2026-76461 is an SQL injection in the mail parsing of Cisco AsyncOS. It needs no account, does not depend on configuration and is already being used in attacks. There is no workaround, only the upgrade.
83 stories