Hackers are actively exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall. The flaw, tracked as CVE-2026-106931, affects the statistics feature and allows attackers to execute commands with root or SYSTEM privileges. SiteGuard, a Japanese vendor protecting over 1.5 million websites, has confirmed the critical severity of the issue and noted…
Acting Federal CISO Michael Duffy presented four key priorities for the CISO Council at the ACT-IAC Cybersecurity Summit. The first priority focuses on reducing cyber exposure by removing outdated infrastructure and accelerating remediation of known exploited vulnerabilities. The second priority emphasizes operational resilience through government-wide tabletop exercises to ensure critical missions continue during breaches. The…
ConnectWise has suspended access to its Cloud Backup service after hackers exploited application identities to breach customer environments. The attack, which began on October 15, allowed unauthorized access to Microsoft 365 tenants by abusing existing service principal permissions. Security firms Huntress and Todyl confirmed that attackers used automated scripts to sign in, bypassing multi-factor authentication…
Research · 16 October 2026 · Image: Zscaler Zscaler’s ThreatLabz has published an analysis of CVE-2026-88771, a critical remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway that carries a CVSS v3.1 score of 9.8.
October 14, 2026 TL;DR The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
A China-linked threat actor known as Armory Castle exploited a BeyondTrust vulnerability as a zero-day starting in August 2026. The flaw, identified as CVE-2026-102764, allowed attackers to perform file operations on Remote Support appliances. Mandiant and Google Threat Intelligence Group observed the group deploying custom tools to gain root access and exfiltrate sensitive documents. BeyondTrust…
Google warned on October 15 that organizations should prepare for widespread exploitation of a new bug in BeyondTrust remote support appliances. The vulnerability, identified as CVE-2026-102764, allows unauthenticated attackers to gain host-level control and access stored credentials. Mandiant found evidence that the suspected Chinese state-sponsored actor Armory Castle exploited the flaw in late August. The…
Publish Date October 16, 2026 The National Institute of Standards and Technology (NIST), National Security Agency’s Super Intelligence Security Center (NSA SISC) and Cybersecurity and Infrastructure Security Agency (CISA) published .
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first.
Publish Date October 16, 2026 CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections.