60
60
60
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.
25
60
60
60
60
60
60
60
60
57
60
Alert: Juniper Firewalls, Openfire, and Apache RocketMQ Under Attack from New Exploits
60
60
60
60
60
60
60
Critical Citrix NetScaler bug fixed, upgrade ASAP! (CVE-2025-5777)
60
60
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips
60
Citrix Patches Three Zero Days as One Sees Active Exploitation
60
60
Critical NetScaler Vulnerability Exploited in Attacks
CISA added critical Citrix NetScaler flaw CVE-2026-19490 (CVSS 9.3) to its KEV catalog after confirming exploitation of gateway and AAA virtual servers in the wild.
CISA warned that threat actors are exploiting CVE-2026-19490, a critical-severity flaw (CVSS 9.3) affecting NetScaler ADC and NetScaler Gateway appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix patched the bug on August 19, and Rapid7 warned it is remotely exploitable without authentication. Sensor data from Previdian shows exploitation ongoing since at least September 3, one day after a public exploit appeared on GitHub, with matching requests observed from three IPs across three countries. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies three days to patch under BOD 26-04.
90
60
60
60
60
60
60
60
Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks
60
Week in review: 300k+ Plex Media Server instances still vulnerable to attack, exploited Git RCE flaw
60
Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw
60
60