Security news.
Today's cybersecurity landscape is marked by a flurry of critical patches and active exploitation alerts, particularly for enterprise networking and AI platforms. Multiple vendors, including Citrix, Atlassian, Splunk, and Cisco, have released urgent updates, while CISA warns of active exploitation against MLflow and Zimbra vulnerabilities. The increasing role of AI in both defense and offense continues to be a prominent theme, alongside ongoing concerns about Android malware and supply chain compromises.
Citrix Urges Immediate Patching for New NetScaler Flaws
Citrix has issued a warning to immediately secure systems against two critical vulnerabilities affecting NetScaler Gateway and NetScaler ADC, with exploitation expected for a critical authentication bypass.
CISA Warns of Active Exploitation in Critical MLflow Vulnerability
CISA has added a critical Server-Side Request Forgery vulnerability (CVE-2026-64849) in the MLflow open-source AI engineering platform to its KEV catalog due to active exploitation.
Critical Zimbra RCE Flaw Actively Exploited
CERT Polska has warned that a critical remote code execution vulnerability in Zimbra Collaboration Suite (ZCS) is now being actively exploited by attackers.
Atlassian, Splunk, and Cisco Patch Dozens of Critical, High-Severity Vulnerabilities
Atlassian and Splunk have released patches for numerous critical and high-severity flaws that could lead to arbitrary code execution and privilege escalation, while Cisco also patched critical vulnerabilities in Crosswork and Secure Workload.
NASA AIT-GUI Flaws Could Allow Unauthenticated Spacecraft Commands
Security researchers disclosed a chain of critical flaws (GHSA-p9r8-2q67-fp86) in NASA/JPL's open-source AMMOS Instrument Toolkit (AIT-GUI) that could allow unauthenticated attackers to issue commands to spacecraft.
Hackers Using AI to Target Siemens PLCs in Critical US Sectors
The NSA, CISA, and other agencies have released a cybersecurity advisory warning that hackers are using AI to target Siemens S7 Series PLCs in critical U.S. sectors, including water plants.
40 Malicious Firefox Extensions Steal Crypto Wallet Secrets
Researchers have identified 40 Mozilla Firefox extensions masquerading as Web3 products like OKX and Rabby Wallet to steal cryptocurrency wallet secrets, part of a broader "Offside Wallet Theft Factory" campaign.
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks
Updated versions of the ToxicPanda (aka TgToxic) and GoldDigger Android banking malware now feature significant enhancements, including expanded remote commands and PIN harvesting workflows targeting over 140 banking and cryptocurrency applications globally.