Vulnerabilities
F5 BIG-IP APM CVE-2026-94127 (CVSS 9.8) Unauthenticated RCE Zero-Day Actively Exploited on OAuth Authorization Servers
One CVSS 9.8, one OAuth-server config, one unauth RCE. F5 zero-day lands under active exploitation this week.
Vulnerabilities
WordPress Triple: CVE-2026-87902 Actively Exploited Within Hours + Comment2Shell + Click2Shell
Three WordPress-core flaws landed in one week, and one of them, CVE-2026-87902, was exploited within hours of disclosure. Comment2Shell and Click2Shell round out the set. WordPress 7.1.2 closes all three, and patching just got urgent.
Artificial Intelligence (AI)
"Plugin4Shell" Zero-Click RCE Across Four Major AI Coding Agents: Two Remain Unpatched
One plugin-marketplace swap, four major AI coding agents affected, and two of them still unpatched. Air Security disclosed Plugin4Shell this week, calling it the first supply-chain vulnerability of the AI agent ecosystem.
Threat Intelligence
The CyberSignal Weekly Roundup: Cisco Patch Dump, Spain's Agentic-AI Breach, NightmareStresser Seized
A Cisco patch dump, an agentic-AI breach on the record, a booter seized, and CISA's first honeypot guidance. The week in brief.
Vulnerabilities
Cisco ISE CVE-2026-76460 Authentication-Bypass Zero-Day Actively Exploited; Emergency Patch Out
One Cisco management API, one authentication bypass, one emergency patch. Cisco's second zero-day in 48 hours lands this week.
Vulnerabilities
Google Pixel Modem Zero-Day CVE-2026-58704 Exploited; CISA 3-Day Federal Deadline
Google patched CVE-2026-58704, a zero-click flaw in the Pixel Cellular Modem already used in limited, targeted attacks. CISA gave federal agencies three days to fix it. Here is what Pixel-issuing enterprises should verify first.
Vulnerabilities
Perimeter + Web-Host Triple: WSO2 API Manager (CVSS 9.8) + Acronis cPanel + LiteSpeed Shared-Host Root
Three critical flaws, one API gateway, two hosting-plane products, active exploitation. Triple critical this week.
Vulnerabilities
Apple's "Vulnpocalypse": 261 Vulnerabilities Patched Across macOS 27 and iOS 27
Two hundred sixty-one CVEs, one Apple release, one record. On September 14, Apple shipped macOS 27 Golden Gate, iOS 27, and the rest of its lineup, fixing more vulnerabilities at once than it ever has. Here is what Apple-fleet defenders should verify.
Vulnerabilities
Cisco Secure Email Gateway CVE-2026-76461 (CVSS 9.8) Actively Exploited: Unauthenticated Root RCE via Email
One email, one CVSS 9.8, one root-command-execution appliance. Cisco confirms active exploitation this week.
Vulnerabilities
GitLab CVE-2026-85706 (CVSS 10.0) Path Traversal Actively Exploited; CISA KEV Sept 11
One CVSS 10.0, one path traversal, one supply chain at risk. GitLab shipped a patch September 10; CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog a day later. Here is what CE and EE operators should verify now.
Vulnerabilities
Adobe's Magento Hotfix for CVE-2026-75650 Is Step 1 of 15, and the Patch Was Never the Problem
Adobe's out-of-band fix for CVE-2026-75650 landed September 7, after attackers had already backdoored live stores. There is no single hotfix: seven version-keyed patch files, a vendor admission that you cannot easily tell whether it applied, and a fifteen-step credential rotation behind it.
Vulnerabilities
Cisco Secure FMC CVE-2026-20079 (CVSS 10.0) Added to CISA KEV as Talos Confirms Exploitation
One CVSS 10.0 flagship, a three-vendor KEV batch, and nation-state plus ransomware actors confirmed. Cisco Secure FMC lands under a federal remediation deadline this week.