CISA
Every ZeroDayFeed story on CISA — across breaches, zero-days, ransomware, patches, policy, and industry, newest first.
-
Patches & Advisories
Back-to-back Chrome 155 stable updates fix 47 flaws, eight of them critical
Google shipped Chrome 155 desktop updates on Oct 13 and Oct 15, 2026, fixing 47 security bugs, eight of them critical, including an ANGLE buffer overflow and a Prerender use-after-free. Google has not marked any of them as exploited in the wild.
-
Zero-Days & Exploits
Citrix NetScaler SAML flaw CVE-2026-88779 exploited in targeted attacks; CISA deadline has passed
Citrix says attackers are targeting CVE-2026-88779, a memory-buffer flaw in SAML-configured NetScaler ADC and Gateway appliances, and CISA's October 7 federal patch deadline has now passed.
-
Patches & Advisories
NGINX patches heap overflow and use-after-free bugs F5 rates critical; Juniper fixes 150-plus Junos flaws
F5 fixed 11 NGINX defects, including two configuration-dependent heap overflows and an AIO use-after-free it scores CVSS 4.0 9.2, while Juniper shipped 17 advisories covering more than 150 Junos flaws. Neither vendor reports exploitation.
-
Zero-Days & Exploits
Cisco Secure Email Gateway Flaw CVE-2026-76519 Exploited: Crafted Attachment Can Yield Root Access
Cisco says attackers are exploiting CVE-2026-76519 (CVSS 9.8), which lets an unauthenticated attacker gain root on a Secure Email Gateway with File Reputation enabled by sending a crafted attachment; there is no workaround, and CISA's October 17 KEV deadline has passed.
-
Policy & Government
Senate passes health care cyber bill that would write MFA and encryption into HIPAA
The Senate passed S. 3315, the Health Care Cybersecurity and Resiliency Act of 2026, by unanimous consent, sending the House a bill that would direct HHS to require MFA, PHI encryption and penetration testing under the HIPAA Security Rule.
-
Zero-Days & Exploits
Atlassian Data Center File-Read Flaw CVE-2026-21589 Exploited After Public PoC; CISA Adds It to KEV
Attacks began within hours of a public proof of concept for CVE-2026-21589, a CVSS 9.3 unauthenticated file-read flaw in eight self-hosted Atlassian Data Center products, and CISA added it to its Known Exploited Vulnerabilities catalog on Oct 15.
-
Policy & Government
DOJ Seizes Integrity Tech's MicroScan and FishHub Domains as Joint Advisory AA26-281A Details Flax Typhoon-Linked Tradecraft
The Justice Department and FBI seized domains behind China-based Integrity Tech's MicroScan scanner and FishHub phishing tool on Oct 8, the same day as advisory AA26-281A from 10 agencies in seven countries, which lists exploited CVEs and the mitigations defenders should apply.
-
Zero-Days & Exploits
Ivanti Connect Secure zero-day CVE-2026-104935 chained for root access; third flaw still unpatched
Attackers exploited Ivanti Connect Secure auth bypass CVE-2026-104935 before disclosure, and Volexity says they chained it with a still-unpatched privilege escalation flaw to get root on a fully patched appliance. CISA added it to KEV on Oct 13.
-
Patches & Advisories
Microsoft's record October Patch Tuesday fixes more than 1,400 flaws, including an exploited Mark-of-the-Web bypass
Microsoft's October 13 Patch Tuesday fixed a record of more than 1,400 vulnerabilities. One of them, CVE-2026-96951, is a Windows Shell Mark-of-the-Web bypass that attackers were already exploiting, and CISA added it to the KEV catalog the same day.
-
Zero-Days & Exploits
Palo Alto patches exploited PAN-OS management-interface flaw that grants root (CVE-2026-0322)
Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management-interface code-injection flaw that is being exploited in a very limited number of attacks. It gives authenticated attackers root on PA-Series and VM-Series firewalls and on Panorama, and CISA set an Oct 17 deadline for agencies to patch and check for compromise.
-
Zero-Days & Exploits
SiteGuard WAF flaw CVE-2026-106931 exploited in the wild to run commands as root or SYSTEM
EG Secure Solutions and JPCERT/CC confirm in-the-wild exploitation of CVE-2026-106931, an OS command injection in SiteGuard Server Edition's default-on statistics feature that runs commands as root or SYSTEM. Fixed builds are 8.00 Update 5 and 7.00 Update 6.
-
Policy & Government
FBI and CISA warn election and campaign officials of AI-polished phishing and smishing ahead of midterms
A joint FBI-CISA alert, I-101626-PSA, warns election officials, candidates and political groups that phishing, smishing and deepfake impersonation aimed at stealing credentials are rising before the 2026 midterms. It urges phishing-resistant MFA first.
