🔒 Monday, October 5, 2026 | Cybersecurity Awareness Month | Compiled by PBCS.NYC ⚠️ ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-63077 | JetBrains TeamCity On-Premises | Unauthenticated Remote Code Execution via deserialization flaw in agent polling protocol | CVSS: 9.8 (Critical) | Affected: Versions ≤2025.11.6 and ≤2026.1.2 | Patched: v2025.11.7 / v2026.1.3 (July 25, 2026) | CISA KEV added August 5, 2026. Active ransomware exploitation confirmed; JetBrains' own internal Cad

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-104286 — Fortinet FortiMail Zero-Day (CVSS 9.8): Unauthenticated arbitrary file write via improper pathname restriction and null byte handling in HTTP/HTTPS requests. Affects FortiMail 7.2–8.0.x. FCEB patch deadline: October 4, 2026. CISA added to KEV on October 1, 2026. Active exploitation confirmed from IPs 79.141.169[.]187 and 45.129.0[.]192. Source: The Hacker News CVE-2026-76504 — Cisco Catalyst SD-WAN Manager Authentication By

Your daily digest of the most critical cybersecurity developments from the past 24 hours. Today's briefing covers October 3, 2026. ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-104286 (CVSS 9.8) — Fortinet FortiMail zero-day: path traversal + NULL byte flaw allows unauthenticated arbitrary file write on affected mail gateways; versions 7.4, 7.6, and 8.0 impacted; actively exploited in the wild. No FCEB deadline announced yet — patch immediately. CVE-2026-76504 (CVSS 9.8) — Cisc

Your daily roundup of the most critical cybersecurity developments from the past 24 hours. ACTIVELY EXPLOITED VULNERABILITIES D-Link CVE-2026-86296 (CVSS: Maximum) — D-Link warned of a maximum-severity vulnerability in legacy DIR-822A dual-band Wi-Fi routers. Public PoC exploit code exists and no patch is available. Customers urged to retire and replace affected devices immediately. Linux Kernel (3 CVEs) — CISA warns of active exploitation of three Linux kernel vulnerabilitie

ACTIVELY EXPLOITED VULNERABILITIES CVE-2025-39964 (Linux Kernel Race Condition) & CVE-2026-53266 (Linux Kernel Out-of-Bounds Write) — Both added to CISA KEV on September 18, 2026 based on evidence of active exploitation. FCEB agencies required to patch by October 9, 2026. CVE-2026-81963 — Windows Update Stack Elevation of Privilege; first-ever zero-day exploitation of this component; allows SYSTEM-level privilege escalation. Patched in Microsoft's September 2026 Patch Tuesday

ACTIVELY EXPLOITED VULNERABILITIES SAP September 2026 Patch Day — 19 Security Notes including 4 critical flaws: CVE-2026-44756 (CVSS 10.0) memory corruption in SAP Extended Passport (EPP) Processing affecting multiple Kernel/Web Dispatcher releases; CVE-2026-58240 (CVSS 9.8) missing-auth in NetWeaver Message Server; CVE-2026-76969 (CVSS 9.4) credential disclosure in SAP Cloud Application Programming Model; CVE-2026-66768 (CVSS 9.0) improper access control in SAP GUI for Java.

Daily Cybersecurity Briefing — September 7, 2026. Covering the latest threats, vulnerabilities, breaches, and security news from the past 24 hours. ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-85046 — Google Chromium V8 Type Confusion: Added to CISA KEV on September 4, 2026. Actively exploited in the wild. Users urged to update Chrome immediately. CVE-2026-83548 (CVSS 10.0) — SonicWall SMA1000 Server-Side Request Forgery: Allows unauthenticated remote access to sensitive funct

Your daily digest of the most critical cybersecurity developments from the past 24 hours. Covering actively exploited vulnerabilities, breaches, threat intelligence, cloud security, ICS/OT, AI threats, and more. ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-85046 — Google Chromium V8 Type Confusion: Added to CISA KEV on September 4, 2026. Affects Chromium-based browsers. FCEB agencies required to remediate immediately. CVE-2026-83548 — SonicWall SMA1000 SSRF (CVSS 10.0): Server

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-8452 — Citrix NetScaler ADC & Gateway (CVSS 8.8): Memory overflow vulnerability added to CISA KEV on August 26. FCEB agencies must patch by August 29, 2026. Actively exploited in the wild. CVE-2026-55040 + CVE-2026-63520 — Microsoft SharePoint RCE Chain: JWT token authentication bypass (CVE-2026-55040) chained with Business Connectivity Services RCE (CVE-2026-63520). Public PoCs released; active exploitation began within 24 hours. C

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-72529 (TrueConf Server Missing Authentication) & CVE-2026-72530 (TrueConf Server Code Injection): Critical-severity bugs present in all TrueConf Server versions since 2022, actively exploited by hacktivist group Head Mare to deploy PhantomCore malware, install web shells, and harvest infrastructure credentials. Exploited via port 4307/TCP. Fixed in versions 5.3.9, 5.4.9, and 5.5.5. Added to CISA KEV August 20, 2026. FCEB patch deadl

ACTIVELY EXPLOITED VULNERABILITIES CISA added CVE-2026-48939 (iCagenda Unrestricted Upload of File with Dangerous Type) and CVE-2026-56291 (Balboola Forms Unrestricted Upload of File with Dangerous Type) to the Known Exploited Vulnerabilities catalog; FCEB agencies must remediate by the stated deadline. CVE-2026-50522 — Critical Microsoft SharePoint RCE is under active exploitation after a public PoC was released. Organizations running on-premises SharePoint should patch imme