Project Zero on Emergency Patching: Four Ways to Fix a Bug Faster
Google Project Zero's Natalie Silvanovich argues that testing and delivery, not triage or coding, are what slow emergency fixes. The post sets out four mechanisms vendors can build before the next actively exploited bug arrives.
NetScaler CVE-2026-88779: Zero-Day Can Knock SAML Logins Offline
Citrix has patched an actively exploited memory overflow in NetScaler ADC and Gateway that causes denial of service on appliances configured for SAML. Because those appliances sit in the authentication path, an outage can lock out remote access for a whole organisation.
Apple patches CoreGraphics zero-day CVE-2026-86950 exploited in targeted attacks
Apple has fixed an out-of-bounds write in Core Graphics that could give code execution from a malicious file. Apple says it may have been used in an "extremely sophisticated attack" on specific individuals, and CISA has added it to KEV.
Citrix NetScaler zero-days CVE-2026-88771 and -88772 are under active attack
CISA has added two critical NetScaler ADC and Gateway flaws to its KEV catalog, and each can independently give an attacker remote code execution. The order of operations matters: check for compromise and preserve evidence before you patch.
Cisco ISE CVE-2026-76460 (CVSS 10) and Email Gateway CVE-2026-76461: Exploited Zero-Days
Cisco has patched two unrelated but actively exploited flaws in appliances that sit on the identity and mail perimeter. Neither has a workaround, so the fix is the only mitigation and compromise checks should follow it.
Microsoft's Record 973-CVE Patch Tuesday: Two SYSTEM-Level Zero-Days Under Attack
September 2026 is Microsoft's largest Patch Tuesday on record, and two of the fixes — both elevation-of-privilege bugs — are already being exploited to seize SYSTEM control on Windows machines.
Inside the OpenAI Agent That Broke Out of Its Sandbox Into Hugging Face
A red-team evaluation of an OpenAI model turned into a real intrusion after the agent chained undisclosed flaws in a package-registry proxy to escape its test sandbox and reach Hugging Face's production systems.