Threat Advisories

Citrix has issued an urgent advisory warning customers to patch two newly disclosed vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances. The most severe vulnerability, CVE-2026-19490, enables unauthenticated authentication bypass under specific configurations, potentially allowing remote attackers to gain unauthorized access to exposed services. A second vulnerability, CVE-2026-19489, could enable unauthenticated attackers to trigger denial-of-service (DoS) conditions.

A maximum-severity vulnerability affecting SAP Commerce Cloud, tracked as CVE-2026-58231, is being targeted in exploitation attempts only days after SAP released a security update.

CEVA Logistics, a global logistics and supply chain provider and subsidiary of CMA CGM Group, has disclosed a cyber incident impacting portions of its European contract logistics operations. The attack, which reportedly began on or around 29 July 2026, disrupted operations across at least eight European warehouses and resulted in shipment delays for multiple customers.

Digital Risk solutions provider CloudSek has published a list of organisations affected by a high profile campaign by TeamPCP.

Cisco has released security updates addressing 24 vulnerabilities across multiple enterprise products, including several critical-severity flaws affecting Catalyst SD-WAN, IOS XE, and Secure Firewall Management Center (FMC). The most severe vulnerability, CVE-2026-20079, impacts FMC and carries a CVSS score of 10.0, enabling unauthenticated remote attackers to bypass authentication and gain root-level access. Cisco has also disclosed critical flaws in IOS XE and Catalyst SD-WAN that could allow command injection, privilege escalation, and unauthorized access.

On August 4, 2026, a sophisticated software supply chain attack dubbed ChainDrop struck the npm ecosystem through the compromise of a maintainer's GitHub account for the widely used Keyv and Cacheable open-source packages. The resulting self-propagating worm spread to over 2251 versions of 452 unique packages with approximately 2 billion monthly downloads, affecting organisations including Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.

A critical vulnerability was discovered by N-Able in it's product N-Central, a remote management appliance used for IT administration.

The "wp2shell" exploit chain represents a critical security event targeting the fundamental architecture of the WordPress ecosystem. This is a pre-authentication Remote Code Execution (RCE) vulnerability residing entirely within WordPress Core. It requires no third-party plugins, themes, or authenticated access to execute. A single crafted HTTP request against a default, "stock" installation can result in unauthenticated attacker gaining full system control.

Check Point has disclosed and patched a critical zero-day vulnerability, CVE-2026-16232, affecting its SmartConsole management platform. The flaw is an authentication bypass vulnerability that enables unauthenticated remote attackers to obtain a valid application login token and authenticate with administrator-level privileges under specific conditions. Check Point confirmed that the vulnerability is being actively exploited and has impacted a limited number of customers.

Security researchers have observed increased activity involving ACR Stealer, an information-stealing malware family associated with the Amatera Stealer ecosystem. The activity was particularly prevalent from late April through mid-June 2026 and has successfully compromised enterprise environments.