[HIGH] – Check Point Issues Patches for Two Critical VPN Certificate Flaws
Check Point released fixes for two CVSS 9.8 VPN certificate flaws that may permit unauthenticated remote code execution.
[HIGH] – Android September Updates Address 180 Vulnerabilities
Android's September updates address 180 vulnerabilities, including critical System-component issues that may allow remote code execution.
[HIGH] – Wiz Finds Exposed LiteLLM Gateways Accept Default Admin Credentials
Wiz found 9.6% of sampled public LiteLLM instances accepted default or no authentication, enabling severe AI-gateway compromise paths.
[HIGH] – Fortinet CVE-2025-25249 Exploited to Deploy PivotC2
Attackers are exploiting Fortinet CVE-2025-25249 to deploy PivotC2; update affected FortiOS and FortiSwitchManager releases.
[CRITICAL] – NetScaler Authentication Bypass Added to CISA KEV
CISA added an actively exploited NetScaler authentication bypass to KEV; exposed gateway and AAA deployments need urgent updates.
[CRITICAL] – Cisco Talos Tracks Active Secure FMC Exploitation
Cisco reports active exploitation of two Secure FMC flaws, including a CVSS 10 authentication bypass enabling root access.
[HIGH] – Google Patches Actively Exploited Chrome V8 Flaw
Google issued Chrome updates for an exploited V8 out-of-bounds write; update desktop Chrome to the patched Stable release.
[CRITICAL] – CISA Adds N-able N-central RCE to KEV Catalog
CISA added a pre-authentication N-central remote-code-execution flaw to KEV; self-hosted administrators should apply N-able's hotfix.
[MEDIUM] – Calif Discloses Mitigated WeChat Zero-Click Worm Demo
Calif demonstrated a zero-click WeChat account-takeover worm; it says Tencent has mitigated the exploit.
[HIGH] – Google Details Agentic AI Credential-Harvesting Campaign
Google observed an agent-enabled credential-harvesting campaign planned and executed in under six hours.