[HIGH] – Wiz Finds Exposed LiteLLM Gateways Accept Default Admin Credentials
Wiz found 9.6% of sampled public LiteLLM instances accepted default or no authentication, enabling severe AI-gateway compromise paths.
[HIGH] – Fortinet CVE-2025-25249 Exploited to Deploy PivotC2
Attackers are exploiting Fortinet CVE-2025-25249 to deploy PivotC2; update affected FortiOS and FortiSwitchManager releases.
[CRITICAL] – NetScaler Authentication Bypass Added to CISA KEV
CISA added an actively exploited NetScaler authentication bypass to KEV; exposed gateway and AAA deployments need urgent updates.
[CRITICAL] – Cisco Talos Tracks Active Secure FMC Exploitation
Cisco reports active exploitation of two Secure FMC flaws, including a CVSS 10 authentication bypass enabling root access.
[HIGH] – Google Patches Actively Exploited Chrome V8 Flaw
Google issued Chrome updates for an exploited V8 out-of-bounds write; update desktop Chrome to the patched Stable release.
[CRITICAL] – CISA Adds N-able N-central RCE to KEV Catalog
CISA added a pre-authentication N-central remote-code-execution flaw to KEV; self-hosted administrators should apply N-able's hotfix.
[MEDIUM] – Calif Discloses Mitigated WeChat Zero-Click Worm Demo
Calif demonstrated a zero-click WeChat account-takeover worm; it says Tencent has mitigated the exploit.
[HIGH] – Google Details Agentic AI Credential-Harvesting Campaign
Google observed an agent-enabled credential-harvesting campaign planned and executed in under six hours.
[HIGH] – Check Point Reports Cross-Account ChatGPT Data-Leakage Channel
Check Point demonstrated a prompt-driven ChatGPT channel that could relay connected-app data across accounts.
[CRITICAL] – SAP Releases Fix for CVE-2026-44756 EPP Memory Corruption
SAP's September security updates address a CVSS 10.0 Extended Passport Processing memory-corruption vulnerability.