cybr.cx Daily Digest — September 10, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-19490 | Citrix NetScaler ADC & Gateway | No CVSS in NVD feed
An authentication-bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway is being actively exploited right now. When configured as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), unauthenticated remote attackers can bypass authentication entirely. CISA's remediation deadline was September 12 — if you haven't patched, assume you're already compromised. Isolate affected appliances immediately.

⚠️ Actively exploited — CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) & Security Cloud Control | No CVSS in NVD feed
Cisco FMC and Security Cloud Control contain an authentication bypass via an alternate path, allowing unauthenticated remote attackers to execute script files on affected systems. Active exploitation is confirmed; CISA deadline was September 12. Firewall management planes being accessible to unauthenticated actors is as bad as it sounds — patch or take offline.

⚠️ Actively exploited — CVE-2025-25249 | Fortinet FortiOS, FortiSwitchManager, FortiSASE | No CVSS in NVD feed
A heap-based buffer overflow in multiple Fortinet products allows remote code execution via specially crafted packets. Fortinet gear is perennially high-value threat actor real estate, and this one is being exploited in the wild. Apply vendor patches immediately; check for indicators of compromise on already-exposed appliances.

⚠️ Actively exploited — CVE-2026-87491 | Google Chromium V8 | No CVSS in NVD feed
An out-of-bounds write in Chromium's V8 JavaScript engine allows remote code execution inside the sandbox via a crafted HTML page. Any Chromium-based browser is affected — Chrome, Edge, and others. This is a drive-by exploitation scenario; push the Chrome 153.0.8010.36 update enterprise-wide now and don't wait for user-initiated restarts.

⚠️ Actively exploited — CVE-2026-85046 | Google Chromium V8 | No CVSS in NVD feed
A separate type confusion bug in V8, also actively exploited, enables remote code execution inside the sandbox via a crafted HTML page. Two concurrent in-the-wild V8 exploits simultaneously is notable — treat Chrome update deployment as P0 today.

⚠️ Actively exploited — CVE-2026-81963 | Microsoft Windows Update Stack | No CVSS in NVD feed
A link-following vulnerability in the Windows Update Stack allows local privilege escalation to SYSTEM. Paired with any initial access vector, this is a clean LPE for ransomware and post-exploitation tooling. CISA deadline is September 22 — don't let that create false comfort.

⚠️ Actively exploited — CVE-2026-85880 | Microsoft Windows ALPC | No CVSS in NVD feed
A heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) enables local privilege escalation. ALPC is a foundational Windows IPC mechanism; bugs here are reliably weaponised in commodity malware. Patch immediately.

⚠️ Actively exploited — CVE-2026-86218 | N-able N-central | No CVSS in NVD feed
A static code injection vulnerability in N-able N-central allows pre-authentication remote code execution. RMM platforms are prime targets for supply-chain-style attacks against MSPs and their downstream clients — this class of vulnerability is exactly how large managed-service compromises begin. Patch with urgency and audit for signs of lateral movement.

⚠️ Actively exploited — CVE-2026-75650 | Adobe Commerce & Magento Open Source | No CVSS in NVD feed
A template engine injection flaw in Adobe Commerce and Magento allows arbitrary code execution. E-commerce infrastructure running Magento is a perennial target for skimming and financial fraud operations; CISA's deadline was September 11, meaning unpatched instances should be considered at high risk right now.

⚠️ Actively exploited — CVE-2026-82329 | JFrog Artifactory | No CVSS in NVD feed
Under default configuration, an improper authentication flaw in JFrog Artifactory allows unauthenticated network-accessible attackers to obtain administrative privileges. If your Artifactory instance is internet-exposed — even partially — treat this as critical and patch immediately. Supply chain integrity of your artifact pipeline is at stake.

CVE-2026-87569 | Google Chrome (< 153.0.8010.36) | CVSS 8.8
A missing authorisation flaw in Chrome's Views component allows a remote attacker to bypass system access restrictions via a socially engineered HTML page. Chained with active V8 exploits above, this Chrome update cycle is particularly dense — ensure 153.0.8010.36 is deployed enterprise-wide.

CVE-2026-87817 | GitPython (< 3.1.60) | CVSS 8.8
GitPython fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files (gitdir, commondir, HEAD). A malicious pre-commit hook in a cloned repository's tracked hooks directory executes arbitrary code when index.commit() is called. Any CI/CD pipeline or developer workflow cloning untrusted repositories is exposed — update to 3.1.60 immediately.

CVE-2026-56711 | VLC Media Player | CVSS 8.8
A 32-bit integer overflow in VLC's AllocatePicture() function wraps the buffer size calculation before widening to size_t, enabling a heap allocation that's undersized for the actual picture data. Exploitation via a crafted media file could lead to memory corruption and code execution. Patch VLC and restrict media file sources in enterprise environments.

CVE-2026-81994 | Adobe Acrobat Reader | CVSS 8.2
A prototype pollution vulnerability in Acrobat Reader can be leveraged to achieve arbitrary filesystem reads, exposing sensitive files outside the intended access scope. Exploitation requires a victim to open a malicious PDF — a perennially reliable phishing delivery mechanism. Patch Acrobat Reader and consider PDF sandboxing controls.

Headline News

Hackers drain ~$320M from Liquid Network — then return most of it
Bitcoin's Liquid Network sidechain, operated by Blockstream and used by numerous exchanges for fast inter-institutional settlement, was drained of approximately 4,000 BTC — worth roughly $320 million at time of attack. The attackers subsequently returned around 3,400 BTC, with approximately 600 BTC (~$47M) still outstanding, and demanded a bug fix rather than a traditional ransom, prompting scepticism about whether these actors are genuinely operating in a "white hat" capacity or managing reputation to avoid prosecution. The technical mechanism of the breach has not been fully disclosed, but the incident exposes the systemic risk concentration inherent in sidechain bridge architecture, where a single exploitable component can drain pooled institutional liquidity at scale. For practitioners in financial services or cryptocurrency custody, this is a reminder that bridge and sidechain security deserves the same scrutiny as the primary chain — and that "white hat" framing after the fact doesn't substitute for pre-incident threat modelling.

F5 BIG-IP APM targeted with fileless Linux rootkit
Threat actors have been observed breaching F5 BIG-IP Access Policy Manager (APM) devices and deploying a sophisticated Linux rootkit that operates entirely in-memory, injecting a web shell directly into PHP processes without writing any malicious code to disk. The fileless approach is deliberately designed to evade traditional file integrity monitoring and endpoint detection tools that rely on on-disk artefacts — making detection dependent on memory forensics and behavioural analysis rather than signature scanning. BIG-IP APM devices sit at the perimeter of enterprise networks handling SSL termination, VPN access, and authentication brokering, making them high-value implant targets for persistent access. Organisations running BIG-IP APM should audit for anomalous PHP process behaviour, unexpected network connections from the appliance, and apply all current F5 security advisories; assume that conventional AV-style detection will miss this implant entirely.

220 million traveller records exposed in airline data leak
A series of cloud misconfigurations exposed an archive spanning nine years of airline traveller data, affecting approximately 220 million records including passenger details and passport information. Researchers discovered the data accessible without authentication before the repository was locked down, but the exposure window and whether threat actors accessed the data before disclosure remains unclear. The breadth of the dataset — passport numbers, travel histories, and personal identifiers — creates durable risk: unlike passwords, passport numbers and travel patterns cannot be rotated, and the data has significant value for identity fraud, surveillance, and social engineering operations. This incident continues a pattern of large-scale PII exposure via misconfigured cloud storage; practitioners should treat data classification and storage bucket access auditing as non-negotiable hygiene, particularly for regulated data like travel documents.

Schrödinger's Feed

a16z crypto rebuilds the Jolt proof system with post-quantum security
Andreessen Horowitz's crypto research arm has rebuilt the Jolt zero-knowledge proof system from the ground up with post-quantum security properties, while also achieving faster performance than the classical predecessor — a combination that's typically difficult to achieve simultaneously, since PQC primitives tend to carry significant computational overhead. Jolt is a zkVM (zero-knowledge virtual machine) framework used to prove the correct execution of arbitrary programs without revealing the underlying computation, with applications in blockchain verification, private smart contracts, and verifiable computation generally. The significance here extends well beyond crypto finance: zkVMs are increasingly proposed as a trust mechanism for AI inference verification and secure multi-party computation, and making them quantum-resistant future-proofs that entire stack. Practitioners building on ZK proof infrastructure should watch this closely — the pressure to migrate proof systems to PQC-safe constructions is arriving faster than most roadmaps anticipated.

/dev/random

AirPods 5 ship with "best-in-class open-ear active noise cancellation"
Apple's newly announced AirPods 5 are being marketed on the strength of active noise cancellation in an open-ear form factor — which is, technically speaking, the audio equivalent of a firewall with all ports open delivering "best-in-class" perimeter security. The engineering is genuinely impressive: generating cancellation signals for ambient sound when there's no physical seal is a hard signal processing problem, relying on outward-facing microphones and adaptive algorithms to model and invert environmental noise in real time. No known CVEs yet — though given that AirPods firmware has historically received security patches, we're prepared to wait.