The FBI and Secret Service say the FortiBleed campaign is still running, and that some victims may be locked out of their own firewalls. The advisory lists the account names attackers leave behind.
Federal agencies had until 30 September to put Citrix's fix on their NetScaler gateways. By Friday the fixed build was crashing under a new attack. Citrix has now patched its third exploited NetScaler zero-day in a week, and CISA wants it in by Wednesday, with a forensic check, for a flaw Citrix describes as a denial-of-service bug.
Cisco says attackers are using a flaw in Catalyst SD-WAN Manager that lets a request with no login act as the admin user. CISA added it to its exploited list on Wednesday with a Saturday deadline. It is the ninth Cisco SD-WAN entry the catalogue has taken in 2026, and the seventh to name the Manager.
CISA put two actively exploited NetScaler flaws on its must-patch list on Sunday evening, with a Wednesday deadline and a forensic check attached. It is the fourth NetScaler entry in 32 days. The three-day window is new this year, and September has already brought more additions to the catalogue than any other month of 2026.
Low-orbit connectivity stopped being a last resort for remote sites and became a line item that carriers now resell alongside fibre.
Billions of agents, sensors, and services are exhausting the workarounds that kept legacy addressing alive, and enterprise networks are rebuilding.