Security Notices
Google Cloud Patches Three Application Integration Vulnerabilities
Google has patched Application Integration authorization, deserialization and Email Task confused-deputy issues and states no customer action is required. Confirm service applicability and retain the bulletins; do not invent a local package or service-recreation task.
hMailServer 6.3.4 Fixes Pre-Authentication Script Injection
hMailServer 6.3.4 fixes script-injection paths with specific event and rule conditions. Plan manual installation and tested database/mail-data recovery; live update will not install this release, and a binary downgrade cannot reverse its database migration.
Citrix NetScaler Fixes Eight Flaws; Exploitation Observed
Citrix reports exploitation of two NetScaler flaws in this update set. Patch every affected customer-managed appliance and HA peer, coordinate forensic triage, and separately apply the required enhanced-ISN configuration where applicable.
CISA Adds WordPress Core Remote File Inclusion to KEV
CISA lists an exploited WordPress template-resolution flaw that can include local PHP files under specific theme and server conditions. Update the affected core branch, preserve suspicious files and logs, and conduct forensic triage.
CISA Adds MikroTik RouterOS SSH Bypass to KEV
The KEV-listed RouterOS SSH bypass requires branch-matched updates and management-access restrictions. Preserve recovery access and inspect router configuration and security indicators; a successful patch or clean indicator alone does not establish an uncompromised appliance.
CISA Adds Microsoft SharePoint Code Injection to KEV
CISA lists an exploited SharePoint code-injection flaw requiring a low-privilege authenticated attacker but no further user interaction. Update every affected farm server through Microsoft's supported workflow and preserve evidence for forensic triage.