All news with #patch release tag

🛡️ Citrix has released security updates addressing a critical memory overflow vulnerability, CVE-2026-107406, affecting NetScaler ADC and NetScaler Gateway. The flaw can enable remote code execution or denial-of-service under specific SAML IdP/SP configurations and carries a CVSS score of 9.5. Citrix credited security researchers from JPMorgan Chase XOR Team and others for reporting the issue and recommends upgrading affected NetScaler instances to the fixed versions.

🔒 Cisco Talos disclosed multiple vulnerabilities affecting Adobe, Apple, Foxit Reader, and Microsoft. The vendors have issued patches in accordance with Cisco’s disclosure policy. Snort rule updates are available to detect exploitation, and Talos posts ongoing vulnerability advisories on its site. Affected components include Photoshop installer, macOS CoreWLAN, Foxit PDF JavaScript features, and several Windows kernel drivers.

🔒 SonicWall released hotfixes addressing four vulnerabilities in SMA1000 appliances, including a CVSS 10.0 SSRF in the WorkPlace portal that can be reached before authentication. The vendor says there is no evidence the flaws are being exploited, and affected firmware builds are listed with fixed and vulnerable versions. The hotfix is available via MySonicWall and requires an appliance restart; no workaround is provided.

🔒 Dell disclosed 18 CVEs affecting its Container Storage Modules (CSM) and Dell System Update (DSU), including two CVEs rated 10 and five rated 9+. The flaws could let unauthenticated or low-privilege attackers bypass auth, gain root, forge admin tokens, and execute remote code. Affected CSM versions prior to 1.17.0 and DSU versions prior to 2.3.0.0 must be updated; Dell reports no active exploitation so far. Vendors and customers are urged to apply fixes and rotate credentials.

🛡️ Dell warned customers to update the System Update (DSU) CLI after a critical path traversal vulnerability (CVE-2026-86360) was disclosed that can allow unauthenticated attackers to execute code with root privileges. The company released DSU 2.3.0.0 to patch this and four other high-severity issues, and urged immediate upgrades. U.S. agencies previously warned vendors to eliminate path traversal weaknesses, and organizations should patch promptly to reduce risk.

🔒 Citrix has released emergency updates for a NetScaler SAML vulnerability, CVE-2026-88779, which has been exploited in active attacks and causes denial-of-service conditions. The flaw affects NetScaler ADC and Gateway appliances using SAML authentication and carries a CVSS score of 8.7. Citrix published fixes for 14.1 and 13.1 branches and supplied Global Deny Lists while urging immediate upgrades. Administrators are urged to verify SAML configuration to determine exposure and apply the new releases promptly.

🔒 On September 15, Google released a Pixel-specific security bulletin addressing 110 vulnerabilities in its smartphones, highlighting CVE-2026-58704 as a zero-day exploited in targeted attacks. The bulletin complements the monthly Android Security Bulletin by fixing issues tied to Pixel hardware components such as the modem, bootloader, GPU, and fingerprint scanner. Owners should install the update via Settings → Security & privacy → System & updates → Security update → Install, and follow recommended hardening steps to reduce risk.

🛡️ Amazon announced the Corretto 8u504 LTS update on September 30, 2026, a no-cost, production-ready OpenJDK distribution. This patch delivers tzdata 2026d timezone updates and is available for download alongside other Corretto LTS builds. Users can obtain updates via Corretto Apt, Yum, or Apk repositories on Linux systems. Feedback is invited.

🛡️ Pillar Security found that selecting a model in Unsloth Studio caused the application to download and execute Python code from model repositories. The issue arose because Unsloth enabled Hugging Face's trust_remote_code automatically during routine model checks, running code just by reading a model's config.json. Unsloth patched the behavior in version 2026.6.9 and users are urged to upgrade and audit uses of trust_remote_code.

🔒 Apple has released a security update addressing CVE-2026-86950, a zero-day in the CoreGraphics rendering framework that Meta Product Security reported. The company said processing a maliciously crafted file could allow arbitrary code execution and that the flaw may have been exploited in an “extremely sophisticated” attack targeting specific individuals. Affected devices include recent iPhones, various iPad models and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1. Apple fixed the issue in iOS 26.7.1, iPadOS 26.7.1 and the noted macOS builds.

🔒 OpenSSL released fixes on September 29 for a High-severity DTLS vulnerability (CVE-2026-84782) that can leak heap memory or crash applications when a DTLS handshake resend occurs while a larger message is partially sent. The bug affects multiple branches and is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8, while fixes for older branches are available only to premium support customers. Vendors including Ubuntu and Debian have issued package updates; Ubuntu users must reboot after updating.

🛈 Microsoft has begun broad rollout of the Windows 11 2026 Update (26H2), but most users will see incremental changes since many features were already delivered via monthly updates. The update installs as a small enablement package for systems on 24H2 or 25H2, making it more like a regular cumulative update. Devices that shipped with 26H1 cannot upgrade directly to 26H2, and installing 26H2 resets the support lifecycle (24 months for Home/Pro, 36 months for Enterprise/Education).

🛈 Amazon RDS for PostgreSQL announces Extended Support minor versions 13.23-rds.20260514, 12.22-rds.20260514, and 11.22-rds.20260514. This Extended Support provides up to three additional years of fixes for critical CVEs and bugs beyond a major version's end of standard support date. You can upgrade via Blue/Green Deployments, in-place upgrade, or restore from a snapshot. Use the Amazon RDS Management Console or AWS CLI to create or update managed PostgreSQL instances.

🔔 Amazon Aurora PostgreSQL-Compatible Edition now supports PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24, delivering community bug fixes and Aurora-specific enhancements. We recommend enabling automatic minor version upgrades to receive these fixes and address known CVEs. Use scheduled maintenance windows or the AWS Organizations Upgrade Rollout Policy to orchestrate phased upgrades across environments. Aurora continues to offer high performance, global resilience, serverless options, and security-focused features.

🛡️ Kiteworks worked with federal intelligence authorities during a scheduled precautionary shutdown to identify and fix a critical vulnerability affecting fewer than 1% of customers. The company developed and deployed a patch and added an extra protective layer across all environments, and said there is no evidence the flaw was exploited. Customers were advised to bring systems back online after the threat window passed and no anomalies were observed.

🔒 Apple released security updates fixing CVE-2026-86950, an out-of-bounds write in the CoreGraphics component that could allow arbitrary code execution when processing a crafted file. The issue was fixed with improved bounds checking and was reported by Meta Product Security. Apple said the flaw may have been exploited in targeted, sophisticated attacks against iOS versions before iOS 27. Updates are available for iOS, iPadOS, and macOS builds listed by device.

🛡️ Amazon released September 25, 2026 patch updates for Corretto LTS and Feature Release builds, including Corretto 25.0.4.10.1, 21.0.12.11.1, 17.0.20.12.1, and 11.0.32.12.1. These Corretto distributions are no-cost, production-ready builds of OpenJDK. The update incorporates the tzdata 2026d timezone data refresh. Users can download releases or configure Apt, Yum, or Apk repositories to receive the updates and provide feedback.

🔐 Citrix has released updates addressing eight vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, including two critical zero-days that were actively exploited. The most severe issues — CVE-2026-88771 and CVE-2026-88772 — enable unauthenticated remote code execution in default deployments and in DTLS-enabled configurations respectively. Agencies including CISA and the ACSC have issued emergency patching guidance, and Citrix urges customers to install updates immediately.

🛑 Microsoft has paused rollout of the KB5002907 Microsoft 365 update after reports it deactivated or removed perpetual Office 2016 and 2019 installs. The optional update, intended for Microsoft 365 Apps >90 days out of date, reportedly installed on some perpetual installs and caused 'Unlicensed Product' states or full removal. Microsoft confirmed the pause and is investigating, advising reactivation or reinstallation where necessary. The company updated the support bulletin and will provide further guidance.

⚠️ A critical Remote Code Execution vulnerability, CVE-2026-87902, affects WordPress versions 4.7.0 through 7.1.1 and allows arbitrary PHP file inclusion leading to potential code execution. WordPress released patches on September 22 (latest recommended version 7.1.2 or newer), but exploit attempts were observed within hours. Site owners should update immediately and follow recommended hardening measures to complement the patch.