🚨 ACTIVE EXPLOITATION
- Researcher reports possible bypass of NetScaler pitboss fix as patched honeypots crash
Kevin Beaumont reports his patched NetScaler honeypots are crashing, suggesting the pitboss fix may be bypassable.- Applies to customer-managed NetScaler ADC and Gateway appliances on versions 13.1 and 14.1, including patched builds
- Patched honeypots running 13.1 and 14.1 are crashing from multiple source IPs, with nsaaad process failures and system reboots logged
- Beaumont says the pitboss fix appears bypassable, dubbing the situation 'PitScaler 2'; unconfirmed so far
- Observed source IP associated with the activity: 213.209.159.55
- Detection: grep ns.log for 'Pitboss declaring system failure', 'maximum number of restarts', or 'All monitored processes have exited, rebooting'
💥 BREACHES & INCIDENTS
- Frontline Education breach exposes school district employee data, including SSNs
Frontline Education is notifying school districts of a data breach in which attackers exploited a third-party software vulnerability to steal employee information.- Affects school districts using Frontline Education's K-12 administration and workforce management software; all employees at impacted districts were affected.
- Stolen data includes Social Security numbers, email addresses, and physical addresses; one district reported 1,210 employees impacted.
- Attackers exploited a vulnerability in a third-party software product to gain unauthorized access to part of Frontline's environment, identified on August 14, 2026; the application and initial access date were not disclosed.
- Breach notifications sent October 1 from frontline@notifications.cyberscout.com were independently confirmed as legitimate by school administrators.
- Impacted adults are offered two years of free credit monitoring through TransUnion; districts may opt out of Frontline's notification services by October 16.
🔓 CVEs & KEV
CVE-2026-104846 — lxsmnsyc seroval — CVSS 9.8 — Seroval Deserialization Flaw Enables Remote Code Execution via Malicious Promise Assimilation
CVE-2026-104851 — fsspec filesystem_spec — CVSS 8.8 — fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote...
CVE-2026-104854 — nrwl nx — CVSS 8.5 — Nx daemon and plugin worker sockets are accessible to other local usersNx is ...
CVE-2026-104859 — nrwl nx — CVSS 7.3 — Nx: OS command injection in the @nx/docker release pipelineNx is a monorepo s...
CVE-2026-102795 — Apache Software Foundation Apache Traffic Server — CVSS 7.0 — Apache Traffic Server: SNI to Host header matching policy is not properly enf...
📋 ADVISORIES
GitLab Patches Critical 9.9 AI Gateway Sandbox Escape Flaw (CVE-2026-90970)
CVE-2026-90970
GitLab patched a critical 9.9 flaw in its AI Gateway that let authenticated Duo Agent Platform users execute arbitrary commands on self-hosted gateways.- Applies only to organizations running their own self-hosted GitLab AI Gateway; GitLab.com, GitLab Dedicated, and GitLab-hosted gateway customers are already protected.
- CVE-2026-90970 (CVSS 9.9) is a prompt template sandbox escape (CWE-1336, improper neutralization in a template engine) leading to arbitrary command execution on the gateway.
- An authenticated user with Duo Agent Platform access submits a specially crafted flow configuration to break out of the sandbox; no user interaction required.
- Affected gateway versions: 18.1.6 through before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; fixed in 19.2.4, 19.3.2, and 19.4.1.
- No known exploitation reported (CISA lists exploitation as 'none'); flaw reported via HackerOne by user invisiblemeerkat.
Sources 📄 Source: docs.gitlab.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, thehackerwire.com (discovered)Dell patches six critical CSM flaws, two CVSS 10.0, enabling unauthenticated admin and root access
CVE-2026-63688
Dell has patched six critical vulnerabilities in Container Storage Modules that let unauthenticated attackers steal storage admin credentials and gain root on Kubernetes nodes.- Affects Dell CSM versions prior to 1.18.0, used to connect Kubernetes clusters to PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT storage arrays.
- CVE-2026-63688 (CVSS 10.0) is a missing-authentication flaw in the csm-authorization-storage gRPC server letting unauthenticated attackers retrieve backend admin credentials for all registered arrays.
- CVE-2026-63692 (CVSS 10.0) bypasses authentication in the authorization proxy and tenant service, granting admin control over storage resources across all tenants.
- CVE-2026-67269 (9.9) lets a low-privilege attacker gain root on all Kubernetes cluster nodes via a single custom resource submission; CVE-2026-67273 (9.6) grants cluster-wide read access to Kubernetes Secrets.
- CVE-2026-54472 and CVE-2026-61421 (both 9.8) involve hard-coded credentials and a publicly known JWT signing secret enabling forged admin tokens; fixes are in CSM 1.18.0 with no workarounds available.
- No exploitation in the wild has been confirmed and no public PoC has surfaced.