A clearer view of today.

CISA warns of critical pre-authentication flaw in MikroTik RouterOS

CISA says RouterOS versions earlier than 7.24 contain an integer-underflow vulnerability in HTTP request handling that an unauthenticated network attacker could exploit with a crafted request to execute code as root or cause denial of service. The advisory rates the flaw critical and recommends updating; it notes MikroTik’s guidance to install version 7.23 or later.

Why it matters For operators whose RouterOS management service is reachable by an attacker, authentication is not a barrier to root-level compromise or service disruption.

What to watch next The unresolved question is which minimum release resolves the flaw: the advisory lists versions below 7.24 as affected but recommends 7.23 or later.

Citrix NetScaler zero-day exploitation expands to mass attacks

Help Net Security reports that attacks against internet-exposed, unpatched Citrix NetScaler ADC and Gateway systems have escalated from stealthy zero-day targeting to widespread exploitation. The report attributes the shift to publication of a root-cause analysis and proof-of-concept exploit for CVE-2026-88771, which it says is remotely exploitable on devices with the default configuration.

What changed Previously stealthy zero-day targeting has broadened into widespread exploitation, which the report links to public technical analysis and proof-of-concept code.

Why it matters Operators of internet-facing, unpatched NetScaler deployments cannot treat this as a risk confined to unusual configurations or selectively chosen targets.

Apple patches actively exploited Core Graphics zero-day

Apple has released iOS and macOS security updates for CVE-2026-86950, an actively exploited vulnerability in the Core Graphics framework, according to the report. Apple said the issue may have been used in an “extremely sophisticated” attack against specific targeted individuals on iOS versions before iOS 27, but provided no further details about the attacks or targets.

Why it matters iOS and macOS users have fixes for a flaw linked to real attacks, but the disclosed targeting concerns pre-iOS 27 devices; the report does not establish attacks against macOS.

What to watch next The attack method and identities of the targets remain undisclosed; the source reports no commitment to release further details.

Detectify finds most open critical and high flaws have lingered over 90 days

In a snapshot of data from 1,293 customers in the US, UK and Nordic countries, Detectify found that more than 90% of open critical- and high-severity vulnerabilities had been exposed for over 90 days in the Nordics and UK, and 86% in the US. The company cautions that this snapshot does not measure typical patching speed and that some lingering issues may be deliberately accepted; it describes default acceptance without a decision as “risk tolerance drift.”

Why it matters For vulnerability-program owners, an old backlog can conceal unmanaged risk rather than demonstrate universally slow patching; deliberate acceptance and neglect require different responses.

What to watch next The concrete review question is whether each longstanding finding has an explicit acceptance decision, rather than simply having remained open.

CISA advisory flags critical command-injection flaw in VIVOTEK camera firmware

CISA’s advisory says a command-injection vulnerability in listed VIVOTEK camera firmware could allow remote command execution, potentially with root privileges and full device compromise. The advisory assigns the flaw a CVSS 3.1 score of 10; the supplied record lists affected models but does not provide remediation details.

Why it matters For operators of the listed cameras, the potential impact extends beyond device availability: successful exploitation could give an attacker control of the camera system.