A clearer view of today.

CISA adds actively exploited Citrix NetScaler flaw to KEV catalog

CISA added CVE-2026-88779, an improper restriction of operations within a memory buffer in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The agency urges organizations to prioritize remediation; its binding directive applies to federal civilian agencies, while CISA encourages other organizations to use risk-based vulnerability management.

Why it matters For organizations running NetScaler, the listing gives vulnerability teams evidence of exploitation to support remediation prioritization, rather than relying only on the flaw's technical classification.

Google pauses new product vulnerability reports to its open-source bug bounty

Google stopped accepting new product vulnerability submissions to its Open Source Software Vulnerability Reward Program starting October 1, 2026, citing a significant rise in automated submissions, most of which it says are invalid. Reports submitted before that date are unaffected, and the company said it plans to provide an update in the first quarter of 2027.

What changed The bounty previously paid researchers for privately reporting flaws in Google's open-source code; new product-vulnerability submissions are now paused because automated reports have strained review capacity.

Why it matters Researchers finding flaws in Google's open-source products now need to check alternative reporting and reward routes; some Cloud-impacting repositories may still qualify under Cloud VRP, so the pause is not a blanket end to eligibility.

What to watch next Google has committed to an update in Q1 2027. Whether that update will reopen product-vulnerability intake remains unresolved; it is not a confirmed restart date.

Huntress says attackers used legitimate RMM tools in 45% of Q1 endpoint incidents

Huntress reported that legitimate remote monitoring and management software appeared in 45% of the endpoint-related incidents it recorded in the first quarter of 2026. In one case, a fake service agreement led to Tiflux being installed, followed by UltraVNC, Splashtop and ScreenConnect on the same device. Huntress also described attacks involving mailbox rules, stolen session tokens and device-code phishing.

Why it matters For endpoint defenders, legitimate software is not sufficient evidence of legitimate access: an attacker-installed management tool can provide persistent remote control while resembling routine IT activity.

What to watch next A concrete defensive question raised by the researchers is whether security teams know which RMM tools are authorized and can detect an unapproved installation; the report does not establish how widely that capability exists.