Exploitation, supply chain, and the incident response nobody publishes.
Citrix published fixes for eight NetScaler ADC and Gateway flaws on September 27 and said two were already being exploited. CISA gave federal agencies until September 30.
WordPress shipped 7.1.2 and backports to every branch since 4.7 on September 22 for an unauthenticated file inclusion in page-template resolution. CISA listed it as exploited on September 25.
Plugin4Shell: pinned-commit bypass in four coding agents' plugin installers.
Oracle's September CSPU: 673 patches, six CVSS 10.0, and not cumulative.
Critical SSMS 22 Copilot flaw: crafted prompts could bypass read-only limits. Fixed in 22.8.2, disclosed 42 days later.
Anthropic's Sept 2026 threat report: stolen AI API keys are loot, attack compute and cover, and eval sandboxes leak them.
