Faizan Akhtar | Cyber Security Researcher & Bug Bounty Hunter

Summary On October 6, 2026, SonicWall published advisory SNWLID-2026-0017 disclosing CVE-2026-102255 , a CVSS 10.0 pre-authentication server-side request forgery (SSRF) in the SMA1000 series secure access appliances. An unauthenticated remote attacker can abuse the WorkPlace interface to force the appliance into issuing attacker-chosen requests. Honeypot telemetry recorded real exploitation attempts within roughly 24 hours of disclosure . This is the third pre-auth SSRF in the same WorkPlace interface this year. There is no workaround — patching is the only fix. Severity CVE ID: CVE-2026-102255 CVSS 3.1: 10.0 (Critical) — scope changed Attack requirements: None — unauthenticated, remote Exploited in the wild: Yes — attempts ~24h after disclosure Workaround: None Affected Versions SMA1000 series (SMA 6210, 7210, 8200v): firmware 12.4.3-03526 and older, 12.5.0-02952 and older. Fixed in 12.4.3-03670 and 12.5.0-03082. SMA 100 series and firewall SSL-VPN not affected. Technica...

Summary On October 5, 2026, Atlassian disclosed CVE-2026-21589 , a critical arbitrary file-access vulnerability affecting its self-hosted Data Center product line. The flaw lets a remote attacker with no credentials at all read specific files sitting in the web application's root directory — on Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Atlassian rated it CVSS 9.3 (Critical) . One day later, security researchers at WatchTowr published a full technical analysis with a working proof of concept — and within hours, real exploitation attempts were already hitting honeypots. Severity CVE ID: CVE-2026-21589 CVSS 3.1: 9.3 (Critical) Attack requirements: None — unauthenticated, remote, low complexity Impact: Arbitrary file read (confidentiality); can escalate to full compromise Exploited in the wild: Attempts observed within hours of PoC release (October 6) Affected Versions Every self-hosted Data Center product is affecte...

Some vulnerabilities are interesting because of their complexity. Others are terrifying because of their simplicity. The GitHub Actions RCE reported against DuckDuckGo in 2026 falls firmly in the second category: one misconfigured workflow file, zero required privileges beyond a free GitHub account, and a straight path from a forked pull request to a poisoned release shipped inside every DuckDuckGo browser on the planet. This is my original analysis of a disclosed finding by independent researcher 6r1ff1n , reported through DuckDuckGo's HackerOne program (report #3619287 — full disclosure: https://hackerone.com/reports/3619287). What follows is my own breakdown of the technique, the attack chain, and the lessons for hunters and defenders. Analysis by Faizan Akhtar. The Discovery at a Glance In early 2026, 6r1ff1n was reviewing DuckDuckGo's public GitHub repositories when one workflow file stood out: .github/workflows/semver-label.yml in duckduckgo/content-scope-scripts — ...

Summary On October 2, 2026, Microsoft broke its normal patch rhythm and shipped an out-of-band security update for Microsoft Exchange Server. The reason: CVE-2026-96940 , an elevation-of-privilege vulnerability that lets an authenticated attacker read other users' mailboxes inside the same organization. Microsoft rated it CVSS 8.8 (High) and — unusually — tagged it "Exploitation More Likely" even though no attacks have been observed yet. When Microsoft releases a fix eleven days before Patch Tuesday for a flaw nobody has publicly disclosed, that is a signal defenders should not ignore. Severity CVE ID: CVE-2026-96940 Title: Microsoft Exchange Server Elevation of Privilege Vulnerability CVSS 3.1: 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Exploitability assessment: Exploitation More Likely Publicly disclosed: No | Exploited in the wild: No (as of the advisory) Weakness: Weak authorization (listed as CWE-1390) The vector tells the story in one lin...

If you are a NetScaler administrator, the last two weeks have felt like a treadmill: on September 27 Citrix shipped emergency fixes for two exploited zero-days (CVE-2026-88771, CVE-2026-88772), on October 3 it shipped another for a SAML zero-day (CVE-2026-88779) — and on October 8, 2026 , it did it again. Bulletin CTX697191 discloses CVE-2026-107406 , a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service on appliances configured for SAML authentication, rated CVSS 4.0 9.5 (Critical) . The cruelest detail: if you patched for the October 3 zero-day and your appliance is a SAML Identity Provider, you are still vulnerable. Here is my analysis of the flaw, the version maze, and the exact builds that end the cycle. Summary CVE-2026-107406 is an improper restriction of operations within the bounds of a memory buffer (CWE-119) — a memory overflow — in the SAML authentication handling of NetScaler ADC and NetScaler Gateway. Whe...

On October 1, 2026, Fortinet published advisory FG-IR-26-175 for a vulnerability already being exploited against real customer appliances: CVE-2026-104286 , a path traversal flaw in FortiMail that lets an unauthenticated attacker write arbitrary files to the appliance's underlying system through crafted HTTP or HTTPS requests. Rated CVSS 9.8 and listed in CISA's Known Exploited Vulnerabilities catalog the same day, this is a zero-day in the truest sense — Fortinet's own Product Security team discovered it while investigating attacks already in progress. FortiMail sits in front of your organization's email flow, which makes this one of the worst places a file-write primitive can land. Here is my full analysis of the bug, the attack chain, and exactly what to do about it. Summary CVE-2026-104286 combines two weaknesses working together: improper limitation of a pathname to a restricted directory (CWE-22, classic path traversal) and improper neutralization of a NULL by...

WordPress site owners have had a rough year with the Super Forms – Drag & Drop Form Builder plugin. In July 2026, researchers disclosed a critical unauthenticated file-upload flaw (CVE-2026-14894) that attackers began exploiting within days — security teams ultimately blocked more than 250,000 exploit attempts against it. Now, on October 8, 2026, a second critical vulnerability has surfaced in the same plugin: CVE-2026-17609 , an unauthenticated arbitrary directory deletion flaw rated CVSS 9.1. An attacker with no account on your site can recursively delete any directory on the server — including the entire WordPress installation. Here is the full analysis. Summary CVE-2026-17609 affects the Super Forms – Drag & Drop Form Builder plugin for WordPress (vendor: Rens Tillmann / WebRehab), a form builder with an estimated 13,000+ active installations. The plugin's submit_form function fails to properly validate attacker-controlled JSON field declarations against the actual ...