Microsoft says most regions affected by an Azure network outage are recovering, but five still show impact as the company investigates a disruption tied to infrastructure servicing. The September 30 incident affected ExpressRoute and VPN gateways, Azure VMware Solution, and other network services across 18 regions.

Source

CISA has warned that a pre-authentication flaw in MikroTik RouterOS can let an unauthenticated attacker run code as root or knock a device offline with one crafted HTTP request. The alert lands days after CISA first put MikroTik RouterOS on its exploited-vulnerabilities list, but this new advisory spells out the bug as an integer underflow in the web-management service and says there is no evidence of active exploitation yet.

Source

Unknown attackers are moving beyond initial NetScaler compromise and using root access to plant two new payloads, WHIPSHOT and SLAPSHOT, on Citrix ADC and Gateway appliances. The campaign builds on the same ongoing NetScaler exploitation that has already hit organizations across North America and Europe, but now shows how intruders are modifying appliance configs to keep control and pivot deeper into internal networks.

Source

Citrix NetScaler zero-day exploitation is escalating from patch alerts to full post-compromise tradecraft: attackers are using CVE-2026-88772 and the separately exploited CVE-2026-88771 to plant web shells, gain root access, steal credentials and move into internal networks. The campaign, already flagged in earlier 4sysops coverage of the NetScaler RCE flaws, now appears to have been active since at least early September across government, finance, education, legal and professional-services targets.

Source

CISA says attackers are exploiting globally the two NetScaler RCE zero-days Citrix disclosed this weekend. The urgent alert expands the risk to eight vulnerabilities, including a third critical flaw that can bypass front-end security controls through HTTP request smuggling.

Source

Citrix has patched two critical NetScaler ADC and NetScaler Gateway vulnerabilities that attackers were already exploiting before fixes became available. CVE-2026-88771 enables unauthenticated command execution across affected deployments, while CVE-2026-88772 can provide remote code execution or cause denial of service when DTLS is enabled.

Source

Huawei is shifting its AI infrastructure pitch from faster accelerators to faster connections between them. At Huawei Connect 2026, the company introduced UnifiedBus alongside the Atlas 960E SuperPoD, claiming the architecture can reduce latency, increase bandwidth tenfold, and scale systems for massive agentic-AI workloads.

Source

Microsoft has confirmed that the September 2026 Windows 11 updates can disrupt Always On VPN, expanding the certificate-authentication failures reported after KB5124008 was deployed. The company is investigating the newly acknowledged connection problem, which can leave enterprise devices unable to establish their automatic VPN tunnel.

Source

Cisco’s survey of 1,000 IT and network leaders found that 80% are comfortable giving AI a high or fully autonomous role in network operations. While 56% still require human approval, 24% would allow agents to act without oversight, and 84% expect an AI-led operating model within a year.

Source

Eclypsium’s latest InfraTrust report warns that attackers are increasingly targeting management consoles rather than the firewalls, switches, and routers they control. The September report tracked 158 advisories across 17 vendors, including 71 remotely exploitable flaws requiring no authentication—an escalation from the initial InfraTrust risk database launched in July.

Source

VMware has stopped selling its SmartNIC-based distributed firewall after customers showed interest but failed to buy, marking a retreat from the company’s push to bring hyperscaler-style hardware acceleration to private clouds. The Distributed Services Engine remains supported in Cloud Foundation, so existing SmartNIC integrations are not being abandoned outright.

Source

Check Point is urging immediate patching for CVE-2026-91843, a critical flaw in Security Management and Log Servers that can let attackers execute code as root through an oversized login username. The vulnerability affects R82.20, standalone deployments, Log Servers, and Multi-Domain systems; Check Point says there is no evidence of exploitation, but R82.20 has no protective Jumbo Hotfix yet.

Source

Cisco has released emergency fixes for CVE-2026-76460 after confirming that the Cisco ISE zero-day is under active attack. The maximum-severity flaw lets unauthenticated remote attackers bypass web management authentication and potentially obtain root access, making immediate patching a priority.

Source

BIND 9.20.29 and 9.21.26 fix 14 security vulnerabilities, including a high-severity flaw that lets an unauthenticated attacker crash the `named` DNS process through a single malicious DNS-over-HTTPS request. ISC says it has seen no active exploitation, but administrators should upgrade because the release also addresses resolver crashes, resource exhaustion, DNSSEC validation errors, and unauthorized zone data.

Source

Unbound DNS resolver versions up to 1.26.0 contain a critical DNSSEC heap overflow that attackers can trigger by controlling a malicious DNS zone and querying a vulnerable resolver. NLnet Labs released Unbound 1.26.1 to fix CVE-2026-81642 and eight other vulnerabilities, but no exploitation has been reported.

Source

Microsoft is outlining a practical route for replacing traditional VPN access with Microsoft Entra Private Access, using identity, device health, and application-level policies instead of broad network tunnels. The phased approach starts with discovering VPN-dependent resources and ends with incremental decommissioning, helping administrators modernize remote access without disrupting critical applications.

Source