ZeroDay Findings
Sign inSign up

Every 24 hours

Tech News

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Oct 14, 2026

    Citrix, Fortinet, and Ivanti Address Critical Vulnerabilities in Latest Patches

    In a significant security update, Citrix, Fortinet, and Ivanti have released patches for a total of 29 vulnerabilities identified across their product lines. These vulnerabilities are of critical severity and pose serious risks, including potential authentication bypass, remote code execution, and the exposure of sensitive authentication data. Organizations using affected products are urged to apply these patches promptly to mitigate the risk of exploitation.

    What changed

    The flaws impact a wide range of enterprise solutions, which could leave many businesses vulnerable to cyberattacks if left unaddressed. Security teams are particularly concerned about the authentication bypass vulnerabilities, as they could allow unauthorized access to sensitive systems and data, leading to potential data breaches or further exploitation.

    Who is affected

    In addition to authentication bypass, the potential for remote code execution raises alarms regarding the integrity and security of affected systems. Attackers could leverage these vulnerabilities to execute arbitrary code, potentially compromising entire networks and leading to significant operational disruptions.

    What it means

    Organizations utilizing Citrix, Fortinet, and Ivanti products are advised to prioritize the application of these patches as part of their incident response strategies. Failure to act could result in severe consequences, including financial losses, reputational damage, and regulatory penalties. As the threat landscape continues to evolve, maintaining up-to-date security practices is essential for safeguarding critical infrastructure.

  2. Oct 14, 2026

    Critical Vulnerability Discovered in WP SYNTEX Polylang Plugin

    A significant security vulnerability, identified as CVE-2026-97278, has been found in the WP SYNTEX Polylang plugin, which is widely used for multilingual content management in WordPress. This flaw, categorized as a deserialization of untrusted data issue, permits object injection, potentially allowing attackers to manipulate the application in harmful ways. The vulnerability impacts all versions of the Polylang plugin up to and including 3.8.9, making a substantial number of WordPress installations susceptible to exploitation.

    What changed

    Users of the Polylang plugin should take immediate action to assess their systems for the presence of this vulnerability. The nature of the flaw means that it can be exploited by malicious actors to execute unauthorized commands or access sensitive data, which could lead to further compromises within the affected WordPress sites. As Polylang is a popular tool among developers and content creators for managing multilingual sites, the risk of widespread impact is significant.

    Who is affected

    Website administrators are urged to update their Polylang plugin to the latest version that addresses this vulnerability. Failure to do so not only leaves the site exposed to potential attacks but also undermines the integrity and trustworthiness of the online presence. This incident highlights the ongoing need for vigilant monitoring and timely updates in the ever-evolving landscape of web security.

    What it means

    In light of this discovery, organizations utilizing the Polylang plugin should also review their overall security posture, including the implementation of security best practices and regular vulnerability assessments. The incident serves as a reminder of the importance of maintaining up-to-date software and being proactive in identifying and mitigating security risks in web applications.