SecPoint

Progress WS_FTP Server: Critical Security Vulnerabilities Progress Software has disclosed critical WS_FTP Server vulnerabilities on Windows. CVE-2026-84295 (CVSS 10.0) could expose administrative credentials to unauthenticated attackers. CVE-2026-90868 (CVSS 9.9) could allow attackers with low privileges to execute operating-system commands under certain configurations. Identify potentially affected systems and update to WS_FTP Server 2024.0.7 or 2025.0.4, or a later supported release for your branch. Restrict administrative access and investigate possible credential exposure. SecPoint has developed a targeted remote assessment for SecPoint Penetrator to help identify potentially affected WS_FTP Server versions. Contact us about availability and assessing your deployment. Scan with SecPoint Penetrator to uncover vulnerabilities, identify exposed services and prioritize critical security updates. Request a product demo: secpoint.com/contact-us.php Become a SecPoint partner: secpoint.com/partner-signup.… Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #WSFTP #FileTransferSecurity #VulnerabilityManagement #CyberSecurity

Adobe Campaign Classic: Eight Critical Vulnerabilities Adobe has released fixes for eight critical vulnerabilities, including low-privilege code execution (CVE-2026-104351) and unauthenticated SQL injection (CVE-2026-105781). Potentially affected systems include Campaign Classic v7 7.4.4 build 9402 and earlier on Windows and Linux. Adobe identifies build 9403 as the security fix and reported no known exploitation when publishing its bulletin. On-premise and hybrid administrators should install the update and restart the Campaign server. Adobe-hosted instances have already been remediated. SecPoint has developed a targeted remote assessment for SecPoint Penetrator to help identify potentially affected Adobe Campaign Classic v7 components. Contact us about availability and assessing your deployment. Scan with SecPoint Penetrator to uncover vulnerabilities, identify exposed services and prioritize critical security updates. Request a product demo: secpoint.com/contact-us.html Become a SecPoint partner: secpoint.com/partner-signup.… Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #AdobeCampaign #ApplicationSecurity #VulnerabilityManagement #CyberSecurity

Cyprus is a beautiful country, and it was a great pleasure to visit Nicosia for The Future of Cybersecurity 2026, organized by Data Ally on 23 September. During my speaking engagement, I had the opportunity to showcase the latest SecPoint Penetrator Vulnerability Scanner and demonstrate how organizations can identify security vulnerabilities across networks, servers, web applications, and exposed services. SecPoint Penetrator combines advanced CVE detection, authenticated Windows vulnerability and patch scanning, automated network security assessments, full 65,535 TCP port scanning, CIDR network scanning, SSL/TLS security checks, Dark Web Search, and visual network mapping. With customizable white-label reporting, CVSS risk scoring, XLS exports, and detailed vulnerability reports, Penetrator also provides a powerful solution for IT security providers, MSPs, and cybersecurity partners looking to deliver professional vulnerability assessment services under their own brand. With new vulnerabilities constantly being discovered and cyber threats evolving, proactive vulnerability scanning is more important than ever. Outside the conference, I also had some time to explore the beautiful city of Nicosia with my cybersecurity book, "How They Hack You?!" I visited the impressive Eleftheria Square, designed by Zaha Hadid Architects, the historic Faneromeni Church, and the lively Ledra Street in the old town. Nicosia is a fascinating combination of modern architecture, history, and culture. Cyprus is definitely a wonderful country to visit, with welcoming people and a great atmosphere. Many thanks to Data Ally for organizing the event and bringing cybersecurity professionals together to exchange knowledge and discuss the future of cybersecurity. Get a Free Vulnerability Scan: secpoint.com/free-vulnerabil… Become a SecPoint Partner: secpoint.com/partner-signup.… #SecPoint #Penetrator #Cybersecurity #Nicosia #Cyprus

WatchGuard Fireware OS: Critical Firewall Vulnerabilities and New Penetrator Checks On 27 October 2026, WatchGuard disclosed serious vulnerabilities affecting Fireware OS, including CVE-2026-93857, CVE-2026-93865 and CVE-2026-93866. All three are rated Critical (CVSS 9.2). Depending on configuration, the flaws may permit unauthenticated code execution through the SIP proxy, privileged FireCluster actions or Access Portal memory corruption. SecPoint Penetrator now includes targeted remote WatchGuard firmware assessments, identifying Fireware OS versions affected by these CVEs when reliable version information is available. Our comprehensive vulnerability scanning platform helps organizations discover exposed infrastructure, prioritize security updates and strengthen vulnerability management across vendors. Apply Fireware OS 2026.4, 12.12.4 or 12.5.22 for applicable T15/T35 devices. Request a product demo: secpoint.com/contact-us.html Become a SecPoint partner: secpoint.com/partner-signup.… Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #WatchGuard #FirewareOS #VulnerabilityScanning #CyberSecurity

HashiCorp Consul: Critical Service Mesh Security Vulnerabilities On 26 October 2026, HashiCorp disclosed serious authorization vulnerabilities affecting Consul and consul-k8s. CVE-2026-105765 may expose cached service certificates and private keys through accessible Consul agent APIs without a valid ACL token. CVE-2026-110720 may allow attackers with specific Kubernetes permissions to obtain elevated Consul privileges. SecPoint Penetrator delivers comprehensive remote vulnerability scanning across business-critical infrastructure. We are expanding Penetrator with dedicated HashiCorp Consul version checks to identify affected software releases through reliable remote assessment. Our continuously evolving vulnerability assessment platform helps organizations discover security weaknesses, identify exposed systems and prioritize critical updates. Discover vulnerabilities before attackers exploit them. Strengthen your security with SecPoint Penetrator. Request a product demo: secpoint.com/contact-us.html Become a SecPoint partner: secpoint.com/partner-signup.… Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #HashiCorp #Consul #VulnerabilityScanning #CyberSecurity

SecPoint Penetrator V69: New One-Page Security Assessment Certificate SecPoint Penetrator V69 introduces a new One-Page Certificate for Vulnerability Assessment and Penetration Testing (VAPT) technical-readiness assessments. In this video, we demonstrate the new certificate option and how administrators can generate professional assessment documentation directly from the Report menu. The new certificate includes: ✔ Overall vulnerability assessment results and technical-readiness conclusion ✔ Assessment date, scanned targets and scan profile ✔ Technical-readiness level against the selected security standard or scan profile ✔ Security best-practice recommendations ✔ Clear certificate validity conditions in a professional one-page format The new certificate is ideal for customer documentation, audit evidence and communicating technical security assessment results. 🔹 Request a product demo: secpoint.com/contact-us.html 🔹 Become a SecPoint partner: secpoint.com/partner-signup.… 🔹 Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #CyberSecurity #VulnerabilityScanning #Penetrator #SecurityAssessment

HPE Aruba Networking: 72 Critical Security Vulnerabilities Disclosed! On 22 October 2026, HPE disclosed 72 vulnerabilities affecting ArubaOS AOS-8 and AOS-10, including eight with the maximum CVSS score of 10.0. Several vulnerabilities could allow unauthenticated attackers to bypass authentication or execute malicious code on potentially affected wireless controllers, gateways and access points. Some attack scenarios require additional preconditions. Organizations should restrict management interfaces and upgrade to the relevant fixed versions: AOS-10 10.8.1.2, 10.7.2.7 or 10.4.1.14, and AOS-8 8.13.3.1 or 8.10.0.24. SecPoint Penetrator now includes targeted remote vulnerability checks for these critical HPE ArubaOS security flaws! Our comprehensive vulnerability scanning platform can remotely identify HPE ArubaOS firmware versions potentially affected by these vulnerabilities, where reliable version information is available. SecPoint Penetrator helps organizations discover vulnerable infrastructure, identify critical security weaknesses and prioritize urgent security updates. Don't wait for attackers to find your weaknesses. Find them first with SecPoint Penetrator! 🔹 Request a product demo: secpoint.com/contact-us.html 🔹 Become a SecPoint partner: secpoint.com/partner-signup.… 🔹 Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #ArubaNetworking #WirelessSecurity #VulnerabilityManagement #CyberSecurity

eMudhra Certificate Trust Incident: Remote TLS Checks in SecPoint Penetrator On 20 October 2026, Mozilla and Google disclosed weak private keys affecting eight eMudhra intermediate CAs, including six TLS issuers. The affected intermediates issued no customer certificates, but browser vendors have blocked them and are removing trust in the related G3 root hierarchy. SecPoint Penetrator's new remote checks inspect server-presented TLS certificate chains for exact affected eMudhra fingerprints and potential G3 certificate-trust failures. These findings identify observable certificate exposure, not whether a server's outbound applications trust compromised CAs. Review affected HTTPS services and migrate certificates to a trusted hierarchy where needed. Chrome's G3 root removal reaches its stable rollout from 27 October 2026. 🔹 Request a product demo: secpoint.com/contact-us.html 🔹 Become a SecPoint partner: secpoint.com/partner-signup.… 🔹 Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #Penetrator #eMudhra #TLS #CyberSecurity

Critical Arista VeloCloud Vulnerability Under Active Exploitation Arista has disclosed CVE-2026-114625, a critical SQL injection vulnerability (CVSS 9.9) affecting VeloCloud Orchestrator. Attackers with even low-privilege portal access may escalate to superuser operator privileges, potentially compromising business-critical SD-WAN infrastructure. Active exploitation has been confirmed. Organizations should review potentially affected on-premises deployments and upgrade to the appropriate fixed releases: 5.2.3.18, 6.1.3.10 or 6.4.2.12. SecPoint Penetrator helps organizations identify security weaknesses, assess network exposure and strengthen vulnerability management. 🔹 Request a product demo: secpoint.com/contact-us.html 🔹 Become a SecPoint partner: secpoint.com/partner-signup.… 🔹 Get a FREE vulnerability scan: secpoint.com/free-vulnerabil… #SecPoint #Arista #VeloCloud #CyberSecurity #VulnerabilityManagement

Critical GitLab Vulnerability: CVE-2026-110264 (CVSS 10.0) GitLab disclosed a critical flaw on 21 October 2026 affecting self-managed GitLab Community and Enterprise Edition. Under certain conditions, an unauthenticated attacker could execute code through an integer overflow in the regular-expression compiler. Is your GitLab infrastructure exposed? Scan with SecPoint Penetrator™. SecPoint Penetrator helps identify exposed services, outdated software, and security weaknesses through actionable vulnerability reports. A GitLab-specific version assessment is undergoing validation and can flag potentially affected installations when trustworthy version information is available. Upgrade affected systems to GitLab 19.5.1, 19.4.3, 19.3.6, or the applicable patched backport (19.2.9, 19.1.9, 19.0.10, 18.11.13). Request a product demo: secpoint.com/contact-us.php Become a SecPoint partner: secpoint.com/partner-signup.… #GitLab #CVE2026110264 #SecPointPenetrator #Cybersecurity #VulnerabilityManagement

Is your Node.js application vulnerable to CVE-2026-111497? A newly disclosed High-severity vulnerability in the Node.js Brotli decoder could allow remote code execution when attacker-controlled compressed data reaches the affected component. Don't leave your infrastructure unchecked. Scan with SecPoint Penetrator™. SecPoint Penetrator helps organizations discover exposed services, identify outdated software and prioritize vulnerabilities with actionable security reports. Our new Node.js assessment is undergoing release validation and can identify potentially affected runtime versions when reliable version information is available. Update Node.js to 22.23.4, 24.22.1 or 26.12.1, as applicable. Request a SecPoint Penetrator demonstration: secpoint.com/contact-me.php **Become a SecPoint partner:** secpoint.com/partner-signup.… #NodeJS #CVE2026111497 #SecPointPenetrator #VulnerabilityScanning #Cybersecurity

PHP critical vulnerabilities: scan with SecPoint® Penetrator™ PHP has released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow unauthenticated remote code execution. Apache mod_php deployments are particularly exposed. Scan with SecPoint Penetrator to help identify potentially affected PHP systems and prioritise remediation. Detection depends on sufficient system information being available. Affected unpatched upstream versions → first fixed release 8.2.0–8.2.34 → 8.2.35 8.3.0–8.3.35 → 8.3.36 8.4.0–8.4.26 → 8.4.27 8.5.0–8.5.11 → 8.5.12 Temporary hardening is not a complete fix. Upgrade promptly, confirm vendor backports where applicable, and verify the PHP runtime serving each website. Older branches require appropriate vendor fixes or migration to a supported release. Scan. Patch. Verify. Test SecPoint Penetrator: secpoint.com/contact-me.html Become a SecPoint partner: secpoint.com/partner-signup.… #PHP #CyberSecurity #VulnerabilityManagement #Penetrator #SecPoint

PHP: Upcoming Critical Security Release PHP’s security team has announced an upcoming release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. Public reporting identifies the issues as CVE-2026-109618 and CVE-2026-109619. Technical details and affected-version information are scheduled for Wednesday, 21 October 2026 at 14:00 UTC. PHP may release earlier if vulnerability details become public or active exploitation is detected. Local release times: Copenhagen / Stockholm: 16:00 CEST · London: 15:00 BST New York: 10:00 EDT · San Francisco: 07:00 PDT Dubai: 18:00 GST · Singapore: 22:00 SGT SecPoint encourages organizations to review potentially affected systems, coordinate with hosting providers and prepare to apply the appropriate security updates promptly once available. #PHP #CyberSecurity #CVE-2026-109619 #CVE-2026-109618 #SecPoint

🇬🇪 Exploring Georgia with SecPoint’s How They Hack You, from the impressive Chronicle of Georgia to panoramic views over Tbilisi’s Old Town and the Bridge of Peace, and the iconic Mother of Georgia (Kartlis Deda). With her bowl of wine welcoming friends and her sword ready to defend against enemies, Mother of Georgia offers a fitting reminder for the digital age: stay open and connected, but protect what matters. At SecPoint, we bring that mindset to modern cyber defence: understand how attackers think, recognise the risks, and strengthen your digital defences. Wherever the journey takes us, cybersecurity awareness matters. 👉 Ready to strengthen your cyber defences? Learn more and contact SecPoint: secpoint.com/contact-me.html 🤝 Grow your cybersecurity business. Sign up as a SecPoint partner: secpoint.com/partner-signup.… #SecPoint #CyberSecurity #HowTheyHackYou #Georgia #Tbilisi

Microsoft SQL Server: Remote Code Execution Vulnerability Microsoft disclosed CVE-2026-65674 on 13 October 2026, a high-severity vulnerability affecting specified SQL Server 2019, 2022 and 2025 releases. The flaw involves deserialization of untrusted data and could allow an authenticated attacker with low privileges to execute code over the network. This is not an unauthenticated attack. Organizations should review potentially affected systems and apply Microsoft's security updates for the correct release and servicing branch. Restrict unnecessary database exposure and review account permissions. SecPoint has developed a new assessment for SecPoint Penetrator to help identify potentially affected SQL Server installations. #SecPoint #SQLServer #DatabaseSecurity #CyberSecurity #VulnerabilityManagement

🚨 Critical Ollama Vulnerability: CVE-2026-103663 A critical security vulnerability has been disclosed in Ollama, the popular platform for running AI models locally and on private infrastructure. The vulnerability allows unauthenticated attackers to exploit a path traversal weakness in the model-pull functionality, potentially writing malicious files outside the intended model directory. Under specific deployment conditions, particularly affected Docker installations with writable executable paths, this could lead to remote code execution following a server restart. Ollama versions 0.34.2 through 0.34.x are potentially affected. Organizations should upgrade to version 0.35.0 or later and restrict unnecessary access to the Ollama API. SecPoint Penetrator continues expanding its vulnerability assessment capabilities to address emerging threats across AI infrastructure. #SecPoint #Ollama #AISecurity #CyberSecurity #VulnerabilityManagement

🚨 Critical Citrix NetScaler Vulnerability Disclosed Citrix has disclosed CVE-2026-107406, a critical vulnerability affecting NetScaler ADC and NetScaler Gateway, with a CVSS 4.0 score of 9.5. The vulnerability could potentially allow remote code execution or denial of service on affected systems. Exploitation requires specific SAML Service Provider or Identity Provider configurations, depending on the installed version. Citrix has released security updates, and organizations should review their NetScaler deployments and apply the relevant fixes. At SecPoint, we continuously follow emerging cybersecurity threats to help organizations understand and assess their exposure. #SecPoint #Citrix #NetScaler #CyberSecurity #VulnerabilityManagement

FortiMail security alert: actively exploited vulnerability CVE-2026-104286 can allow an unauthenticated attacker to write arbitrary files through FortiMail’s web management interface. CERT-SE reports that the vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue. SecPoint Penetrator includes an assessment for CVE-2026-104286 to help identify potentially affected FortiMail systems and prioritize remediation. Review exposed installations, follow Fortinet’s mitigation guidance and investigate possible compromise. Scanning supports prioritization but does not replace incident investigation. SecPoint Penetrator Information linkedin.com/products/secpoi… SecPoint Penetrator Contact information secpoint.com/contact-me.html SecPoint Penetrator Partner Sign Up secpoint.com/partner-signup.… #FortiMail #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator

Great meeting Fotis Chalios, Cybersecurity Specialist and Technical Manager at Data Ally, during The Future of Cybersecurity 2026 in Nicosia, Cyprus! 🇨🇾 It was a pleasure exchanging ideas about today's cybersecurity challenges, emerging threats, and practical security solutions. Fotis brings impressive technical expertise and valuable insights into cybersecurity. His experience is also valuable in helping organizations get the most out of the SecPoint Penetrator vulnerability scanning solution. Always great to connect with knowledgeable cybersecurity specialists who are passionate about making organizations more secure. Thanks to Fotis for the great conversation and to Data Ally for organizing an excellent event! #SecPoint #DataAlly #Cybersecurity #FutureOfCybersecurity #Cyprus

Citrix NetScaler security alert: two actively exploited vulnerabilities Citrix has confirmed exploitation of CVE-2026-88771 and CVE-2026-88772 in unmitigated NetScaler deployments. The first can allow unauthenticated command execution. The second can lead to remote code execution or denial of service when DTLS is enabled. SecPoint Penetrator includes assessments for both CVEs to help identify potentially affected NetScaler systems and prioritize remediation. Review exposed gateways, apply the appropriate Citrix updates and investigate possible compromise. linkedin.com/products/secpoi… #NetScaler #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator