Skip to content
TrustList

TrustList daily digest · Tech and security

Thursday, 1 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security6

  1. 1Security advisories

    Zammad helpdesk zero-days exploited since 21 September: update to Zammad 7.2.0 or take instances offline

    Two Zammad flaws, CVE-2026-102489 and CVE-2026-102490, are exploited. Zammad says 7.0 and later are not affected by the first and the second needs prior server access; it advises updating to 7.2.0. A fix for the second is pending.

  2. 2Security advisories

    FreePBX publishes four security advisories on 29 September 2026: update the Pinsets, Sangoma Connect, SIPSTATION and Contact Manager modules

    FreePBX’s 29 September advisories fix three high-severity SQL injection flaws (Pinsets, Sangoma Connect RT API, SIPSTATION) and a contact-manager access flaw, after six high or medium advisories on 17 September. All need a login; update the modules.

  3. 3Security advisories

    Kiteworks fixes more than 100 flaws, 12 of them critical, in Core and its Email Protection Gateway: update to 9.5.1

    Kiteworks published more than 100 security advisories on 30 September 2026, 12 rated critical, for Core, the Email Protection Gateway, Secure Data Forms and MFT Server. The most severe, a gateway code-injection flaw, is fixed in 9.4.1; update to 9.5.1.

  4. 4Security advisories

    Zimbra flaw CVE-2026-73570 is being exploited: update to 10.1.20 and check for intrusions

    The Zimbra SNMP command-injection flaw CVE-2026-73570, fixed in 10.1.20 on 20 July 2026, has been on CISA’s exploited list since 21 August. Microsoft saw probing from 28 July. Servers with zimbra-snmp enabled need 10.1.20 and an intrusion check.

  5. 5Security advisories

    MikroTik RouterOS critical flaw CVE-2026-84411 allows unauthenticated root code execution: update to 7.24

    Italy’s national cyber agency warns of a critical flaw in MikroTik RouterOS before 7.24 that lets an unauthenticated remote attacker run code as root or knock the device offline. No exploitation reported. Update routers and switches to 7.24.

  6. 6Security advisories

    JetBrains fixes 12 high-severity flaws in YouTrack, Hub, IntelliJ IDEA and TeamCity: update self-hosted servers

    Italy’s national cyber agency reports JetBrains updates fixing many flaws, 12 rated high, in YouTrack (before 2026.2.19422), Hub, IntelliJ IDEA (before 2026.2.3) and TeamCity (before 2026.1.4 or 2025.11.8). No exploitation reported.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy