Skip to content
TrustList

TrustList daily digest · Tech and security

Friday, 9 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security7

  1. 1Security advisories

    Citrix fixes CVSS 9.5 NetScaler SAML flaw; no attacks seen so far

    Only appliances configured as a SAML service provider or identity provider are exposed; Citrix knows of no exploitation yet, and Shadowserver counts about 21,000 NetScaler fingerprints online.

  2. 2Security advisories

    Veeam fixes critical remote code flaw in Backup & Replication 12

    Version 13 is not affected, and Veeam lists no workaround. Singapore's cyber agency repeated the warning on 9 October, and version 12 reaches end of support on 28 February 2027.

  3. 3Security advisories

    Fortinet ships FortiMail fixes for exploited flaw CVE-2026-104286

    Fortinet's advisory FG-IR-26-175 was updated on 7 October with fixed builds for three branches. FortiMail 7.2 gets no fix and must move to 7.4 or later; Cloud is already patched.

  4. 4Security advisories

    Tenable fixes critical command injection in Identity Exposure SaaS

    The fix ships in SaaS 3.126.0, but the Active Directory listener must also be uninstalled and reinstalled before the flaw is closed. Tenable credits an outside researcher.

  5. 5Security advisories

    AhsayCBS backup flaws exploited to plant miners, no patch confirmed

    Huntress saw the first attack at 23:20 UTC on 7 October, three days after the CVEs were published; the console is popular with managed service providers.

  6. 6Security advisories

    AWS CDK fixes a symlink flaw in Docker asset bundling in 2.267.0

    Every aws-cdk-lib release before 2.267.0 is affected, and the bulletin offers an audit-your-containers workaround for teams that cannot upgrade immediately. AWS does not state a severity score.

  7. 7Security advisories

    Nvidia DCGM Exporter flaw can crash GPU monitoring, fixed in 4.8.2

    Researchers found about 2,100 internet-exposed GPU servers in scans between March and May. Nvidia rates the bug 8.2 and shipped the fix in September; no attacks are reported.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy