SecOraLens
CriticalPhishingCVE-2026-86950

Cybersecurity Newsletter Bulletin – Pentagon Data Breach, Citrix, Fortimail and Apple 0-days and 20+ stories

Cyber Security News·Source published ·1 min read

What happened?

This week’s security newsletter was dominated by a Pentagon personnel data breach affecting more than three million people, actively exploited zero-days in Apple CoreGraphics and Fortinet FortiMail, and reports of two still-unpatched Citrix NetScaler RCE flaws. The broader bulletin covers 26 developments spanning cloud identity, malware, AI-agent governance, remote access, browser security, vulnerable infrastructure, and defensive tooling. Pentagon Data Breach The Pentagon confirmed that unautho

Key details

  • Apple fixed a CoreGraphics out‑of‑bounds write used in a sophisticated targeted attack.
  • FortiMail critical vulnerability allowing unauthenticated file writes is being actively exploited.
  • Two undisclosed NetScaler RCE flaws were found and reportedly used in real‑world attacks.
  • Apache HTTP Server 2.4.69 resolves twenty vulnerabilities ranging from code execution to request smuggling.

Affected

  • Defense Manpower Data Center information system was accessed without authorization.
  • iPhone 11 and later, plus various iPad Pro, Air, standard, and mini models are affected.
  • FortiMail versions 8.0.0‑8.0.1, 7.6.0‑7.6.6, 7.4.0‑7.4.8, and 7.2.0‑7.2.9 are vulnerable.
  • TeamViewer Full Client, Host and related components on Windows, Linux and macOS are impacted.

Fixes and mitigations

  1. DMDC patched the file‑sharing vulnerability on July 16 after discovery.
  2. Disable IBE support or remove the FortiMail management interface from public access.
  3. Upgrade Apache to version 2.4.69 and prioritize systems using vulnerable virtual‑host settings.
  4. Upgrade TeamViewer to version 15.82 or the latest maintenance release.

What to look for

  • Check FortiMail logs and look for file, account, cron and network IoCs.
  • Monitor NetScaler authentication events, configuration changes, file modifications and outbound traffic.
  • Watch for unusual installer activity, malicious recording files, or altered protected files.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories