NetScaler CVE-2026-88779: Exploited SAML Flaw Needs Newer Builds Than Last Week's Zero-Day Fixes
CVE-2026-88779 can knock SAML-configured NetScaler ADC and Gateway appliances offline and is on CISA's exploited list. The fixed builds are newer than …
Tag
Incident Response
Cisco Catalyst SD-WAN Manager CVE-2026-76504: Fixed Releases and Log Checks
Cisco says an unauthenticated authentication bypass in Catalyst SD-WAN Manager is being exploited. There is no workaround, only upgrades, a temporary …
Zammad Zero-Days CVE-2026-102489 and CVE-2026-102490: What Is Fixed and What Is Not
Two Zammad flaws chained in the breach of the Dutch Institute for Vulnerability Disclosure are on CISA's exploited list. The sources disagree on which …
FortiMail CVE-2026-104286: Affected Builds, IBE Workaround
Fortinet says an unauthenticated file-write flaw in FortiMail is being exploited, and as of October 4, 2026 its advisory still lists the fixed builds …
Citrix NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772): Patch, Then Hunt
Two NetScaler ADC and Gateway flaws were exploited before Citrix disclosed them on September 27, 2026. Upgrading closes the hole. It does not tell you …
Logging for Incidents, Not for Dashboards
Most logging strategies optimize for building dashboards, then fail the one test that matters: can you reconstruct what happened during an actual …
The Tabletop Exercise Gap: Testing Incident Response for Real
Tabletop exercises satisfy the audit requirement but rarely test whether your team can actually execute under pressure. Here's the gap and how to …
Alert Fatigue Is a Security Metric, Not a Morale Problem
Teams treat alert fatigue as a burnout issue to manage around. It's actually a leading indicator that your detection pipeline is broken.
Why Your Incident Postmortems Aren't Preventing Repeats
Blameless postmortems became standard practice for good reasons, but most teams stopped halfway through adopting them — and it shows in the repeat …