https://getpentest.ca/brief A free weekly email on the vulnerabilities being exploited this week, what they mean for your next penetration test, and what to patch first. en-CA https://getpentest.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms https://getpentest.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms Tue, 29 Sep 2026 13:00:00 +0000 Eight NetScaler flaws, two already being exploited. Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, and CISA added two of them to the Known Exploited Vulnerabilities catalogue. https://getpentest.ca/brief/7-fake-government-requests-real-ai-attacks https://getpentest.ca/brief/7-fake-government-requests-real-ai-attacks Tue, 22 Sep 2026 13:00:00 +0000 Exposed Vite dev servers are being scanned for cloud keys. F5 Labs described an automated mass-scanning campaign hunting internet-exposed Vite development servers. https://getpentest.ca/brief/6-revolut-handed-data-to-a-fake-government-request https://getpentest.ca/brief/6-revolut-handed-data-to-a-fake-government-request Tue, 15 Sep 2026 13:00:00 +0000 Artifactory auth bypasses are now on the exploited list. CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalogue on September 11. https://getpentest.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 https://getpentest.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 Tue, 01 Sep 2026 13:00:00 +0000 JFrog Artifactory flaw lands in the KEV catalogue. CISA added three actively exploited vulnerabilities to the Known Exploited Vulnerabilities catalogue: an ownCloud authentication flaw, an unspecified Linux kernel issue, and a path traversal issue in JFrog Artifactory. CISA red-teamed two organizations and only one saw it coming. CISA ran simultaneous red team assessments at two organizations and published the comparison. https://getpentest.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold https://getpentest.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold Tue, 25 Aug 2026 13:00:00 +0000 Microsoft patches a 10.0 in Entra ID. Microsoft patched CVE-2026-69836, a remote code execution flaw in Entra ID carrying a CVSS score of 10.0, which was initially reported as exploited in the wild. https://getpentest.ca/brief/1-a-250-000-penalty-and-a-vendor-that-went-dark https://getpentest.ca/brief/1-a-250-000-penalty-and-a-vendor-that-went-dark Tue, 11 Aug 2026 13:00:00 +0000 Hidden prompt injection is showing up in "Ask AI" buttons on marketing pages. Researchers observed production websites embedding hidden prompt injection payloads inside pre-filled deep links behind "Ask AI" buttons, including on marketing and competitor comparison pages.