HIGH/ SEPTEMBER 5, 2026TODAY’S BRIEFING — #169
PostgreSQL, WordPress plugins, Citrix NetScaler under active attack; Unicode phishing surge
PostgreSQL's 12-year-old logical decoding RCE (CVE-2026-6471) has exploit code public; WordPress plugins face 440K+ attacks; Citrix NetScaler auth bypass actively exploited; Microsoft warns of Unicode phishing at scale.
CVE-2026-6471Postgresql — 12-year-old logical decoding RCE; enables code execution as database OS user; exploit public (PostGREShell)CVE-2026-14894WordPress Super Forms — Missing file type validation RCE; 440K+ exploit attempts documentedCVE-2026-19490Citrix NetScaler — Authentication bypass; [exploitation unverified] in the wildCVE-2026-9586Sangoma Switchvox — Unauthenticated SQL injection enabling arbitrary code execution; exploited in wild
Read the full briefing →