Research
In the news.
What happened in a major security event, why it matters, and what to check on your own systems.
Citrix NetScaler zero-day: unauthenticated command execution on the gateway
On 27 September 2026 Citrix fixed a critical NetScaler flaw that was already being exploited. What it is and how to check your appliances.
ConnectWise Cloud Backup: a vendor credential, and Microsoft 365 tenants
In October 2026 attackers used a Cloud Backup application's credential to sign in to customer Microsoft 365 tenants. What is known, and what to check in your tenant.
PHP2Shell: two critical PHP bugs, already exploited
PHP shipped emergency fixes on 21 October 2026 for two remote code execution flaws. What happened, and what to check on your servers.
My own findings will go here once they are published. I only publish with permission from the affected party.
Spotted an error in a post? Email hello@ryanhenrick.com.