The US IT security agency CISA is warning about observed attacks on numerous software products. The list ranges from Red Hat and MS SQL to Ajax.NET, Linux, Citrix NetScaler, and Gitea. Updates have in some cases been available for a while, and some of the flaws now under attack are more than ten years old.
Critical flaw in Gitea
CISA reported attacks on the source code management system Gitea early Wednesday. Through the diffpatch API, attackers could inject and execute malicious code remotely (CVE-2026-60004, CVSS 9.8, critical risk). Gitea version 1.27.1 fixes the issue; if you run Gitea, you should install the update as soon as possible.
A whole batch of further flaws
Early Thursday, CISA added a whole batch of additional vulnerabilities to its Known Exploited Vulnerabilities catalog. The most recent affects Citrix NetScaler ADC and Gateway, for which fixes have been available since late June (CVE-2026-8452, CVSS 8.8, high risk). According to security researchers, attackers are trying to exploit the remotely and unauthenticated exploitable code-smuggling flaw to plant web shells with filenames like "x.php" and "z.php" on vulnerable instances and run reconnaissance commands like "id" and "echo" there.
Attackers have also set their sights on a Linux kernel vulnerability that's been known and patched since 2022 (CVE-2022-0995, CVSS 7.8, high risk). Outdated Ajax.NET installations are under attack too (CVE-2021-23758, CVSS 9.8, critical risk), as are long-obsolete Microsoft SQL Server installations (CVE-2019-1068, CVSS 8.8, high risk). Reaching even further back are exploited flaws in Red Hat Linux, specifically in the Automatic Bug Reporting Tool (CVE-2015-5287, CVSS 7.8, high risk) and in libuser (CVE-2015-3246, CVSS 5.1, medium risk).
What you should do now
CISA doesn't provide details on the nature or scope of the observed attacks. What all the affected products have in common, though, is that IT teams should assume possible compromise for any internet-reachable, unpatched instances. Check affected systems for signs of intrusion and unauthorized changes, regardless of how old the specific flaw is. The fact that some of these vulnerabilities are years old shows that patches alone don't help if they never get applied.