F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

The Hacker News - Sep 23, 2026

Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.

Read full article

More News

Sep 23, 2026

Oppo Find X10 Pro Max launched: Triple 200MP cameras, 8,000mAh battery, price and specs

Oppo Find X10 Pro Max launched in China with triple 200MP cameras, an 8,000mAh battery, the Dimensity 9600 Pro chipset, and a 6.78-inch 144Hz display. India launch expected around Diwali/end-October 2026; local pricing not announced.

Sep 23, 2026

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break

Sep 23, 2026

Has Queen Nefertiti finally been found? New scans provide fresh evidence for a hidden chamber beyond Tutankhamun's tomb that could hold the remains of his long-lost stepmother

Archaeologists believe they may have uncovered a secret hiding behind the walls of Tutankhamun's tomb.

Sep 23, 2026

Vivo V80 India launch date: 5 key features to know before you buy

Vivo V80 launches in India on October 6 with a ZEISS quad-camera system, 50MP main and telephoto sensors, a 6.59-inch 144Hz 1.5K OLED display, a 7,200mAh battery with 90W fast charging, and OriginOS 7 with 30+ AI camera features. Price to be revealed at launch.

Sep 23, 2026

Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version

Sep 23, 2026

Gen Z are in a sex RECESSION, study reveals - with a fifth reporting they've never had a partner

Despite being the generation that grew up with Tinder, Hinge and Bumble at their fingertips, a study has revealed Gen Z is in a sex recession.

Sep 23, 2026

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants

The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency. "We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark

Sep 23, 2026

Rare snails lay eggs during car journey to zoo

The zoo near Canterbury says glutinous snails started laying eggs on their way to Kent.

Sep 23, 2026

Chinese maker of robot-vacuum sensors launches Hong Kong IPO, undeterred by US ban

Shenzhen Camsense Technologies, a maker of spatial sensors for robotic vacuum cleaners, launched a Hong Kong initial public offering (IPO) that aims to raise about HK$680 million (US$86.7 million), despite headwinds from Washington’s recent import ban on foreign-made vacuum robots. “The export and procurement for our existing client products remain normal, with potential disruption limited to new product development schedules,” Camsense co-founder Zhou Kun said about the ban’s impact. “We have...

Sep 23, 2026

More than 170,000 respiratory cases recorded in haze-choked Indonesia

More than 40,000 of the cases – which range from mild coughs to pneumonia – involve toddlers.

Sep 23, 2026

Ireckonu calls for unification of fragmented data to unlock revenue potential

As World Tourism Day approaches this weekend (Sunday, September 27, 2026), Ireckonu, the leading Hospitality Customer Data Platform (CDP) has called on the industry to unify data for the benefit of both guests and hotels. A recent study by Ireckonu found that hotels are missing out on the opportunity to re-engage up to 20% of guests due to the fragmented nature of accurately capturing their data.

Recommended