Security Signal Weekly: September 19-25, 2026

OverviewThis week’s urgent queue is crowded with systems that control access to something larger than themselves. Attackers are exploiting F5 and Check Point access gateways, Arista’s SD-WAN orchestrator, SharePoint, TeamCity, and managed switches. CISA’s newest additions bring WSO2 API infrastructure and Adobe Commerce into the same patch-and-investigate cycle.The software details vary, but the operational problem is consistent. A successful update closes one route in; it does not prove that an exposed appliance, CI server, web application, or package consumer stayed clean before the fix. The useful work this week is to identify the affected configuration, verify the running version, and preserve enough evidence to decide whether the ticket is maintenance or incident response.Reality check: When a vendor says a flaw is exploited, version compliance is only the first question. The second is what the system could reach while it was vulnerable.Top 10 Security Signals1. F5 BIG-IP APM…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town