Deadline Day

Today is the KEV remediation deadline for the F5 BIG-IP APM vulnerability CVE-2025-53521 (CVSS 9.3), reclassified from DoS to RCE after confirmed exploitation. A critical flaw in Open VSX's pre-publish scanning pipeline was disclosed — scanner failures were silently interpreted as "no scanners configured," allowing malicious extensions to bypass all vetting and explaining how the GlassWorm campaign evaded detection. Citrix NetScaler CVE-2026-3055 reconnaissance has intensified with attackers targeting the specific vulnerable endpoint. Three new vulnerabilities in LangChain and LangGraph expand the AI framework attack surface. The DarkSword iOS exploit chain has reportedly leaked to GitHub. A senior energy official publicly warned that adversaries may be pre-positioned inside energy infrastructure networks.