HOTNEWS 2026  January(174) February(168) March(221) April(222) May(261) June(255) July(464) August(446) September(56) October(0) November(0) December(0) | HOTNEWS 2026(2086)  STATISTICS (7358) | ARCHIVE

DATE

NAME

INFO

CATEGORY

SUBCATE

13.9.26

 CVE-2025-14733 An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. VULNEREBILITY VULNEREBILITY

12.9.26

 DoppelCart DoppelCart: 119,000 Domains in What May Be the Largest Documented Fake-Shop Network INCIDENT INCIDENT

12.9.26

 CVE-2026-58231 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application. VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system. VULNEREBILITY VULNEREBILITY

12.9.26

 Distillation Attacks Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks ATTACK AI

12.9.26

 SloppyRAT malware Researchers at Zscaler ThreatLabz uncovered SloppyRAT, an emerging malware strain linked to ransomware operators aiming to establish initial footholds and facilitate lateral network traversal across victim environments. Delivered primarily through multi-stage ClickFix delivery campaigns, this remote access trojan supplies attackers with an expansive suite of built-in, PowerShell-like commands alongside reverse SOCKS proxy capabilities. ALERTS VIRUS

12.9.26

 Espionage Groups Deploy BlueMoon Exploit Chain Researchers at Proofpoint recently reported on targeted spearphishing campaigns involving multiple state-aligned espionage groups utilizing a novel exploit framework dubbed BlueMoon. The campaigns primarily involve China-nexus threat groups, such as Sheathminer (aka APT31, TA412), targeting entities globally using newly staged infrastructure. ALERTS GROUP

12.9.26

 Telegram-beaconing VBS downloader deploys ScreenConnect RMM Symantec has observed a campaign using an unobfuscated VBScript downloader distributed as a fake Adobe plugin update. The script fingerprints the host, attempts to disable Windows Defender and Smart App Control through registry policy writes, and then invokes msiexec to install a remotely hosted MSI package that deploys the ConnectWise ScreenConnect client, giving the actor access. ALERTS VIRUS

12.9.26

 Mantax Otax Android Malware Researchers at Zimperium recently reported on Mantax Otax, a dual-function Android malware strain originating from threat actors based in Indonesia. The hybrid threat targets regional Android users by combining intrusive espionage tools and file-encryption capabilities into a single payload. ALERTS VIRUS

12.9.26

 GoldFactory threat group abuses Android Work Profiles with Vwork clone tool Cybersecurity researchers at Group-IB discovered a novel defense-evasion technique used by the threat group GoldFactory, creators of the Gigabud Android banking trojan. The operators pair their malware with Vwork, an adapted variant of the open-source utility Shelter that exploits Android’s Work Profile architecture. ALERTS GROUP

12.9.26

 CL-CRI-1171 cybercrime operation Unit 42 researchers uncovered an extensive, two-year cybercrime scheme designated as CL-CRI-1171. The group responsible functions as a commercial pay-per-install marketplace that distributes diverse payloads for third-party adversaries. The operation funnels traffic through two deceptive avenues: manipulated search engine results and influential gaming-focused YouTube channels. ALERTS CRIME

12.9.26

 ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav3_ext compute unified device architecture (CUDA) extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerability is tracked as CVE-2026-84286. ALERT ALERT

12.9.26

 CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability KEV KEV

12.9.26

 CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability KEV KEV

12.9.26

 CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability KEV KEV

12.9.26

 CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability KEV KEV

12.9.26

 CVE-2026-85706 Path Traversal issue in repository commits API impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-87719 Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-88765 Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-79708 Scheduled Pipeline Execution Policy test allows Developers to access protected CI/CD variables VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-78252 Cross-site Scripting issue in Markdown JSON table renderer impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-13210 Incorrect Authorization issue in CI/CD environment variable scope matcher impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2025-14871 Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-1168 Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2024-11222 Race Condition issue in Merge Request Pipelines impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-12910 Improper Authentication issue in SAML SSO sign-in restriction enforcement impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-82837 Insufficiently Protected Credentials issue in Workhorse senddata emitters impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-19619 Cross-site Scripting issue in Content Editor impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-86341 Access Control Implementation issue in protected environment approval rules impacts GitLab EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-86340 Authorization Bypass issue in protected environment approval rules impacts GitLab EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-7514 Missing Authorization issue in Generic Package Registry impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-8030 Improper Input Validation issue in Namespace Transfer impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-16794 Missing Authorization issue in Compliance Framework management impacts GitLab EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-3855 Improper Input Validation issue in Terraform State API impacts GitLab CE/EE VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-85706 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API. VULNEREBILITY VULNEREBILITY

12.9.26

 Casbaneiro In August 2026, FortiGuard Labs observed a Casbaneiro attack campaign targeting users in Latin America, using phishing emails and PDF files themed around fake invoices and legal notices as the initial stage. MALWARE BANKING

12.9.26

 ShadowPane ZeroBEC uncovered a phishing campaign we track as ShadowPane that uses browser-in-the-browser deception to make malicious RMM installations appear to originate from Adobe. CAMPAIGN CAMPAIGN

12.9.26

 SloppyRAT In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain. MALWARE RAT

12.9.26

 MacSync Executive Summary MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines.... MALWARE MACOS

12.9.26

 Gray Rabbits One click. Three critical failures. One backdoor. MALWARE BACKDOOR

12.9.26

 GuardBreaker LLM-based code scanners won’t help attackers build a nuclear weapon, but that refusal could work in their favor MALWARE AI

12.9.26

 CVE-2026-73693 (CWE-78): a contact-sheet handler runs an attacker-chosen filename through a shell, so a file uploaded with a command in its name executes it. VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-73694 (CWE-78): a superuser settings test endpoint passes an operator-supplied argument straight to a shell and reflects the output, a direct command channel. VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-73698 (CWE-89): a delegated (non-superuser) administrator turns a control-panel field into raw SQL, including stacked statements. VULNEREBILITY VULNEREBILITY

12.9.26

 CVE-2026-73699 (CWE-502): a permission blob deserialized on every page load instantiates arbitrary classes, which the SQL injection above weaponizes into a file write. VULNEREBILITY VULNEREBILITY

11.9.26

 Detecting and countering misuse of AI: September 2026 Over the past eight months, our Threat Intelligence team identified and disrupted operations in which threat actors tried to use Claude for malicious activity. In this report, we share case studies from those operations and describe how malicious use of Claude has evolved since our previous threat reports in March, August, and November 2025. REPORT REPORT

11.9.26

 AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks An incorrect permissions assignment vulnerability in the amwrtdrv.sys kernel driver, included with AOMEI Backupper 8.4.0, allows an unprivileged local user to perform arbitrary writes to the physical disk. ALERT ALERT

11.9.26

 CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability KEV KEV

11.9.26

 CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability KEV KEV

11.9.26

 Atomic macOS (AMOS) Stealer infection Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

11.9.26

 XWorm infection Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

11.9.26

 CVE-2026-82329 JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. VULNEREBILITY VULNEREBILITY

11.9.26

 CVE-2026-42016 JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. VULNEREBILITY VULNEREBILITY

11.9.26

CVE-2026-42018

 JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. VULNEREBILITY VULNEREBILITY

11.9.26

 CVE-2021-38003 Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. VULNEREBILITY VULNEREBILITY

11.9.26

 Hagaseca Hagaseca: Inside a Packed Android RAT Loader MALWARE RAT

11.9.26

 Mantax Otax Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration RANSOM RANSOM

10.9.26

 CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. ECV ECV

10.9.26

 CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability: Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. ECV ECV

10.9.26

 CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability: Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. ECV ECV

10.9.26

 CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability: Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. ECV ECV

10.9.26

 CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability: Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. ECV ECV

10.9.26

 CVE-2026-86218 N-able N-central Static Code Injection Vulnerability: N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. ECV ECV

10.9.26

 CVE-2026-81963 Microsoft Windows Link Following Vulnerability: Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. ECV ECV

10.9.26

 CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability: Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. ECV ECV

10.9.26

 CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. ECV ECV

10.9.26

 CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability: SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. ECV ECV

10.9.26

 FBI Cyber Strategy This Strategy sets the course for FBI Cyber Division to defend the American people and the nation’s critical infrastructure in cyberspace. It defines our priorities, objectives, and framework for countering malicious cyber activity directed at the United States. IC3 IC3 INDUSTRY

10.9.26

 China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy IC3 IC3 INDUSTRY

10.9.26

 MacSync Stealer deployment via ClickFix campaigns MacSync Stealer is a commercial macOS malware framework functioning primarily as a stealthy stager and data-exfiltration engine. As reported by Seqrite analysts, the infection typically begins through malvertising or "ClickFix" social engineering schemes, wherein victims unwittingly paste malicious commands into Terminal after encountering counterfeit verification challenges or prompts. ALERTS VIRUS

10.9.26

 Amatera stealer and ZigCryptoStealer among the payloads delivered in recent ClearFake WebDAV infection chain Researchers at Cisco Talos reported on widespread credential- and cryptocurrency-harvesting operation centered on the Amatera stealer and attributed to a threat actor designated as UAT-10820. ALERTS VIRUS

10.9.26

 Ted backdoor and CurlRAT activities in South Korea Researchers at Rapid7 recently reported a campaign by suspected North Korean state-sponsored actors targeting the media and automotive sectors in South Korea. Seeking long-term espionage, the attackers initially compromise edge web servers—often through vulnerable groupware portals—to deploy a sophisticated Linux toolkit. ALERTS VIRUS

10.9.26

 BL4CK SP1D3R Ransomware BL4CK SP1D3R is a Windows ransomware family first publicly documented in July 2026. It encrypts user data, appends the .bl4ck extension, replaces the desktop wallpaper, sets a custom file-type icon, and drops ransom notes that direct the victim to a contact channel and a per-machine identifier. ALERTS RANSOM

10.9.26

 Attackers impersonate IT support in Microsoft Teams to deploy persistent Node.js backdoors Threat researchers at Microsoft have documented a targeted intrusion campaign that exploits Microsoft Teams communications. ALERTS VIRUS

10.9.26

 Self-propagating Go-based Botnet enrolls vulnerable IoT devices for DDoS campaigns A newly identified IoT botnet written in Go combines autonomous self-propagation with centralized remote execution to launch distributed denial-of-service (DDoS) campaigns. ALERTS BOTNET

10.9.26

 Updated python-based NodeStealer variant distributed in the wild Security researchers at Netscope have identified an updated variant of the Python-based NodeStealer malware. Originally developed to harvest web browser data and commercial Facebook accounts, the threat has evolved into comprehensive spyware. ALERTS VIRUS

10.9.26

 Gambling Goblin threat group activities Check Point Research has uncovered an extensive cyber campaign by a Chinese-speaking threat group named “Gambling Goblin,” an entity linked to the Earth Berberoka cluster. ALERTS GROUP

10.9.26

 CVE-2026-19490 NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 VULNEREBILITY VULNEREBILITY

10.9.26

 Gigabud Vwork: Weaponized Open-source Software as an Addon for Gigabud MALWARE ANDROID

10.9.26

 CVE-2026-85102 Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN VULNEREBILITY VULNEREBILITY

10.9.26

 CVE-2026-85103 ASN.1 decoding heap overflow leading to a remote code execution VULNEREBILITY VULNEREBILITY

10.9.26

 CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability KEV KEV

10.9.26

 CVE-2026-1949 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability KEV KEV

10.9.26

 CVE-2026-8749 Google Chromium V8 Out of Bounds Write Vulnerability KEV KEV

10.9.26

 CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel KEV KEV

10.9.26

 Anubis Market Anubis Market is a multi-category Dark Web marketplace operating as a Tor hidden service, with escrow-backed trading in Bitcoin (BTC) and Monero (XMR). Its visible category strip displays more than 11,000 listings, and while narcotics account for the largest share of physical goods, its Digital section is the single biggest category on the market. CRYPTOCURRENCY CRYPTOCURRENCY

9.9.26

 CVE-2026-87491 Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-67401 Security: CVE-2026-67401 SQL Injection Vulnerability in cPanel's EmailTrack Functionality - September 8, 2026 VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2025-53521 When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. VULNEREBILITY VULNEREBILITY

9.9.26

 ShieldCrash Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited. EXPLOIT EXPLOIT

9.9.26

 CVE-2026-44756 A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. VULNEREBILITY VULNEREBILITY

9.9.26

 SAP Security Patch Day - September 2026 On 8th of September 2026, SAP security patch day saw the release of 19 new security notes. There is 1 update to previously released security note. VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-55007 (CVSS score: 8.1) - A double free vulnerability in Microsoft Exchange Server that allows an unauthorized attacker to execute code over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-80097 (CVSS score: 8.6) - An improper authentication vulnerability in Microsoft Authenticator that allows an unauthorized attacker to elevate privileges locally VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-69465 (CVSS score: 8.8) - A missing authorization vulnerability in Microsoft Office SharePoint that allows an authorized attacker to execute code over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-65669 (CVSS score: 9.6) - An injection vulnerability in SQL Server allows an unauthorized attacker to elevate privileges over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-69525 (CVSS score: 9.8) - A use-after-free vulnerability in Windows Remote Desktop Services that allows an unauthorized attacker to execute code over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-69595 (CVSS score: 9.8) - A use-after-free vulnerability in Windows Services for NFS ONCRPC XDR Driver that allows an unauthorized attacker to execute code over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-69730 (CVSS score: 9.8) - A use-after-free vulnerability in Windows DNS server that allows an unauthorized attacker to execute code over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-69829 (CVSS score: 9.8) - A heap-based buffer overflow vulnerability in Windows Shell that allows an unauthorized attacker to execute code over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-72979 (CVSS score: 9.8) - A use-after-free vulnerability in Windows DHCP Server that allows an unauthorized attacker to execute code over a network VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-85880 (CVSS score: 7.8) - A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC) that allows an authorized attacker to elevate privileges locally and gain SYSTEM privileges VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-81963 (CVSS score: 7.8) - An improper link resolution vulnerability in the Windows Update Stack that allows an authorized attacker to elevate privileges locally and gain SYSTEM privileges VULNEREBILITY VULNEREBILITY

9.9.26

 UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. ALERT ALERT

9.9.26

 CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-81963 Microsoft Windows Link Following Vulnerability VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-86218 N-able N-central Static Code Injection Vulnerability VULNEREBILITY VULNEREBILITY

9.9.26

 CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability KEV KEV

9.9.26

 CVE-2026-81963 Microsoft Windows Link Following Vulnerability KEV KEV

9.9.26

 CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability KEV KEV

9.9.26

 CVE-2026-86218 N-able N-central Static Code Injection Vulnerability KEV KEV

9.9.26

 InTheBox Technical Analysis of the Web Injects in Android Botnet Operations HACKING WEB

9.9.26

 SURXRAT SURXRAT is an actively developed Android Remote Access Trojan (RAT) commercially distributed through a Telegram-based malware-as-a-service (MaaS) ecosystem under the SURXRAT V5 branding. MALWARE RAT

9.9.26

 TAXISPY RAT TAXISPY RAT : Analysis of TaxiSpy RAT – Russian Banking – Focused Android Malware with Full Remote Control MALWARE RAT

9.9.26

 GIGABUD RAT Sophisticated Android Malware Strikes Users in Thailand, Philippines, and Peru MALWARE RAT

9.9.26

 Trojan/Linux.MikeDor Trojan/Linux.MikeDor MALWARE BACKDOOR

9.9.26

 2026 THREAT HUNTING REPORT CROWDSTRIKE 2026 THREAT HUNTING REPORT REPORT REPORT

9.9.26

 BeatBanker BeatBanker: A dual‑mode Android Trojan MALWARE ANDROID

9.9.26

 PixRevolution PixRevolution: The Agent-Operated Android Trojan Hijacking Brazil’s PIX Payments in Real Time MALWARE ANDROID

9.9.26

 Slim Spider SLIM SPIDER is an eCrime adversary that has been actively targeting Brazilian financial institutions since at least March 2026. The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment service Pix, digital asset platforms, and financial entities’ cloud environments. SLIM SPIDER’s primary tool is MikeDor, a custom cross-compiled, Go-... GROUPS GROUPS

9.9.26

 TaxiSpy Extended IOCs for TaxiSpy Android Banking Malware MALWARE SPY

8.9.26

 Syslogk Rootkit Detection and Removal of the Syslogk Rootkit in a Linux Environment MALWARE ROOTKIT

8.9.26

 HVNC Backdoor HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures MALWARE BACKDOOR

8.9.26

 BigBear 2.0 CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. OPERATION OPERATION

8.9.26

 Operation GitPower Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM OPERATION OPERATION

8.9.26

 WeWorm The first zero-click worm to spread through WeChat calls across iOS and Android. MALWARE WORM

8.9.26

 CVE-2026-79678 A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. VULNEREBILITY VULNEREBILITY

8.9.26

 CVE-2026-76560 A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. VULNEREBILITY VULNEREBILITY

8.9.26

 CVE-2026-76578 A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry VULNEREBILITY VULNEREBILITY

8.9.26

 CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. VULNEREBILITY VULNEREBILITY

8.9.26

 BengalSEO BengalSEO Part 1: Anatomy of the Operation OPERATION OPERATION

7.9.26

 CVE-2026-13190 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution. VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-13186 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution. VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-13185 In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution. VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-13184 In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains. VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-13183 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values. VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-13182 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers. VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-13181 In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments. VULNEREBILITY VULNEREBILITY

7.9.26

 SourTrade SourTrade: Browser-Assembled Malware Delivered Through Malvertising CAMPAIGN CAMPAIGN

7.9.26

 CVE-2026-86218 N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-18577 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-86206 A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 VULNEREBILITY VULNEREBILITY

7.9.26

 CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs VULNEREBILITY VULNEREBILITY

7.9.26

 JSCeal Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode MALWARE JAVASCRIPT

6.9.26

 Vulnerabilities in Mikrotik RouterOS software During its own research, CERT Polska discovered vulnerabilities in MikroTik RouterOS software and participated in coordinating their disclosure. Details on how these vulnerabilities were found, along with other related information, are available in our separate article. VULNEREBILITY VULNEREBILITY

6.9.26

 H1 2026 Malware and Vulnerability Trends Malware and Vulnerability Trends REPORT REPORT

6.9.26

 REVSTEALER ramps up Elastic Security Labs details emerging infostealer targeting gamers PAPERS MALWARE

6.9.26

 REVSTEALER Elastic Security Labs deep dives into REVSTEALER, an emerging infostealer targeting browsers, wallets, and gaming accounts. MALWARE STEALER

6.9.26

 StyleSmuggler StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack HACKING HACKING

6.9.26

 Acronis Cyberthreats Report, H2 2025 The Acronis Cyberthreats Report covers the global threat landscape as encountered by the Acronis Threat Research Unit (TRU) and Acronis sensors in the second half of 2025. General threat data (including malware, ransomware, web and email threats, vulnerabilities, etc.) presented in the report is gathered from January–December of 2025 and reflects threats targeting endpoints we observed in this time frame REPORT REPORT

5.9.26

 CVE-2026-59347 HGFS stack buffer-overflow vulnerability VULNEREBILITY VULNEREBILITY

5.9.26

 CVE-2026-59346 VMXNET3 integer-overflow vulnerability VULNEREBILITY VULNEREBILITY

5.9.26

 Essential macOS Stealer infection Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

5.9.26

 Files for an ISC diary (Guildma/Astaroth infection) Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

4.9.26

 CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability KEV KEV

4.9.26

 ASCII smuggling ASCII smuggling crosses over from AI prompt injection to phishing evasion HACKING AI

4.9.26

 ted backdoor DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors MALWARE BACKDOOR

4.9.26

 PostGREShell PostGREShell: The database powering much of the internet had an open door for 12 years VULNEREBILITY VULNEREBILITY

4.9.26

 Zawoo Ransomware Researchers at CERTAINITY recently reported on Zawoo Team, a ransomware operation. The actor has been active since at least early August 2026 and brought its leak site online on 30 August, listing 19 victims at once, concentrated among small and micro enterprises in German-speaking Europe across engineering, industrial software, construction, hospitality and real estate. Access came through the victim's VPN using valid credentials for an already privileged account with no multi-factor authentication enforced, and no exploitation or escalation was observed. ALERTS RANSOM

4.9.26

 Mirage Kitten Expands Toolset with Cross-Platform NodeRabbit and PollCat RATs In a recent write-up, Kaspersky details a campaign by the Iranian threat group Mirage Kitten targeting aviation, FinTech, and technology organizations across the Middle East and Africa. The threat actor recruits candidates on professional networking platforms and entices software engineers to download trojanized coding challenges hosted on cloud storage. ALERTS APT

4.9.26

 SleepWalker backdoor SleepWalker is a stealthy Windows backdoor identified by an independent researcher at r136a1 that departs from typical malware by staying dormant rather than beaconing to an external command server. Disguised as a native Microsoft dynamic link library with falsified ESET metadata, the implant relies on DLL side-loading to run inside the official ESET Management Agent executable. ALERTS VIRUS

4.9.26

 Node.js: Old Technique Makes a Comeback Between March and July 2026, attackers who compromised a technology start-up in Asia ran into a problem: almost every payload they attempted to deploy, including AdaptixC2 agents and Cobalt Strike Beacon, was blocked on the victim's network. Their response was to download the official Node.js installer from nodejs.org and use the trusted, signed runtime to execute a malicious implant. ALERTS VIRUS

4.9.26

 GOLD SHERWOOD Operators Leverage Credential Abuse and EDR Killers in The Gentlemen Ransomware Attacks Researchers at Sophos recently reported on the post-exploitation tactics and intrusion mechanics associated with The Gentlemen Ransomware-as-a-service (RaaS) operations. This activity is attributed to the GOLD SHERWOOD threat group. Threat actors reportedly gain initial access through various means, such as exploiting unpatched edge devices or by leveraging compromised VPN user credentials without multi-factor authentication. ALERTS OPERATION

4.9.26

 BraZetsu - a Python-based malware Discovered by Group-IB analysts and attributed with high confidence to the Brazilian cybercrime group Exilware, BraZetsu is a modular, Python-based malware framework designed specifically for Initial Access Brokers (IABs). The codebase suggest heavy reliance on generative AI during the development process. ALERTS VIRUS

4.9.26

 Casdoor authentication server is vulnerable to authorization bypass Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3.115.0 and earlier. ALERT ALERT

4.9.26

 Cisco IOS XR Software Security Hardening Release: September 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. VULNEREBILITY VULNEREBILITY

4.9.26

 CVE-2025-34158 Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner). VULNEREBILITY VULNEREBILITY

4.9.26

 CVE-2026-32475 Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1. VULNEREBILITY VULNEREBILITY

4.9.26

 CVE-2026-14894 CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including executable PHP files, leading to remote code execution. (Fixed in version 6.3.314) VULNEREBILITY VULNEREBILITY

4.9.26

 CVE-2026-85046 Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel. VULNEREBILITY VULNEREBILITY

4.9.26

 Still Circling This is a collaborative follow-up to our original post, developed jointly with Emmanuel C., a security researcher not affiliated with LevelBlue, who contributed additional infrastructure and tooling findings based on an analysis of the same GitHub staging account. OPERATION OPERATION

3.9.26

 BraZetsu Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets. MALWARE PYTHON

3.9.26

 FalconFlank FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique. EXPLOIT EXPLOIT

3.9.26

 Communicating Under
Pressure: Best Practices for
Service Providers		 Service outages impacting IT and operational technology (OT) systems can be damaging and disruptive for customers, network defenders, critical infrastructure
owners and operators, and the general public. During incidents that reach or exceed established thresholds, whether caused by malicious activity or a nonmalicious event, service providers must communicate effectively so end users can minimize operational impact. This guide outlines how to prepare for effective outage communications and key elements of clear, actionable messaging.		 Best Practices Best Practices

3.9.26

 Cisco IOS XR Software Security Hardening Release: September 2026 These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities At the time of publication, these vulnerabilities affected Cisco Secure Email devices if they were running Cisco AsyncOS Software Release 16.5.0 or earlier and had S/MIME configured for communication between email gateways. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Advance Notification for Publication of September 2, 2026, Security Advisories Under the Cisco risk-based disclosure process, hardening releases and other security advisories are scheduled to publish on the first and third Wednesday of each month. To help customers prepare, we provide this seven-day advance notice of upcoming security vulnerability disclosures. However, this schedule is not a final commitment of releases. If updates are delayed or unforeseen changes arise, specific products may be removed and rescheduled. Products may also be added when releases are ready ahead of schedule. The latest status is available in the Revision History section of this advance notice. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Crosswork Security Hardening Release: August 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. VULNEREBILITY VULNEREBILITY

3.9.26

 CVE-2026-83548 (CVSS score: 10.0) - A server-side request forgery vulnerability in SonicWall SMA 1000 Appliances that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. KEV KEV

3.9.26

 CVE-2026-83549 (CVSS score: 7.8) - A post-authentication operating system command injection vulnerability in SonicWall SMA 1000 Appliances that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. KEV KEV

3.9.26

 CVE-2026-9586 (CVSS score: 9.3) - An SQL injection vulnerability in Sangoma Switchvox that could allow an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. KEV KEV

3.9.26

 CVE-2026-82329 (CVSS score: 9.8) - An improper authentication vulnerability in JFrog Artifactory that under default configuration could allow an unauthenticated attacker with network access to obtain administrative privileges. KEV KEV

3.9.26

 CVE-2026-48710 (CVSS score: 6.5) - An HTTP request/response smuggling vulnerability in Kludex Starlette that could allow attackers to inject paths into the host part, prepending the actual path, leading to issues such as authentication bypass when the authentication depends on the reconstructed URL's path. KEV KEV

3.9.26

 CVE-2026-49869 (CVSS score: 10.0) - An operating system command injection vulnerability in Kestra OSS that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. KEV KEV

3.9.26

 CVE-2026-59822 (CVSS score: 8.8) - An improper authentication vulnerability in Berri LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. KEV KEV

3.9.26

 CVE-2026-72718 Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor VULNEREBILITY VULNEREBILITY

2.9.26

 RevStealer malware impersonates legitimate software RevStealer is an infostealer variant found to be commonly distributed under the disguise of trojanized Electron desktop application. As reported by researchers from Morphisec, this malware strain is primarily spread through game-cheat websites and fake GitHub repositories. ALERTS VIRUS

2.9.26

 Fiasco Ransomware Symantec has collected and analyzed a ransomware binary that belongs to a likely new double-extortion ransomware actor who goes by the name of "Fiasco". They utilize a Rust-written Windows 64Bit PE to encrypt files and append a .secure extension. ALERTS RANSOM

2.9.26

 KryBit Ransomware KryBit is a cross-platform Ransomware-as-a-Service (RaaS) that targets endpoints, virtual machines, and network storage spanning Windows, Linux, and VMware ESXi environments. As per a recent report from Picus Security, the attackers behind this ransomware variant are employing a double-extortion model, and exfiltrating sensitive data before encrypting sensitive files, appending them with a .KRYBIT extension and leaving a ransom note in the form of a .txt file. ALERTS RANSOM

2.9.26

 Adware Sideloading Chain Deploys ValleyRAT Payload Kaspersky has published a report on a campaign distributing the ValleyRAT backdoor disguised as adware. The malware arrives through installer files that, depending on a naming variant, install a decoy application such as a collaboration tool or browser while covertly deploying a modified version of a legitimate Chinese wallpaper utility. They're using that utility for DLL sideloading, so the malicious library gets to run under cover of a signed process. ALERTS VIRUS

2.9.26

 Virtualizor INCIDENT BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access INCIDENT INCIDENT

2.9.26

 Mirax Mirax: a new Android RAT turning infected devices into potential residential proxy nodes MALWARE RAT

2.9.26

 StreamRat Uncovering StreamRat: From Meta Ads to Full Device Takeover MALWARE RAT

2.9.26

 CVE-2026-83548 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations. VULNEREBILITY VULNEREBILITY

2.9.26

 CVE-2026-83549 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. VULNEREBILITY VULNEREBILITY

2.9.26

 Hugging Face Transformers library writes remote code to disk prior to consent check A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library. ALERT ALERT

2.9.26

 Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing Since late 2025, malicious cyber actors have been targeting prominent victims, their family members, and personal acquaintances by directly messaging personal accounts with malicious links leveraging a technique known as "OAuth consent phishing." IC3 IC3

2.9.26

 CVE-2026-63219 Unauthenticated file upload via missing authorization on formatter upload endpoint VULNEREBILITY VULNEREBILITY

2.9.26

 CVE-2021-31886 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) VULNEREBILITY VULNEREBILITY

2.9.26

 CVE-2026-9586 An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. VULNEREBILITY VULNEREBILITY

2.9.26

 Plump Spider's Operations New Details on Plump Spider's Operations in Pix Fraud Schemes OPERATION OPERATION

2.9.26

 CVE-2026-82329 JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. VULNEREBILITY VULNEREBILITY

1.9.26

 PrettyPrague GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability. Another zeroday in an antimalware provider, I'm not sure but I believe this vulnerability affect other GenDigital products as well (such as AVG, Norton...) EXPLOIT EXPLOIT

1.9.26

 CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability  VULNEREBILITY VULNEREBILITY

1.9.26

 CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability  VULNEREBILITY VULNEREBILITY

1.9.26

 CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability  KEV KEV

1.9.26

 CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability  KEV KEV

1.9.26

 CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. VULNEREBILITY VULNEREBILITY

1.9.26

 CVE-2026-66066 aka KindaRails2Shell (CVSS score: 9.5) - A vulnerability that could allow an unauthenticated attacker to read arbitrary files from the server, leak Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens, ultimately leading to remote code execution. VULNEREBILITY VULNEREBILITY