CVE-2021-42260, CVE-2025-12768, CVE-2025-31277, CVE-2025-3248, CVE-2025-43529, CVE-2026-0768, CVE-2026-0769, CVE-2026-12661, CVE-2026-16675, CVE-2026-5027, CVE-2026-58400, CVE-2026-63219, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-84352, CVE-2026-84353, CVE-2026-9586, CVE-2026-9621, CVE-2026-9633
Domains:
148[.]184., gehie246[.]com, yimxg25tiy[.]com, cc8ttkv35b[.]com, n7b8t85zsg[.]com, azurewebsites[.]net, azurewebsites[.]net., cloudfareintcdn[.]com.
IP Addresses:
8.4.0.2
Get tomorrow's brief in your inbox
Today: SonicWall disclosed two SMA1000 zero-days (CVSS 10 and 7.8) exploited in the wild, patch immediately. Langflow RCE (CVE-2026-0768) exploitation is accelerating with credential harvesting and lateral movement from 20+ IPs across multiple countries. JFrog Artifactory auth bypass (CVE-2026-82329, CVSS 9.8) hit real-world exploitation within 72 hours of disclosure, with attackers minting admin tokens on self-hosted instances. A BGP hijack compromised Virtualizor's update infrastructure for 33 hours, delivering malicious updates to web hosting platforms.
SonicWall SMA1000 Dual Zero-Day Exploitation (CVE-2026-83548, CVE-2026-83549)
SonicWall disclosed two zero-days in SMA1000 series appliances being exploited in the wild. CVE-2026-83548 (CVSS 10) is a pre-authentication SSRF in the Appliance Work Place interface allowing unauthenticated access to sensitive functionality. CVE-2026-83549 (CVSS 7.8) is an authenticated OS command injection in the Appliance Management Console. SonicWall observed chained exploitation of both flaws. No IOCs have been published.
Langflow RCE Under Sustained Exploitation (CVE-2026-0768, CVE-2026-0769, CVE-2026-5027)
CVE-2026-0768 (CVSS 9.8) in Langflow's custom component editor allows unauthenticated RCE as root via unvalidated Python code execution. VulnCheck observed sustained exploitation since August 30, with 360+ attempts hitting UK canaries, expanding to 20+ IPs across six countries. Attackers are harvesting credentials (secret keys, API keys, SSH keys, .env files), performing lateral movement, exfiltrating Langflow source code, and hunting for already-backdoored installations. Combined with CVE-2026-0769 (EPSS 98th percentile) and CVE-2025-3248 (CISA KEV, ransomware-linked, EPSS 100th percentile), over 15,000 successful attacks have been logged against Langflow instances in 2026.
JFrog Artifactory Authentication Bypass Exploited (CVE-2026-82329)
CVE-2026-82329 (CVSS 9.8) is an authentication bypass in default configurations of self-hosted JFrog Artifactory. Instances without an additional join key receive a "phantom" join key that attackers abuse to forge credentials and mint admin tokens. Exploitation began September 1, three days after the August 28 disclosure. Attackers are enumerating users, groups, credential sets, and federated access topologies. This flaw does not affect JFrog SaaS, only self-hosted deployments.
Sangoma Switchvox Unauthenticated SQLi to RCE (CVE-2026-9586)
CVE-2026-9586 (CVSS 9.3) is an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 that enables arbitrary code execution as the PostgreSQL superuser. Exploitation began August 30 with reverse shell deployment observed on honeypots. Approximately 4,000 instances are internet-exposed, mostly in the U.S.
/var/log/switchvox/db-quirks.log for SQL injection payloads. Block IP 176.65.148[.]184. Assume exposed instances have been targeted.The Gentlemen Claim Nutex Health Breach
Nutex Health confirmed unauthorized access and theft of patient, employee, provider, business, and financial data. The Gentlemen ransomware group (Storm-2697) claimed responsibility, threatening to leak data within nine days. The group operates as RaaS with double extortion and has claimed 580+ victims in 75+ countries since mid-2025. A purported class-action lawsuit has been filed in Texas.
Insider Recruitment Accelerating for Ransomware Groups
Mimecast reports a 42% increase in malicious insider incidents over the past year. Flashpoint found over 75% of unique threat actor posts on the dark web came from insiders advertising their corporate access. Annual insider threat costs hit $19.5M per organization in 2026. Ransomware groups are actively bribing employees for initial access as external defenses improve, with Scattered Spider cited as an example of groups paying telecom employees for access.
BGP Hijack Delivers Malicious Virtualizor Updates
An attacker hijacked IP space belonging to Softaculous via BGP for 33 hours (August 28-31) by announcing a more-specific prefix through NexonHost (AS62390). The attacker obtained a TLS certificate and stood up a clone website delivering malicious updates for the Virtualizor web hosting management platform. Payment data entered during the hijack window may have been captured. Virtualizor cannot determine the number of affected users since all traffic flowed through attacker infrastructure.
GeoNetwork Unauthenticated RCE Chain (CVE-2026-63219 + CVE-2026-58400)
Two GeoNetwork vulnerabilities chain for unauthenticated RCE. CVE-2026-63219 (CVSS 8.6) is a missing auth check on the formatter upload endpoint. CVE-2026-58400 (CVSS 9.1) is an unsafe XSLT processor config allowing java.lang.Runtime.exec() calls. 121 internet-exposed instances across 39 countries were fingerprinted, 89% government, military, or national agency. Fixed in GeoNetwork 4.4.12 and 4.2.17.
/geonetwork/srv/api/formatters at the reverse proxy.FBI Warns of OAuth Consent Phishing Campaign
The FBI is tracking an ongoing campaign since late 2025 where attackers impersonate government officials, journalists, and public personalities on commercial messaging apps to target high-profile individuals. Victims are tricked into granting OAuth consent to malicious applications, giving attackers persistent access to email, files, and data. Password changes do not revoke access; victims must invalidate the token in application security settings.
Silver Fox Counterfeit Installer Campaign Targeting Chinese Operations
Microsoft Defender Experts is tracking a campaign using spoofed software download sites (impersonating Razer, Kaspersky, and others via .com.cn/.hl.cn domains) to deliver malicious installers. Payloads establish persistence, weaken security protections, and communicate with attacker infrastructure. Server-side payload regeneration produces unique hashes per download. Victims span healthcare, manufacturing, gaming, technology, logistics, government, and education, primarily affecting China-based operations of multinational organizations.
153M+ Driver's Licenses for Sale on Dark Web
A new dark web service called "Nexus" is selling digital scans (front, back, infrared, ultraviolet) of 153M+ US and Canadian driver's licenses. The data appears sourced from an active, ongoing breach of a major identity verification company. The FBI New Orleans field office has opened an investigation. Records include timestamps correlating to individuals' travel dates, and the database is growing by hundreds of thousands of records daily.
Rockwell Automation ICS Advisory Batch
CISA published five Rockwell Automation ICS advisories: - FactoryTalk Activation Manager (CVE-2026-16675): Privilege escalation to SYSTEM via installer console window hijacking. Update to V5.03. - RSLinx Classic (CVE-2026-9621/9622/9624/9625): Four DoS vulnerabilities via crafted CIP packets. Update to v4.60. - Redundancy Module Configuration Tool (CVE-2026-9633/9634): DLL search-order hijacking for privilege escalation. Update to v10.01.00. - Historian ME (CVE-2025-12768, CVE-2026-12661): RCE and DoS via crafted requests. Apply vendor patches. - ControlLogix/CompactLogix/GuardLogix (CVE-2021-42260): DoS via crafted data causing major nonrecoverable fault. Update firmware to 34.015+, 35.014+, 36.013+, or 37.011+.
Sality Botnet Disrupted by International Law Enforcement
The DOJ, together with authorities from Bulgaria, Hungary, and Romania, plus CrowdStrike and Shadowserver, dismantled the Sality P2P botnet active since 2003. The operation exploited the botnet's unpatched P2P protocol by manipulating peer lists to isolate infected machines from operator control. Sality delivered the EggJagger cryptocurrency clipper, stealing at least $150,000. Over 15,000 infected machines were part of the network.
Iranian Nimbus Manticore Deploying Cross-Platform RATs via Fake Coding Tests
Nimbus Manticore is delivering NodeRabbit and PollCat RATs through trojanized coding challenge archives on LinkedIn and job platforms. Victims are asked to debug a project management app; the server.js file contains a bundled malicious npm package that launches an implant communicating with Azure-hosted C2. The RATs support full system reconnaissance, file operations, and network enumeration across Windows, macOS, and Linux.
METR Discloses Two Security Incidents
AI model evaluation nonprofit METR disclosed a March breach where an attacker stole an API key from a researcher's personal AWS instance running vibe-coded orchestration software with a fail-open vulnerability. The attacker consumed $600,000 in API credits over three weeks. A separate May incident involved sustained automated reconnaissance including credential stuffing, OAuth attacks, and phishing. No sensitive evaluation data was compromised.
Chrome 152 and Firefox 155 Security Updates
Chrome 152 patches 26 vulnerabilities including two critical use-after-free flaws: CVE-2026-84353 (Shared Tab Groups) and CVE-2026-84352 (WebGL), plus nine high-severity bugs. Firefox 155 patches 29 flaws including 13 high-severity issues spanning use-after-free, sandbox escape, and memory corruption across multiple components. No exploitation observed in the wild for either browser.
Malicious Packagist Packages Targeting iOS Devices
13 malicious Composer packages on Packagist inject JavaScript into Vietnamese streaming sites. On iPhones running iOS 18.4-18.6.x, the code chains WebKit vulnerabilities (CVE-2025-31277, CVE-2025-43529, both CISA KEV) through kernel escape to install spyware that exfiltrates keychain data, SMS, photos, call history, and cryptocurrency wallet seeds from Bitget, BitKeep, Trust Wallet, OKX, and others.
The speed from vulnerability disclosure to active exploitation continues to compress. JFrog Artifactory, Langflow, and Switchvox all saw exploitation within days of public disclosure, reinforcing the point from Verizon's latest DBIR that vulnerability exploitation is now the top initial access vector. Supply chain infrastructure (Artifactory, Virtualizor via BGP hijack) is being targeted specifically because compromise there multiplies downstream impact. The insider threat vector is growing measurably as external defenses improve, with ransomware groups shifting recruitment budgets toward bribing employees with legitimate access.