Tuesday, September 1, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Unknown 7 critical 84
- WordPress 1 critical 27
- ash-project 20
- Microsoft 1 critical 15
- ellite 13
- Apache 9
- samanhappy 1 critical 7
- D-Link 5 critical 6
- Red Hat 6
- joomshaper.com 5
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Hackers Weaponize Microsoft Teams Help Desk Calls for Malware and Network Lateral Movement
Attackers are turning Microsoft Teams help desk calls into an entry point for malware and network compromise. A campaign tracked as Spring Ring used external accounts that resembled internal IT support to chat with employees, then call them and press for remote access or software execution. The activity ran from January through April 2026 and approached more than 150 employees at at least 10 organizations. Its danger lies in the human element: a familiar sounding technician and a live conversation can make an unexpected request feel urgent and legitimate. Analysts at Unit 42 identified the…
Also in Malwarebytes Labs Any.Run Malware Analysis Bleeping Computer +1
-
Attackers Abuse Trusted Cloud Services to Hide Phishing Attacks Against Financial Organizations
Cybercriminals are increasingly weaponizing trusted cloud platforms such as Microsoft Azure, Google Firebase, Google Cloud Storage, Amazon Web Services, and Cloudflare to host phishing infrastructure aimed squarely at the financial sector, making malicious traffic nearly indistinguishable from legitimate business activity. Security researchers describe this as a structural shift toward what some call Trusted Infrastructure Phishing , where every stage of an attack, from delivery to credential theft, runs through legitimate, enterprise-approved services rather than attacker-owned domains…
Also in Bleeping Computer The Hacker News
-
Hackers Abuse Real ChatGPT Links to Trick Windows Users Into Installing Malware
Windows users are being targeted through a malicious campaign that turns a ChatGPT shared link into the step of a malware infection. Rather than breaking into the AI platform, the operators place a deceptive message inside a shared conversation and rely on victims to follow its instructions. The page claims that traffic is too high and directs visitors to a supposed backup site. That destination uses a fake human-verification screen and tells people to open the Windows Run dialog, paste a command, and press Enter. The action quietly starts a PowerShell-based download chain outside the…
Also in Microsoft Security Microsoft Security Microsoft Security
-
WatchGuard Patches Critical Vulnerabilities
Three critical issues in the Fireware OS iked process could allow unauthenticated attackers to execute arbitrary code remotely.
Also in CCCS Alerts & Advisories
-
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence (AI) models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors attempted to gain unauthorized access to its systems. No sensitive information is believed to
Also in Infosecurity Magazine
-
Five Hackers Plead Guilty to ATM Jackpotting Attacks Using Malware to Dispense Cash
Five Venezuelan nationals have pleaded guilty in a U.S. federal case involving attempted ATM jackpotting attacks . This criminal technique uses malware to force cash machines to dispense money without legitimate customer transactions. The case follows an FBI investigation into attempts to compromise ATMs in Wamego and Manhattan, Kansas, during December 2025. U.S. Attorney Ryan A. Kriegshauser said banks and financial institutions should take preventative steps as jackpotting incidents continue to increase across the United States. According to court documents , Luis Alberto Velasquez-Artigas…
Also in Bleeping Computer
-
JFrog Artifactory Auth Bypass Exploited in Attacks to Gain Admin Access
A critical authentication bypass vulnerability in JFrog Artifactory , tracked as CVE-2026-82329, is being actively exploited, allowing unauthenticated attackers with network access to gain administrator-level privileges. WatchTowr said its intelligence team has observed attackers exploiting the issue and “minting themselves admin tokens.” An attacker with a valid administrator token could control the affected Artifactory environment, including repositories, user accounts, access permissions, build artifacts, and software packages stored in the platform. JFrog disclosed the vulnerability on…
Also in SecurityWeek
-
21,000+ Microsoft Exchange Servers Remain Exposed to Active CVE-2026-62911 Exploitation
Nearly 22,000 Microsoft Exchange servers worldwide are still running unpatched for CVE-2026-62911 , a critical authentication-bypass vulnerability that attackers can exploit to seize control of enterprise email infrastructure. According to daily internet-wide scans published by the Shadowserver Foundation, exactly 21,899 unique IP addresses were flagged as vulnerable as of August 31, 2026, underscoring how slowly organizations are responding to one of this year’s most consequential Patch Tuesday disclosures. CVE-2026-62911 Microsoft Exchange CVE-2026-62911 is classified as an authentication…
Also in Bleeping Computer Bleeping Computer
-
Iranian cyber spies target aviation, fintech developers with new malware
In a report published Tuesday, Kaspersky said it first discovered NodeRabbit on a system in Afghanistan and later identified variants on systems in Egypt and Ethiopia.
Also in SecurityWeek
-
PaperCut Exploitation Escalates to Active Intrusions
CISA has added the vulnerabilities tracked as CVE-2026-82078 and CVE-2026-81578 to its KEV catalog.
Also in CISA Alerts & Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-82693 | AC1206Tenda | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible … Attack
Exploitation
|
|||||||||
| CVE-2026-82694 | AC1206Tenda | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated… Attack
Exploitation
|
|||||||||
| CVE-2026-82695 | AC18Tenda | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remote… Attack
Exploitation
|
|||||||||
| CVE-2026-82970 | WP Cookie Notice for GDPR, CCPA & ePrivacy ConsentWP Legal Pages | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/… Attack
Exploitation
|
|||||||||
| CVE-2026-81779 | Newspapers XSilk Themes | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isImproper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48. Attack
Exploitation
|
|||||||||
| CVE-2026-81780 | Hash Formhashthemes | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-82971 | Opera11Apple | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack… Attack
Exploitation
|
|||||||||
| CVE-2026-82689 | DNS-320LD-Link | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIso… Attack
Exploitation
|
|||||||||
| CVE-2026-82692 | DNS-340LD-Link | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os comman… Attack
Exploitation
|
|||||||||
| CVE-2026-79748 | mcphubsamanhappy | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isMCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endp… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.