Thursday, September 3, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Jenkins 33
- WordPress 3 critical 30
- Drupal 1 critical 26
- Elastic 15
- craftcms 1 critical 13
- Cisco 3 critical 11
- F5 7
- Microsoft 6
- Red Hat 1 critical 6
- nuclio 5
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Microsoft to Expand Memory Integrity Protection Across Windows Devices
Microsoft will begin expanding memory integrity protection across eligible Windows devices in October 2026, automatically enabling a stronger kernel-level security baseline for more users and organizations. The change is designed to protect Windows from sophisticated attacks that attempt to tamper with critical operating system components, while requiring little or no additional configuration. Memory Integrity, built on Virtualization-based Security (VBS), uses hardware-assisted virtualization to isolate sensitive Windows components and prevent malicious code from modifying protected kernel…
Also in Bleeping Computer Bleeping Computer Cyber Security News +3
-
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs
Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program. "The Fairwind Program gives high-priority defenders (like governments, healthcare providers, and telecommunications services) early access to advanced models that help them
Also in Infosecurity Magazine CCCS Alerts & Advisories Malwarebytes Labs +2
-
Rockwell Automation 1756-ENBT Module
View CSAF Summary Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover. The following versions of Rockwell Automation 1756-ENBT Module are affected: 1756-ENBT module vers:all/* (CVE-2025-10478) CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation 1756-ENBT Module Improper Check for Unusual or Exceptional Conditions Background Critical Infrastructure Sectors: Critical Manufacturing, Food and Agriculture, Transportation Systems, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters…
Also in CISA Alerts & Advisories CISA Alerts & Advisories CISA ICS Advisories +3
-
New StreamRAT Android Trojan Gives Hackers Full Remote Control Through VNC and Accessibility
StreamRAT is a new Android banking trojan that gives criminals broad control of an infected phone. It pairs streaming offers with screen viewing, remote actions and deceptive login windows, turning an app download into an account takeover. The campaign targeted Spanish-speaking Android users through advertisements on Meta platforms and TikTok. One observed advertising push reached 570,000 Meta users between 11 June and 3 July 2026, mainly in Spain. It identified the malware while tracking the streaming-themed Steamtv Esp campaign. The operators used a phishing site and a multi-stage…
Also in Malwarebytes Labs Malwarebytes Labs The Hacker News
-
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an IOS XR hardening release bundling 7 umbrella CVEs, 2 of which are rated 9.8, with no workaround for any IOS XR version. The Nexus vulnerability, tracked as CVE-2026-20212 (CVSS score: 9.8), is
Also in CCCS Alerts & Advisories SecurityWeek
-
The Agentic SOC – From AI Theater to Real Defense
Moving beyond "AI theater" with measurable KPIs: Security teams must distinguish between genuine value and "productivity theater." Success requires defining concrete KPIs—such as cost improvement, risk reduction, and speed—to measure true ROI, rather than deploying AI tools without a clear strategic purpose. Mitigate new autonomous risks: The shift to an agentic SOC introduces distinct threats, such as indirect prompt injection, and creates visibility gaps that traditional SIEM platforms are not built to handle. Organizations should shift from post-event observability to proactive control…
Also in Microsoft Security Blog Dark Reading
-
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as
-
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. "Unlike the standard infostealer model, BraZetsu is a comprehensive master toolkit that empowers Initial Access Brokers (IABs) by turning compromised systems into highly valuable commercial
Also in Microsoft Security Microsoft Security Microsoft Security
-
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone
The iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware, according to new findings from the Citizen Lab in collaboration with the SHARE Foundation. "Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group's Pegasus spyware," the Citizen Lab said. "We found high-confidence indicators of
Also in Infosecurity Magazine
-
Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data
Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing Corporation unit, in March 2026, affecting courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. West Publishing said it discovered the activity on June 30, 2026. A subset of court records could contain individuals' names
Also in The Record
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-4357 | Embed HTML5 GameWordPress | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isThe Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites. Attack
Exploitation
|
|||||||||
| CVE-2026-77009 | WatchMan-Site7WordPress | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isThe WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server. Attack
Exploitation
|
|||||||||
| CVE-2026-81294 | AuthorizerPaul Ryan | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-84795 | cmscraftcms | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isCraft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges … Attack
Exploitation
|
|||||||||
| CVE-2025-9314 | Developer ToolsWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component Attack
Exploitation
|
|||||||||
| CVE-2026-53611 | looking-glassAS203038 | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isLooking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit … Attack
Exploitation
|
|||||||||
| CVE-2026-20212 | Cisco NX-OS SoftwareCisco | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 ar… Attack
Exploitation
|
|||||||||
| CVE-2026-20274 | Cisco IOS XR SoftwareCisco | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that a… Attack
Exploitation
|
|||||||||
| CVE-2026-20279 | Cisco IOS XR SoftwareCisco | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that a… Attack
Exploitation
|
|||||||||
| CVE-2026-19117 | Secret Server (On-Prem)Delinea | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnder specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.