Thursday, September 10, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Dell 1 critical 59
- Unknown 35
- grokability 32
- WordPress 1 critical 24
- GeoVision Inc. 2 critical 22
- Apache 20
- pmmp 18
- open-webui 13
- Microsoft 1 critical 12
- Red Hat 12
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Register Security Serial Microsoft 0-day hunter drops yet another Defender exploit
Zero-day researcher Nightmare Eclipse, aka MSNightmare, published yet another Microsoft Defender proof-of-concept exploit for a zero-day dubbed ShieldCrash, which they claim will allow attackers to bypass the earlier ShieldBreak patch and read files as SYSTEM. “I might rework this later into a full SYSTEM PoC but for now I'm dropping this skeleton PoC because I'm feeling a bit lazy,” the prolific Microsoft bug hunter and thorn in Redmond's side said in their latest zero-day exploit's README. As is usual with Nightmare’s zero-day cadence, they published ShieldCrash shortly after Microsoft…
Also in Dark Reading Bleeping Computer Bleeping Computer +3
-
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
At least four espionage groups, most with suspected links to China, are using a new exploit kit that chains two Chromium-based browser flaws and one Microsoft Windows bug to break into organizations' networks in the US and Southeast Asia. Mark Kelly, a threat researcher at email security shop Proofpoint, told The Register that the researchers don't know exactly who was targeted, nor how, and so far the damage appears limited. “In terms of organizations targeted, we saw fewer than 20 organizations globally targeted across the activity highlighted," he said. "However, the true number is almost…
Also in Malwarebytes Labs Bleeping Computer Malwarebytes Labs +3
-
US Government Accuses Chinese AI Firms of Distilling Frontier Models
US agencies claim Chinese companies covertly extracted billions of tokens from OpenAI, Anthropic, Google Gemini, and SpaceX's Grok to reduce development costs.
Also in CCCS Alerts & Advisories The Hacker News Infosecurity Magazine +3
-
ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-84387.
Also in SecurityWeek CCCS Alerts & Advisories CCCS Alerts & Advisories
-
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical
Also in CCCS Alerts & Advisories Zero Day Initiative Zero Day Initiative +2
-
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below - CVE-2026-20079 (CVSS score: 10.0) - An authentication
Also in Bleeping Computer CCCS Alerts & Advisories
-
Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks
Check Point Software has disclosed and patched two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a maximum CVSS score of 9.8 and both capable of allowing unauthenticated remote code execution under specific conditions. Check Point’s own research team uncovered the flaws, and the company says it has found no evidence of active exploitation or public proof-of-concept code as of this writing. Check Point VPN Vulnerabilities CVE-2026-85102 is rooted in improper certificate trust validation during VPN negotiation, tracked under CWE-295. According to Check…
Also in The Hacker News CCCS Alerts & Advisories The Hacker News
-
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operating system. Second, CVE-2026-20316 is a vulnerability that allows a remote attacker to log in using a low-privileged account. CVE-2026-20079 is a critical vulnerability with a CVSS…
Also in SecurityWeek Bleeping Computer
-
Top 10 Best Server Security Solutions in 2026
Bottom line up front: servers are not big laptops. They run Linux as often as Windows, can’t tolerate agent-induced latency, host the data ransomware actually wants, and increasingly live as VMs, containers, or cloud instances. Deploying dedicated endpoint detection and response (EDR) on servers requires balancing performance overhead with deep telemetry. Trend Micro’s server heritage still leads for hybrid estates, CrowdStrike and SentinelOne bring the strongest detection, Defender for Servers wins on Azure-centric economics and the quiet failure mode everywhere is the hypervisor nobody’s…
Also in Microsoft Security Microsoft Security Microsoft Security +1
-
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps
Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their
Also in SecurityWeek Infosecurity Magazine The Hacker News +3
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-67401 | cPanelWebPros | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component Attack
Exploitation
|
|||||||||
| CVE-2026-19583 | VelociraptorRapid7 | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isVelociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However… Attack
Exploitation
|
|||||||||
| CVE-2026-85978 | AkanaPerforce | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAn unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to byp… Attack
Exploitation
|
|||||||||
| CVE-2026-80172 | Secure Connect GatewayDell | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could ex… Attack
Exploitation
|
|||||||||
| CVE-2026-85102 | Quantum Security GatewayCheck Point | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. Attack
Exploitation
|
|||||||||
| CVE-2026-85103 | Quantum Security GatewayCheck Point | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems. Attack
Exploitation
|
|||||||||
| CVE-2026-87929 | MaxSite CMSMaxSite | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isMaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can min… Attack
Exploitation
|
|||||||||
| CVE-2026-18351 | Drag and Drop File Upload for Elementor FormsWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validati… Attack
Exploitation
|
|||||||||
| CVE-2026-7188 | Access Control SystemArmiya Information Technologies Ltd. Co. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Ver… Attack
Exploitation
|
|||||||||
| CVE-2026-88278 | GV-LPCLPC2011/2211GeoVision Inc. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isGeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI
Open-source registries for AI agents are only effective when they include a rigorous, transparent security review process for community submissions. That’s why for its new CyberAgents Exchange registry, Tenable paired its exposure management expertise with OpenAI GPT Cyber models to create the CyberAgents Exchange AI Inspector. Key takeaways The Exchange Inspector combines Tenable’s exposure detection with OpenAI’s GPT Cyber models and with human oversight to rigorously vet submissions made to the CyberAgents Exchange. Securing AI agents requires analyzing a broad attack surface that includes…
Also in Microsoft Security
-
StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day
A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became available. Key takeaways CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that can be triggered without authentication. Active exploitation of CVE-2026-75650 began on September 4, 2026, three days before Adobe released a hotfix, with multiple victim stores confirmed across different…
Also in CISA Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.