Friday, September 11, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- IBM 8 critical 49
- WordPress 1 critical 44
- Unknown 1 critical 17
- OISF 1 critical 15
- MongoDB 15
- WWBN 1 critical 11
- strongSwan 9
- renovatebot 8
- Dell 4 critical 7
- tesseract-ocr 7
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Dark Reading US Government Accuses Chinese AI Firms of Distilling Frontier Models
US agencies claim Chinese companies covertly extracted billions of tokens from OpenAI, Anthropic, Google Gemini, and SpaceX's Grok to reduce development costs.
Also in Huntress CCCS Alerts & Advisories The Hacker News +2
-
Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections
Microsoft’s September 2026 security update KB5124008 is knocking some Windows 11 enterprise clients off Always On VPN after the Patch Tuesday package landed on September 8. Administrators who can reproduce the failure say certificate-based tunnels that worked immediately before the patch stop connecting afterward, then recover as soon as the cumulative update is removed and the device is rebooted. The first detailed account appeared on Microsoft Q&A on September 9, 2026, from an administrator running Windows 11 24H2 and 25H2 clients with Always On VPN, certificate-based authentication…
Also in Infosecurity Magazine Bleeping Computer Infosecurity Magazine +3
-
Metasploit Wrap Up: This One Goes to Sixteen!
This One Goes to Sixteen! Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers! New module content (16) Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read Authors: Bourbon Offensive Security Services and Jean-Marie Bourbon Type: Auxiliary Pull request: #21739 contributed by kmkz Path: scanner/http/elasticsearch_tika_xfa_xxe CVE reference: CVE-2025-66516…
Also in The Hacker News Sophos Threat Research Bleeping Computer +2
-
New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims
A newly uncovered Android threat combines ransomware with spying, creating a trap for people who install apps from untrusted links. Called Mantax Otax, the malware can lock files, watch the screen, intercept verification codes and secretly use a phone’s cameras, making one infection both an extortion and privacy crisis. The campaign appears built around standalone Android app packages, or APKs, hosted on third-party file-sharing services. Victims can be led to them through shared links, messaging apps or phishing messages, then persuaded to install the app outside the official store. Its…
Also in Malwarebytes Labs Dark Reading Bleeping Computer +3
-
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
At least four espionage groups, most with suspected links to China, are using a new exploit kit that chains two Chromium-based browser flaws and one Microsoft Windows bug to break into organizations' networks in the US and Southeast Asia. Mark Kelly, a threat researcher at email security shop Proofpoint, told The Register that the researchers don't know exactly who was targeted, nor how, and so far the damage appears limited. “In terms of organizations targeted, we saw fewer than 20 organizations globally targeted across the activity highlighted," he said. "However, the true number is almost…
Also in Malwarebytes Labs Bleeping Computer Malwarebytes Labs +3
-
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns
Also in Bleeping Computer Microsoft Security Microsoft Security +2
-
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described. One flaw affects Check Point's Security Gateways, its firewall appliances. The other affects those gateways and the Security
Also in SecurityWeek CCCS Alerts & Advisories
-
New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks
KATARU is a newly observed IoT malware strain that can turn poorly secured devices into DDoS attack nodes. The sample was captured after an attacker used repeated Telnet password guesses against a honeypot, then downloaded an ARM payload. It shows how old entry points still give attackers a foothold. The malware resembles the Mirai botnet family in its ability to flood targets with traffic, but carries wider tools. It can attempt to gain root access, stay active through reboots, hide command traffic, and run commands supplied by its operators. A compromised device can therefore be harder to…
Also in Cyber Security News Elastic Security Labs
-
Your Critical Vulnerabilities Might Not Be Your Biggest Risk
Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining which of those vulnerabilities actually create a path to compromise. A critical vulnerability may look alarming on a scanner report, but if it sits behind strong segmentation, identity controls, and other defenses that prevent an attacker
Also in Recorded Future Intelligence
-
GitLab Vulnerability Exploited One Day After Disclosure
The critical-severity path traversal flaw allows unauthenticated attackers to read arbitrary files from the GitLab server.
Also in Bleeping Computer
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-68487 | PleskWebPros | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isPath traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. Attack
Exploitation
|
|||||||||
| CVE-2026-68488 | PleskWebPros | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover. Attack
Exploitation
|
|||||||||
| CVE-2026-89049 | Amazon SSM AgentAWS | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms mig… Attack
Exploitation
|
|||||||||
| CVE-2026-89094 | ForgejoForgejo | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isForgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. Attack
Exploitation
|
|||||||||
| CVE-2026-9163 | GisLab Laboratory Management SystemGIS Informatics | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.… Attack
Exploitation
|
|||||||||
| CVE-2026-88877 | traefikCanonical | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isTraefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www… Attack
Exploitation
|
|||||||||
| CVE-2026-81467 | ThinOS 10Dell | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isDell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit … Attack
Exploitation
|
|||||||||
| CVE-2026-88018 | rclonerclone | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isrclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any cli… Attack
Exploitation
|
|||||||||
| CVE-2026-88899 | knownsknowns-dev | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isknowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root o… Attack
Exploitation
|
|||||||||
| CVE-2026-52098 | Unknown | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAn issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-75862.
Also in CCCS Alerts & Advisories Zero Day Initiative Zero Day Initiative +1
-
ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-84387.
Also in CCCS Alerts & Advisories CCCS Alerts & Advisories CISA Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.