Wednesday, September 16, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Oracle 98 critical 637
- Google 4 critical 140
- Mozilla 78
- WordPress 2 critical 62
- HP 6 critical 38
- Microsoft 7 critical 37
- Unknown 34
- Arista Networks 3 critical 31
- Concrete CMS 30
- IBM 2 critical 25
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
GhostCode is a newly identified phishing kit that turns a normal Microsoft 365 sign-in into an account takeover. It does not need to steal a password. Instead, it persuades people to approve a login that gives criminals access to their work account. The campaign began with ordinary-looking messages submitted through business contact forms. Attackers posed as procurement staff, followed up with a request to sign a non-disclosure agreement, then sent a WeTransfer link holding a password-protected HTML attachment. The file presented a document-sharing lure and directed the recipient to a…
Also in Cyber Security News Bleeping Computer Bleeping Computer +3
-
Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs
Hackers can now rent a Windows-focused remote access tool called VectraRAT for $250 a month, lowering the barrier to deep and persistent compromise. The malware gives paying operators a way to watch victims, steal data, run commands, and move traffic through an infected computer. VectraRAT has surfaced as a rental-only malware service rather than a one-off tool used by a single group. Investigators linked it to campaigns that use the Amadey loader and ClickFix pages, where fake verification prompts persuade people to run copied commands on their own devices. SOCRadar said in a report shared…
Also in The Register Security Dark Reading The Hacker News +3
-
Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems
Noodle RAT is a remote-access trojan that gives attackers control of compromised computers and servers. Its renewed visibility matters because it runs on both Windows and Linux, allowing one malware family to follow victims across corporate networks. The tool has appeared in operations against organisations across Asia-Pacific, including Thailand, India, Japan, Malaysia and Taiwan. Operators can steal files, run commands and route traffic through a victim system, expanding an initial breach into a wider network risk. Check Point analysts identified the malware as a distinct family, rather…
Also in Dark Reading Bleeping Computer The Hacker News +3
-
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
A single X DM split into two malware chains: AMOS stealer on Mac, NetSupport Manager on Windows, see the Huntress SOC analyst breakdown.
Also in CCCS Alerts & Advisories Malwarebytes Labs Wiz Research +1
-
Google fixes actively exploited Android zero-day on Pixel devices
Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks.
Also in CCCS Alerts & Advisories Microsoft Security Microsoft Security +1
-
Cisco email security boxes can be rooted by... an email
Criminals are exploiting a critical Cisco Secure Email Gateway flaw that can turn a malicious email into root access. The vulnerability, tracked as CVE-2026-76461, carries a 9.8 CVSS score and affects physical and virtual Secure Email Gateway appliances regardless of their configuration. Cisco says there are no workarounds, so patching is the only fix. The bug lies in how Cisco's AsyncOS software handles incoming email. An attacker doesn't need to log in: they can send a booby-trapped message through a vulnerable gateway and, if the exploit works, run commands as root. Which is not exactly…
Also in CyberScoop Rapid7 Blog The Hacker News +2
-
Threat Intelligence Alone Won't Close the Exploitation Gap
A leaked credential shows up in a criminal marketplace, or a vulnerability gets a disclosure advisory, and either one can be weaponized against a real target before most security teams have triaged the alert. Attackers are combining that kind of intelligence with AI-assisted exploitation to accelerate the path from exposure to breach faster than most security programs are built to react.
Also in Cisco Security Advisories CISA Alerts & Advisories Bleeping Computer +1
-
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said. The WordPress security company said it has blocked over
Also in Infosecurity Magazine SecurityWeek Bleeping Computer +2
-
HBO Max Reddit account compromised to serve ClickFix attacks
Someone compromised the official HBO Max Reddit account and used it to push more than 100 malicious ads serving up ClickFix attacks targeting both Windows and macOS devices with information-stealing malware. A Reddit user uncovered the infostealer ads on September 6, noting that the ad showed u/hbomax as the author — this is the verified HBO Max account — and advertised a macOS app for HBO Max. The streaming service does not offer a native client for the Mac. Anyone who clicked on the malicious ad would then be taken to a “somewhat-legitimate” looking landing page (hbomaxx[.]us) that includes…
Also in Palo Alto Unit 42 SANS Internet Storm Center
-
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once the extension was installed, it could access each product's built-in AI with a single click. On Comet, Edge,
Also in SecurityWeek The Hacker News The Hacker News +1
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-59971 | mysql_mcp_serverOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isMySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_setti… Attack
Exploitation
|
|||||||||
| CVE-2026-53710 | mcp-context-forgeIBM | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isMCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr… Attack
Exploitation
|
|||||||||
| CVE-2026-71133 | Oracle Access ManagerOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated… Attack
Exploitation
|
|||||||||
| CVE-2026-83020 | Oracle Platform Security for JavaOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allo… Attack
Exploitation
|
|||||||||
| CVE-2026-83021 | Oracle WebLogic ServerOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenti… Attack
Exploitation
|
|||||||||
| CVE-2026-83059 | Oracle Internet DirectoryOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated a… Attack
Exploitation
|
|||||||||
| CVE-2026-83099 | Oracle FormsOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated… Attack
Exploitation
|
|||||||||
| CVE-2026-87230 | Oracle Hyperion Financial ManagementOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with net… Attack
Exploitation
|
|||||||||
| CVE-2026-73453 | EOSArista Networks | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAn unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is … Attack
Exploitation
|
|||||||||
| CVE-2026-57138 | PraisonAIMicrosoft | Critical | 9.9 | 0.7% | — | — | — | EPSS 0.7%CVSS 9.9 | |
What it isPraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
On the NSA’s Supercomputer from the 1960s
Really interesting story about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA.
Also in CCCS Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.