Saturday, September 19, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- IBM 16 critical 90
- WordPress 3 critical 77
- Red Hat 1 critical 39
- OISF 16
- Unknown 1 critical 10
- Microsoft 1 critical 10
- AcademySoftwareFoundation 10
- strukturag 1 critical 8
- MongoDB Inc. 2 critical 8
- HashiCorp 7
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses
Also in Malwarebytes Labs Bleeping Computer Hak5 +3
-
Google Gemini AI Hacked 3 Real Companies during a Cybersecurity Test
Google has confirmed that its Gemini artificial intelligence model accessed protected systems belonging to three companies during a cybersecurity evaluation after a testing error exposed the agent to the public internet. The incident shows how an autonomous AI system can move beyond a sandbox when controls, target definitions, and network isolation fail even without instructions to attack organizations. Irregular, a company that evaluates AI models for cybersecurity capabilities, conducted the exercise. Gemini was participating in a “capture the flag” challenge, a security test in which an…
Also in The Hacker News Wired Security CCCS Alerts & Advisories +3
-
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path
Also in The Hacker News Cyber Security News CISA Alerts & Advisories +2
-
Cisco drops another exploited zero-day, this time a perfect 10
Cisco admins who have spent their week patching email gateways now face a perfect-10 Identity Services Engine flaw under active attack. Cisco disclosed CVE-2026-76460 on Wednesday, describing it as an authentication bypass affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Successful exploitation can give an unauthenticated remote attacker command execution with root privileges. Product Security Incident Response Team said it was aware of active exploitation and urged customers to install the fixes immediately. CISA has also added the vulnerability to its…
Also in Dark Reading CyberScoop CCCS Alerts & Advisories +1
-
TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
CrowdSec has disclosed that attackers copied about 170 private GitHub repositories after a former employee’s account was compromised through May’s TanStack npm supply chain attack. The May 22 theft remained undetected until stolen source code appeared on a cybercrime forum on September 16, showing how a poisoned dependency can outlive its infection window and undermine developer identities. Data Leak Claim The incident traces to CVE-2026-45321 , the compromise of TanStack’s Router and Start ecosystem. On May 11, the threat actor chained an unsafe pull_request_target workflow, GitHub Actions…
Also in The Hacker News The Hacker News Bleeping Computer +1
-
BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers
A new attack technique dubbed “BragJack” allows a malicious browser extension to seize trusted communication channels used by AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome. Rather than bypassing model guardrails or hiding instructions inside web content, the proof-of-concept attacks directly supplied commands to privileged browser components, turning an assistant into a tool for theft and unauthorized actions. Forever Security researcher Gal Weizman demonstrated the technique across all five Chromium-based environments using one extension with browser-specific rules…
Also in Bleeping Computer The Hacker News
-
Critical Microsoft Azure AI Foundry Vulnerability Allows Attackers to Escalate Privileges
Microsoft has patched a maximum-severity security flaw in Azure AI Foundry, its enterprise platform for building and managing generative AI applications and agents, that could have allowed an unauthenticated attacker to escalate privileges over the network without any user interaction. Tracked as CVE-2026-85889 , the vulnerability carries the highest possible CVSS score of 10.0, placing it among the most severe cloud security issues disclosed this year. According to Microsoft’s advisory, published on September 17, 2026, the root cause is a missing authentication check for a critical function…
Also in The Hacker News SecurityWeek Microsoft Security +2
-
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw
Also in Bleeping Computer SecurityWeek CCCS Alerts & Advisories
-
Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link
WordPress administrators are being urged to update after researchers disclosed Click2Shell, an exploit chain that can turn one malicious link into remote code execution (RCE) on a vulnerable website. The issue begins with a WordPress Core theme-preview weakness that silently installs an attacker-selected theme from the official directory, then becomes a server compromise when chained with insecure pre-activation code in a theme. WordPress addressed the Core flaw in version 7.1.1 , released September 17, 2026, as part of an update containing 11 security fixes, 17 Core bug fixes, and 19 Block…
Also in The Hacker News SecurityWeek
-
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior. "SolarWinds
Also in CCCS Alerts & Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-93603 | vm2patriksimek | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isvm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.g. … Attack
Exploitation
|
|||||||||
| CVE-2026-93605 | vm2patriksimek | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isvm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary comma… Attack
Exploitation
|
|||||||||
| CVE-2026-93606 | vm2patriksimek | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isvm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer (hostPromiseSanitizeReject / makeSanitizedPromiseCa… Attack
Exploitation
|
|||||||||
| CVE-2025-15399 | Common LicensingIBM | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isIBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a u… Attack
Exploitation
|
|||||||||
| CVE-2026-10747 | MQ ApplianceIBM | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isIBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication. Attack
Exploitation
|
|||||||||
| CVE-2026-93740 | A3002MUTotolink | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate… Attack
Exploitation
|
|||||||||
| CVE-2026-93741 | A3002MUTotolink | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is… Attack
Exploitation
|
|||||||||
| CVE-2025-53837 | xwiki-renderingxwiki | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isXWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or a… Attack
Exploitation
|
|||||||||
| CVE-2026-10858 | MQ for HPE NonStopIBM | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isIBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages. Attack
Exploitation
|
|||||||||
| CVE-2026-61682 | kcpKubernetes | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it iskcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* iden… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
ZDI-26-718: Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20235.
Also in Zero Day Initiative Zero Day Initiative CCCS Alerts & Advisories +1
-
Exploring the new AWS Sign Up experience
This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.
Also in Palo Alto Unit 42
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.