Security news, decoded.

CISA has updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-63077, a critical authentication bypass in JetBrains TeamCity On-Premises, as now being leveraged by ransomware operators. JetBrains fixed the bug on July 25 in versions 2025.11.7 and 2026.1.3; it allows an unauthenticated attacker to abuse the agent polling protocol to run arbitrary OS commands with the TeamCity server's privileges, potentially exposing credentials and compromising CI/CD pipelines. CISA first added the flaw to its exploited-vulnerabilities list back on August 5, and JetBrains confirmed in-the-wild attacks two days later, but this is the first time the ransomware angle has been officially confirmed. Shadowserver currently counts around 160 internet-facing TeamCity instances still unpatched, down from roughly 700 shortly after disclosure, and organizations running exposed servers are urged to apply the fix immediately given TeamCity's history of abuse by both state-sponsored actors and ransomware crews.

SolarWinds has shipped fixes for two high-impact security flaws in its Observability Self-Hosted monitoring platform, both of which could let unauthenticated remote attackers execute arbitrary code. The more severe issue, CVE-2026-28324 (CVSS 9.8), stems from an insufficient integrity check that becomes exploitable on instances running insecure, non-default settings. The second, CVE-2026-28325 (CVSS 8.8), involves unsafe deserialization of untrusted data on systems configured with a particular communication mode. Both bugs affect every Observability Self-Hosted release up to 2026.2.2 and are resolved in 2026.2.3; researcher Kai Huang of Armadin was credited with reporting them. This follows last week's fix for CVE-2026-28326 (CVSS 8.8) in SolarWinds Access Rights Manager up to version 2026.2, caused by a hardcoded static key that also allowed unauthenticated remote code execution. SolarWinds states none of these vulnerabilities have been observed being exploited in the wild, and customers are urged to apply the available updates.

GNOME has released version 50.5, closing a security gap in the gvfs file-system component, a code-injection bug in the Epiphany browser, and a use-after-free flaw in the librsvg image-rendering library. The update touches 22 modules in total, and the GNOME Release Team is urging every distribution running GNOME 50 to pull in the new packages. Epiphany moves from 50.4 to 50.6, folding in two earlier point releases. One of them stops JavaScript from being injected through a CSS selector used in the autofill feature, and also fixes a path-traversal issue in WebExtension XPI archives (a ZIP slip bug that could let a malicious extension drop files outside its intended folder). The other adds proper quoting to command-line arguments before Epiphany passes them to a shell. gvfs 1.60.3 carries the one named vulnerability in this release, CVE-2026-88924, fixed by having the admin backend set socket ownership before the socket is created — though GNOME's notes give no severity rating for it. librsvg 2.62.4 patches a use-after-free triggered by duplicate XML entities inside nested XInclude documents, alongside Rust dependency updates addressing RUSTSEC-2026-0187 and RUSTSEC-2026-0204. The login manager GDM also gets fixes for two use-after-free bugs — one capable of crashing an entire session during screen lock/unlock — plus a regression that had broken systemd authentication after a prior security patch.

Patchstack reports that a newly patched WordPress flaw started being exploited mere hours after it became public, with activity already escalating to full-blown site takeovers. The bug, CVE-2026-87902 (CVSS 9.2), is a path traversal issue in how WordPress resolves page templates via getpagetemplate(), letting unauthenticated attackers pull in an arbitrary readable local .php file from outside the active theme's folder. When the active theme's top-level directory name begins with 'page-' and the server can read a chosen PHP target, this can be chained with the known pearcmd.php PEAR-to-RCE trick (requiring registerargcargv enabled) to achieve remote code execution — a setup present in the official PHP Docker image and in default cPanel configs running PHP below 8.5. Affected theme structures include the old Twenty Twelve and Twenty Fourteen defaults as well as third-party themes like Neve, Hestia, and Sydney. WordPress fixed the issue in version 7.1.2 on September 22, with the patch backported as far as the 4.7.x line, but Patchstack says attackers crafted exploit payloads directly from the patch diff and ramped up from reconnaissance scans to live compromises by September 23, with traffic now ten times higher than on the first night and expected to keep growing given public scanning tools.

Security researchers report that attackers began probing and exploiting a critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), within hours of the patch being released on September 22, 2026. The bug lets an unauthenticated attacker manipulate page-template resolution in getpagetemplate() to pull in an arbitrary readable local PHP file from outside the active theme, which can lead to remote code execution if the server environment and theme meet certain conditions. Honeypot data from Previdian and Patchstack shows real-world abuse using the local pearcmd.php file to drop web shells in /tmp or /var/tmp, with dozens of attempts logged from IPs in the US, Indonesia and elsewhere. Site owners are urged to immediately update to WordPress 7.1.2, 7.0.6, 6.9.9 or 6.8.10 and check their environments for signs of compromise, since mass scanning is expected even though actual successful breaches may remain limited thanks to default auto-updates.

watchTowr Labs found that CVE-2026-94127 in F5 BIG-IP APM lets an unauthenticated attacker send an oversized Authorization header during an OAuth request, causing a heap overflow that can be developed into remote code execution. The issue affects BIG-IP APM 21.x and 17.x, and F5 reports active exploitation, making prompt installation of the available hotfixes important for exposed deployments.

Check Point confirmed attackers are exploiting CVE-2026-85102, a pre-authentication RCE flaw in Security Gateway VPN certificate handling, and CVE-2026-93616, a pre-authentication path traversal issue in the Management web service that can enable script execution and Java class loading. Organizations should deploy the recommended LivePatch or Jumbo Hotfix updates for supported gateways and update Spark firewalls, while applying access-rule mitigations where patching is not possible.

Threat actors are actively exploiting the critical unauthenticated path traversal flaw CVE-2026-87902 in WordPress to write PHP files that can run shell commands when accessed. WordPress fixed the issue in version 7.1.2 and backported fixes to branches down to 4.7; administrators should update promptly and review logs for double-encoded traversal probes and suspicious files in /tmp or /var/tmp.

Attackers have exploited the MikroTrick chain, combining CVE-2026-67279 and CVE-2026-86060 to gain administrator control of Internet-exposed MikroTik RouterOS devices without credentials. MikroTik fixed the flaws in RouterOS 6.49.21, 7.23.4, and 7.24.2, but organizations should also investigate systems for signs of prior compromise, including SSH logins using -2 and unknown ops accounts. Exposed SSH services face the greatest risk; compromised routers should be isolated, reset, rebuilt from trusted configurations, and have credentials rotated.

CISA added actively exploited Linux kernel flaws CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its KEV Catalog, with the shortest BOD 26-04 remediation deadline expiring on September 21, 2026. CVE-2025-39682 can expose memory or cause denial of service, CVE-2026-53266 can corrupt memory and potentially enable local privilege escalation, and CVE-2025-39964 can crash systems or produce corrupted cryptographic output. Organizations should urgently update affected Linux systems, prioritizing internet-facing assets.

Eclypsium's InfraTrust report says attackers are increasingly targeting network administration platforms, where compromise can provide broad control over managed infrastructure. Actively exploited vulnerabilities include Cisco Secure Firewall Management Center flaws CVE-2026-20079 and CVE-2026-20316, Cisco Identity Services Engine flaw CVE-2026-76460, and SonicWall SMA 1000 flaws CVE-2026-83548 and CVE-2026-83549. Organizations should apply vendor hotfixes and updates, restrict access to management interfaces, and investigate potentially compromised appliances.

Arista Networks has issued patches for CVE-2026-93952, an actively exploited zero-day in VeloCloud Orchestrator (VCO) On-Prem deployments using certificate-based VeloCloud Edge-to-VCO authentication. The input-validation flaw can let remote attackers with network access to the VCO web interface reach privileged internal host functions without VCO credentials; hosted VCO 5.2.3.16 or later and VCO 6.4.2.8 or later are patched, while fixes are planned for 6.1.3.7 and below and 7.0.0.2 and below.

cPanel has fixed CVE-2026-87899 in CalDAV and CardDAV, which could allow an authenticated hosting account to execute code as root on cPanel & WHM version 120 and later. The updates also address CVE-2026-68490, exposing other accounts' calendar and contact data, and CVE-2026-87900 in WP Toolkit 6.11.2-10794 and older, which permits cross-account database changes; administrators should update cPanel & WHM to 11.134.0.57, 11.136.0.41, 11.138.0.8, or later, and WP Toolkit to 6.11.3 or later.

Adobe has issued updates for 36 vulnerabilities, including critical flaws in Adobe Connect and AEM Forms that could enable code execution or privilege escalation. The Adobe Connect issues are CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, involving SQL injection, XSS, and input-validation weaknesses. AEM Forms fixes CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000, while Adobe also patched other products; the company reports no known in-the-wild exploitation and recommends applying the priority 2 updates within 30 days.

DepthFirst released proof-of-concept code for CVE-2026-80521, a Linux Kernel AFUNIX socket use-after-free that can let a containerized attacker obtain root access on the host. Ubuntu 26.04, 24.04, and 22.04 LTS remain unpatched, including newer kernel packages used for AWS, Azure, and GCP workloads. The upstream Linux Kernel fix is available, but Ubuntu lists the issue as work in progress; no confirmed in-the-wild exploitation has been reported.

Check Point has issued emergency fixes for CVE-2026-93616, a pre-authentication path traversal flaw affecting its Management Server products, after attacks dating to July 23, 2026. Exploitation attempts are also targeting Check Point Spark Firewalls through CVE-2026-85102, an authentication bypass and RCE vulnerability; organizations should patch, review Mobile Access activity, and limit Management Server access where fixes cannot be applied. CISA also added CVE-2026-93952 in Arista VeloCloud Orchestrator and CVE-2026-94127 in F5 Networks’ BIG-IP APM to its Known Exploited Vulnerabilities catalog, highlighting the need to check affected systems for compromise.

WordPress has released 7.1.2 to address CVE-2026-87902, an unauthenticated path traversal vulnerability affecting versions 4.7.0 through 7.1.1. The flaw in getpagetemplate() can let remote attackers cause WordPress to include readable PHP files outside the active theme directories, potentially leading to server-side code execution under certain configurations. WordPress also backported the fix to supported older branches, and site operators should update promptly.

Arista has released emergency fixes for CVE-2026-93952, a CVSS 10 improper input validation flaw actively exploited against on-premises VeloCloud Orchestrator deployments. The issue can let a remote attacker reach privileged internal functions, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its managed data. Arista fixed the affected 5.2.x and 6.1.x trains in VCO versions 5.2.3.16 and 6.4.2.8, respectively, and advises organizations to update immediately.

F5 has released engineering hotfixes for CVE-2026-94127, an exploited heap-based buffer overflow in BIG-IP Access Policy Manager when it operates as an OAuth authorization server. Unauthenticated attackers can send crafted traffic to an affected virtual server and execute code; impacted releases are 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3 before their respective hotfixes. Organizations should install the applicable F5 hotfix, or obtain F5's iRule mitigation while investigating for compromise.

Chinese-linked actor UTA0565 used fake websites to exploit a zero-day chain affecting Google Chrome and Microsoft Windows: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The flaws enabled a browser sandbox escape and remote code execution, delivering the CLEANGULP malware, which can run commands, manage files, inspect processes, and execute BOF payloads.

F5 has confirmed active zero-day exploitation of CVE-2026-94127, a CVSS 9.8 vulnerability in BIG-IP Access Policy Manager. Unauthenticated attackers can execute code remotely when a vulnerable BIG-IP APM deployment is configured as an OAuth Authorization Server with an access policy and OAuth profile on a virtual server. Affected releases are BIG-IP APM 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3; F5 has issued hotfixes. CISA has also added the flaw to its Known Exploited Vulnerabilities catalog, making prompt remediation important.

F5 released fixes for CVE-2026-94127, an actively exploited remote code execution zero-day in BIG-IP Access Policy Manager. The issue affects BIG-IP APM virtual servers configured with both an access policy and OAuth profile when operating as an OAuth Authorization Server; OAuth Client or Resource Server-only deployments are not affected. CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog. Organizations should install F5's updates, investigate OAuth authentication failures, suspicious commands, and subsequent TMM SIGABRT events, or apply F5's iRule mitigation where patching is delayed.

ShinyHunters claims it breached FBI systems, defaced a subdomain of fbijobs.gov, and obtained personal data allegedly belonging to thousands of FBI employees. The group says it used a zero-day flaw in Oracle PeopleSoft to access FBI systems and steal 2-3 TB of information, though the FBI is still investigating and the data's source has not been confirmed. ShinyHunters has previously been linked to in-the-wild exploitation of the Oracle PeopleSoft vulnerability tracked as CVE-2026-35273, but it is unclear whether that flaw was used in the alleged FBI incident.

Vercel has patched CVE-2026-94545, a critical Next.js vulnerability that can allow server-side code execution when Node.js ImageResponse processes attacker-controlled values in generated SVG content. The issue affects Next.js 16.2.0 through 16.3.5; Next.js 15 and the Edge implementation of ImageResponse are not affected. Organizations should upgrade to Next.js 16.3.6, while developers using Satori directly should update to version 0.33.5.

Check Point has issued urgent fixes for CVE-2026-93616, a CVSS 9.8 directory traversal and file upload flaw exploited in attacks against Management Server. The issue affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent, allowing unauthenticated attackers to upload and run arbitrary scripts. The company also reports exploitation attempts targeting Spark Firewall customers through CVE-2026-85102, which can bypass VPN authentication and enable code execution on Security Gateway and Spark Firewall; organizations should apply the available updates and restrict Management Server access to trusted IP addresses.

ShinyHunters claims it breached the FBI and obtained data on current and former employees, as well as FBI job applicants. The group says it used an undisclosed Oracle PeopleSoft pre-authenticated RCE flaw to compromise FBIjobs.gov, while CVE-2026-35273 was previously exploited by the group against enterprise networks; the FBI is investigating the claims.

The NetBSD Project released NetBSD 10.2 with a fix for a remotely triggerable null pointer dereference in ipfilter that could crash the kernel, plus a TCP timestamp issue that exposes 4 bytes of kernel stack data. The update also addresses unspecified security issues in NFS and telnet, updates OpenSSL to 3.0.21, Xorg to 21.1.24, and xkbcomp to 1.5.0, and includes fixes for libXpm CVE-2026-4367 and unbound CVE-2025-11411. Administrators should upgrade NetBSD 10 systems, updating the kernel and modules before userspace when using a manual upgrade path.

Patchstack observed active probing for CVE-2026-87902 less than five hours after WordPress 7.1.2 was released. The unauthenticated path traversal flaw affects WordPress Core 4.7.0 to 7.1.1 and can lead to local file inclusion and, under certain server conditions, RCE; administrators should update to 7.1.2, 7.0.6, 6.9.9, 6.8.10, or the applicable backport through 4.7.37.

A Chinese-speaking threat actor linked to Red Heron exploited WordPress Core wp2shell flaws CVE-2026-63030 and CVE-2026-60137 to breach organizations, including government targets, and steal database records containing passwords and PII. The campaign also exploited ZyXEL GS1900 Smart Managed Switches flaw CVE-2026-7273 and targeted PAN-OS GlobalProtect, FlowiseAI CVE-2026-56271, Ubiquiti UniFi OS CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, Linux CVE-2022-0847, Gitea CVE-2026-60004, Nuclio CVE-2026-79756, SENAITE LIMS CVE-2026-54569, and Proxmox VE CVE-2023-54391. Organizations should review GreyNoise IoCs and patch exposed systems, as the activity resulted in stolen credentials, device configurations, and sensitive records.

Check Point says CVE-2026-93616 was used in targeted attacks against its Security Management Server on July 23. The path traversal vulnerability can let an unauthenticated attacker upload and execute scripts through the server's web service, so administrators should apply the fixes in sk1000171 and investigate for prior compromise. The company also reported exploitation attempts against CVE-2026-85102 on Check Point Spark Firewalls, a VPN certificate-validation flaw fixed on September 9.

WordPress has released fixes for CVE-2026-87902, a CVSS 9.2 core vulnerability affecting versions 4.7.0 through 7.1.1. An unauthenticated attacker could cause WordPress to load PHP files outside theme directories, which could lead to attacker-controlled code execution on certain server and theme configurations. Site owners should update to WordPress 7.1.2 or the applicable supported-branch release; no workaround is available.

JFrog researchers released proof-of-concept details for CVE-2026-90898, a CVSS 9.8 flaw in Bifrost AI Gateway that lets unauthenticated attackers launch commands through MCP client registration when management authentication is disabled. All Bifrost HTTP transport versions before 2.1.0 are affected; operators should update to transports/v2.1.0 and rotate provider credentials if an exposed instance ran without authentication. The research also covers CVE-2026-86242, fixed in transports/v2.0.0, which can enable code execution on dynamically linked builds or SSRF on statically linked builds.

Check Point has released R82.20 Security Hotfix for CVE-2026-93616, an actively exploited path traversal vulnerability affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Unauthenticated attackers can upload and run arbitrary scripts, so organizations should apply the hotfix, review indicators of compromise, and restrict management access to trusted IP addresses where immediate patching is not possible.

A public proof of concept named BigDiskBuster can prevent Microsoft Defender from downloading platform and signature updates by exhausting free space on the C:\ drive. The tool has no assigned CVE and no Microsoft patch or advisory; it may leave Defender running with outdated detection content, although its claimed behavior has not been independently verified. It differs from the previously patched UnDefend issue, CVE-2026-45498, which Microsoft addressed in Antimalware Platform version 4.18.26040.7.

WordPress 7.1.2 addresses CVE-2026-87902, an unauthenticated local file inclusion flaw in page template resolution affecting WordPress Core from 4.7.0 through 7.1.1. The issue can allow remote code execution under certain server configurations, so administrators should apply the available fixed release as soon as possible.

D-Link has disclosed two unpatched vulnerabilities with public PoC code affecting legacy DIR-822A dual-band Wi-Fi routers: CVE-2026-86296 and CVE-2026-86510. CVE-2026-86296 is an unauthenticated DHCP server stack buffer overflow that could let an attacker on the local network crash the service or execute code, while CVE-2026-86510 can cause memory corruption on devices using L2TP or L2TPv6 WAN connectivity. D-Link is investigating and developing fixes; customers should keep these routers off the internet, limit remote management, and restrict administrative access to trusted systems.

Arista Networks says attackers are actively exploiting CVE-2026-93952, a CVSS 10.0 vulnerability in on-premises VeloCloud Orchestrator deployments using certificate-based Edge authentication. A remote unauthenticated attacker with network access to the VCO web interface and an Edge certificate's public portion could access privileged internal functions, compromise the orchestrator, and potentially reach managed Edge devices. Fixed releases are available for 5.2 and 6.4, while fixes for affected 6.1 and 7.0 releases are pending; organizations should restrict VCO web access and monitor for signs of compromise.

Chinese threat actor Red Heron has exploited CVE-2026-7273, a CVSS 8.8 unauthenticated stack-based buffer overflow in ZyXEL GS1900-series switches. GreyNoise observed attacks in 48 countries that used crafted HTTP requests to run commands and steal hashed root credentials, device configurations, and network data from 996 systems. ZyXEL released updates for ten affected models in June, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog after the campaign exposed many devices still using factory-default credentials.

CVE-2026-89775 in Linux Kernel ARM64 KVM can let a guest virtual machine retain read-write access to freed host kernel memory when nested virtualization is enabled, potentially enabling a guest-to-host escape. The issue is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1; no exploitation or public exploit code has been reported, and ARM64 nested virtualization is disabled by default.

Technical details and a public proof of concept show that CVE-2026-65660 in Microsoft SharePoint Server can enable authenticated remote code execution, despite initially being described as a spoofing issue. The flaw affects SharePoint Server 2016, 2019, and Subscription Edition, where crafted web-part markup can bypass SafeControls checks and load arbitrary .NET classes. Microsoft patched the issue in its August 11 security updates; no in-the-wild exploitation has been reported.