Security news, decoded.

A Chinese-speaking threat actor exploited CVE-2026-7273 in unpatched ZyXEL GS1900 Smart Managed Switches, compromising 996 devices in 48 countries and stealing configurations, network details, and hashed root credentials. The stack-based buffer overflow affects firmware 2.90(XXXX.1)C0 and earlier and enables unauthenticated command execution over LAN; CISA has listed it as exploited, while CVE-2026-32996 in Veeam Agent for Windows is also under active attack and should be remediated by upgrading Veeam Backup & Replication to 13.0.2.29 or later.

Researcher Abdelhamid Naceri released BigDiskBuster, a proof of concept that can prevent Windows Defender from receiving platform and signature updates on supported Windows versions while it runs in the background. The update-blocking issue has no CVE ID or vendor patch yet; it follows other Defender flaws, including ShieldBreak, tracked as CVE-2026-69414.

CISA has added CVE-2026-7273, an actively exploited stack-based buffer overflow in ZyXEL GS1900 switches, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to apply fixes by Thursday. Crafted HTTP requests can allow an unauthenticated attacker on the LAN to execute operating-system commands, creating a path to device compromise and data theft. GreyNoise reports that a suspected Chinese-speaking actor exploited the flaw to steal data from 996 ZyXEL switches across 48 countries; organizations using affected GS1900 models should update to Zyxel's patched firmware releases.

WordPress has fixed CVE-2026-93485, known as Comment2Shell, an issue that could let an anonymous commenter inject script into a page. If a logged-in administrator viewed the affected comment, the script could abuse that session to upload a malicious plugin and execute code on the server. The flaw affects WordPress 4.7 through 7.1; update to WordPress 7.1.1 or the fixed release for the supported branch. No exploitation has been reported.

CISA has added CVE-2026-7273, an actively exploited stack-based buffer overflow in Zyxel GS1900 series switch firmware, to its KEV catalog. The flaw affects specified GS1900 models through their listed 2.90 firmware releases and can let an unauthenticated LAN attacker run operating-system commands through a crafted HTTP request; federal agencies must apply fixes by September 24, 2026. Arctic Wolf also reported active exploitation of CVE-2026-32996 in Veeam Agent for Microsoft Windows, where a local attacker can reuse exposed elevated session identifiers to execute commands with SYSTEM privileges.

Check Point's weekly report says Cisco is aware of active exploitation of CVE-2026-76460 in Cisco Identity Services Engine, which can give unauthenticated remote attackers access to the management interface; Cisco also fixed CVE-2026-76461 in Secure Email Gateway. Check Point patched CVE-2026-91843 in Security Management and Log Servers, Oracle addressed more than 800 flaws including in Oracle E-Business Suite, and ISC updated BIND 9 for 14 issues, including CVE-2026-77692; the roundup also covers breaches affecting Japan Digital Agency Government Solution Service, Brevo, and Gyazo, plus the WaterPlum campaign.

CISA has added CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 in the Linux Kernel to its Known Exploited Vulnerabilities catalog after confirming their use in attacks. The flaws involve AFALG cryptographic sockets, ebtables SNAT, and the kTLS receive path, with potential consequences including memory corruption, system crashes, altered cryptographic behavior, and privilege escalation. Federal agencies must apply available mitigations and updates and perform forensic triage on affected assets.

ShinyHunters claims it compromised rival ransomware group Clop's leak-site server by abusing an unauthenticated file-upload flaw in Grav CMS, though the alleged theft of server data has not been independently confirmed. The group has threatened to disclose information about organizations that paid Clop, including companies targeted in the Oracle E-Business Suite campaign tied to CVE-2025-61882. If victim records were obtained, affected organizations could face further data exposure or renewed extortion even after dealing with Clop.

Cisco disclosed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication-bypass flaw in Identity Services Engine (ISE) that can give remote unauthenticated attackers access to affected devices. The weekly roundup also covers Plugin4Shell, a SHA-pinning bypass enabling zero-click RCE in Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI, alongside CVE-2026-32882 in Discourse community forum, fixed upstream in libheif 1.22.0. Other incidents include ClickFix campaigns, Brevo's supply-chain compromise, and KREMLIN malware targeting Google Chrome and Microsoft Edge credentials.

CISA has added CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266 to its Known Exploited Vulnerabilities catalog, confirming exploitation of three Linux kernel flaws. The issues can enable denial of service, memory disclosure or corruption, unpredictable cryptographic results, and unauthorized memory modification through affected TLS, AFALG socket, and bridge Netfilter ebtables SNAT code. Federal agencies have been directed to remediate all three vulnerabilities within three days.

ESET says SMBs adopting AI agents face new risks from excessive permissions, malicious skills, supply-chain changes, and prompt injection. The report highlights Microsoft 365 Copilot and CVE-2025-32711, where indirect prompt injection could expose data, while warning that AI is also accelerating phishing, vulnerability exploitation, and ransomware activity.

Microsoft has fixed CVE-2026-66804, a Windows privilege-escalation flaw involving a dangling registration for the CrossDevice COM object. The issue, an incomplete remediation for CVE-2026-50343, could let a local user place a DLL in a writable ProgramData path and have it loaded by a privileged COM service. Google Project Zero shows how custom COM marshaling and the Shell Create Object Handler could be used to reach SYSTEM-level code execution.

This week’s security news includes Cisco patches for actively exploited flaws in Cisco Secure Email Gateway (CVE-2026-76461) and Cisco Identity Services Engine (ISE) (CVE-2026-76460), as well as targeted exploitation of an Acronis backup plugin issue (CVE-2026-87886). Researchers also disclosed that Parallels Desktop flaw CVE-2026-90894 can let a local Mac user obtain root access, while Revolut confirmed a breach involving customer records obtained through government-agency impersonation.

Researcher Gal Weizman demonstrated BragJack, a proof-of-concept technique in which an already-installed malicious extension can take over AI browser assistants in Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome. The flaws can enable access to sensitive browser data and cause agents to perform actions for victims; Google fixed CVE-2026-0628 and Microsoft fixed CVE-2026-55945. Users should update their browsers and review extensions with broad site-data permissions.

ShinyHunters breached and defaced the Clop (Cl0p) ransomware group's Tor leak site after claiming to exploit an unauthenticated file upload flaw in Grav CMS. The group says it took server logs, source code, Grav CMS plugins, and onion-service private keys, although only the uploaded file and defacement have been independently confirmed. The incident follows a dispute tied to Clop's Oracle E-Business Suite campaign, which exploited CVE-2025-61882, and ShinyHunters says it intends to extort Clop over the alleged theft.

Hacktron researchers used Claude Opus 5 to combine CVE-2026-32882 in libheif with an OpenAI single sign-on flaw, gaining access to ChatGPT and Codex accounts belonging to OpenAI employees. The controlled research led to a harmless pull request in an internal OpenAI repository; the team reported the issues, and OpenAI fixed its login-side flaw and paid a $6,500 bounty. Discourse instances running unpatched libheif 1.19.7 should rebuild with a fixed release, as image-processing exposure and shared SSO can turn a public-service compromise into broader account access.

SolarWinds has fixed CVE-2026-28326, an 8.8-severity hard-coded static key issue in Access Rights Manager (ARM) that could allow unauthenticated remote code execution. All versions of Access Rights Manager 2026.2 and prior are affected; the company addressed the flaw in ARM 2026.2.1 and has not reported active exploitation. SolarWinds also recently resolved Web Help Desk flaws CVE-2026-28323 and CVE-2026-28299 in WHD 2026.2.1, and released Serv-U fixes for CVE-2026-28302, from CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323.

Attackers are actively exploiting CVE-2026-58138, a pre-authentication remote code execution flaw in Orkes Conductor 3.21.21 before 3.30.2. Crafted workflow definitions can abuse unsandboxed JavaScript or Python evaluation to run operating-system commands as the Conductor process; organizations should upgrade to Conductor 3.30.2 or later and restrict access to workflow API endpoints.

CrowdSec says an attacker used a former employee's GitHub OAuth token to copy about 170 private repositories after the TanStack npm supply-chain attack tracked as CVE-2026-45321. Malicious TanStack npm packages stole developer credentials, and CrowdSec had not yet removed the former employee's GitHub access when the repositories were copied. The archive later published online included private source code, 83 user email addresses, and information on 51 potential investors; CrowdSec says its infrastructure and databases were not accessed and exposed credentials have been rotated.

CISA has added Linux kernel vulnerabilities CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog after evidence of active attacks. The flaws can expose memory, cause denial-of-service conditions, corrupt cryptographic results, or enable local privilege escalation, making timely remediation important; federal agencies have been directed to apply fixes by September 21, 2026.

Working exploit code is public for four Linux kernel local privilege-escalation flaws: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill). The bugs affect IPsec AH6, TUN/TAP, PPPoE, and SCTP code, allowing kernel-memory corruption that can give a local attacker root access; no in-the-wild exploitation has been reported. Update to a kernel release containing all fixes—starting with 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4—or confirm that your distribution has backported them.

This week’s security developments include a nearly 13-year Swiss prison sentence for the developer linked to Lockergoga, MegaCortex, and Nefilim ransomware. Defiant reported active exploitation of a file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin, which can enable PHP webshell uploads; users should update to version 2.0.3.2. SAP customers should urgently patch CVE-2026-44756, an unauthenticated memory-corruption issue affecting Extended Passport processing in products including S/4HANA, NetWeaver, and Business Suite. TP-Link also fixed Tapo C200 flaws CVE-2026-15315 and CVE-2026-15316 in firmware V51.4.6, while Plugin4Shell exposed silent plugin takeover risks for AI coding agents.

Microsoft remediated CVE-2026-85889 (CVSS 10.0) in Azure AI Foundry, where missing authentication could have allowed an unauthenticated remote attacker to elevate privileges. The company also mitigated CVE-2026-85885 in Microsoft 365 Copilot, CVE-2026-85878 in Azure Database for PostgreSQL, and CVE-2026-87701 in Azure Cosmos DB; these cloud issues require no customer action, and CVE-2026-85889 has not been seen exploited. An out-of-band Windows 11, version 26H1 update, KB5129194 (28000.2956), addresses CVE-2026-62721 in Windows User-Mode Power Service (UMPS) and CVE-2026-85921 in Windows Secure Kernel Mode, which could enable local privilege escalation.

Microsoft has remediated 18 vulnerabilities affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, Microsoft 365 Copilot, Copilot, Microsoft 365 Copilot Business Chat, Azure Machine Learning, and Azure Portal. The issues include privilege escalation, information disclosure, and spoofing flaws; Microsoft says none are known to be exploited and the server-side fixes require no customer action. Separately, Windows users must install updates for the privilege escalation flaw CVE-2026-85921, which Microsoft assesses as less likely to be exploited.

Check Point has issued a LivePatch for CVE-2026-91843, a stack-based buffer overflow in the login process of Security Management Server that also affects Log Server. An unauthenticated attacker could exploit the flaw with low complexity to run code remotely with root privileges, and Check Point says all Security Management Server deployments are affected regardless of configuration. Organizations unable to deploy the update should apply the vendor's hardening guidance and restrict trusted client access; no active exploitation has been reported.

Attackers are exploiting CVE-2026-58138, a CVSS 9.8 remote code execution vulnerability in Orkes Conductor that can be triggered without authentication through malicious workflow definitions. The flaw was fixed in Conductor 3.30.2; organizations should update, limit access to workflow API endpoints, and investigate suspicious workflow activity.

Check Point patched CVE-2026-91843 in Security Management Server and Log Server, an unauthenticated remote code execution flaw that could grant root privileges; the company reports no evidence of exploitation and urges immediate updates. Tanium also fixed SQL injection, SSRF, and access-control issues in Tanium Asset and Threat Response, while Kaspersky addressed a Redis-related issue in Kaspersky Security 10 for Linux Mail Server that could cause malfunctions or code execution during file processing.

WordPress 7.1.1 addresses 11 security vulnerabilities and 17 Core bugs, including CVE-2026-93485, an unauthenticated stored XSS flaw in the wpautop() content-formatting function affecting WordPress Core through 7.1. An anonymous visitor could submit a crafted comment that becomes executable script when the comment is published and viewed, potentially affecting any site visitor. WordPress has also backported fixes to supported older branches, but site operators should update to WordPress 7.1.1 or the latest available release.

Check Point released a LivePatch for CVE-2026-91843, a CVSS 9.8 stack overflow that can let unauthenticated attackers execute code as root on Check Point Security Management Server and Check Point Log Servers through Trusted Clients access. The issue affects R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, R81.10 with Jumbo Hotfix Take 190 or below, and all R82.20 builds; older R81, R80.40, R80.30, R80.20, R80.10 and R80 branches are also affected. Check Point reports no known exploitation, but administrators should install the fix, verify its status, and restrict Trusted Clients to known hosts rather than exposing management access to the internet.

This ThreatsDay roundup reports ransomware exploitation of VMware vCenter flaw CVE-2026-59310, while Cisco Talos-linked reporting covers attacks involving Cisco Secure FMC vulnerabilities CVE-2026-20079 and CVE-2026-20316. Palo Alto Networks and Oasis Security also detailed campaigns abusing malware distribution channels and exposed LocalAI deployments, including root-level command execution and credential theft. Oracle released its September 2026 Critical Security Patch Update for more than 800 vulnerabilities, none identified as actively exploited.

Docker has fixed CVE-2026-77179, a macOS flaw in Docker Sandboxes 0.28.0 up to but not including 0.42.0 that could let malicious guest code use a symlink race to access or alter host files under the VM host account. The 0.42.0 release also resolves CVE-2026-79994, affecting versions 0.37.0 through 0.41.9, which could redirect authorized Unix socket connections to sockets outside the workspace. Docker reports no known exploitation; users should update to 0.42.0 or later, or use clone mode and avoid read-write host mounts until they can update.

Attackers exploited a chain in MikroTik RouterOS, dubbed MikroTrick, to take over exposed routers without credentials before fixes were publicly disclosed. CVE-2026-67279 bypasses SSH authentication after rekeying, while CVE-2026-86060 can turn a crafted username into a trusted administrative identity on vulnerable RouterOS 7.x builds. Update to 6.49.21, 7.23.4, 7.24.2, or later, and investigate routers for persistent privileged accounts, scripts, and scheduled tasks because patching alone does not remove an existing compromise.

ISC has released BIND 9 versions 9.21.26 and 9.20.29 to fix 14 vulnerabilities, including seven high-severity flaws that can cause denial-of-service conditions. Remote attack paths affect CVE-2026-80274, CVE-2026-76163, CVE-2026-19666, CVE-2026-81563, CVE-2026-77692, CVE-2026-19667, and CVE-2026-81736; CVE-2026-77692 can crash named through one unauthenticated DoH SIG(0) request. The remaining fixes address risks including cache poisoning, resource exhaustion, packet loss, and injection of attacker-controlled data into zones. ISC has not observed exploitation in the wild and recommends updating deployments promptly.

NLnet Labs released Unbound 1.26.1 to address CVE-2026-81642, a DNSSEC validator heap overflow affecting versions through 1.26.0 that a malicious DNS zone could use to cause denial of service or potentially execute code remotely. The update also fixes CVE-2026-82717, CVE-2026-81634, CVE-2026-77955, CVE-2026-78227, CVE-2026-80225, CVE-2026-82720, CVE-2026-85501, and CVE-2026-77860. Neither CVE-2026-81642 nor CVE-2026-82717 is known to be exploited, but operators should upgrade to Unbound 1.26.1 or apply the available patches.

Cisco has issued fixes for dozens of vulnerabilities in Cisco Secure Firewall Management Center, Cisco Identity Services Engine, and Cisco Nexus Dashboard, including multiple critical-severity issues. Cisco Identity Services Engine patches address CVE-2026-20282, CVE-2026-20283, and CVE-2026-20284, which could enable SQL injection, data modification, or command execution for attackers with administrative access. The FMC updates include CVE-2026-20332, while related flaws CVE-2026-20079 and CVE-2026-20316 have been exploited in the wild; organizations should apply Cisco's updates promptly.

Cisco has confirmed that attackers are exploiting CVE-2026-76460, an authentication bypass in an API of Cisco Identity Services Engine (ISE). The flaw affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), releases 3.0 through 3.5, and can let unauthenticated remote attackers access devices through the web-based management interface. Organizations should review logs across every deployment node and external network and firewall logs, then upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4; Cisco provides no workaround.

Cisco Talos recorded 90 ransomware incidents affecting Japanese organizations from January through July 2026, with The Gentlemen the most frequently observed group and Qilin second. Talos linked The Gentlemen infrastructure to reconnaissance, credential theft, lateral movement, data theft and attempted exploitation of CVE-2025-2479 and CVE-2025-24799, while Qilin scripts showed signs of generative AI assistance for ransomware deployment and backup destruction.

ESET researchers found FamousSparrow deploying its new SparroWocky backdoor against government organizations across Latin America since at least August 2025. The modular Windows implant replaces SparrowDoor and can run commands, steal files, capture screenshots, proxy network traffic, and execute Beacon Object Files while using evasion features to hinder detection.

ISC has released BIND 9.20.29 and 9.21.26 to address 14 vulnerabilities: CVE-2026-77692, CVE-2026-76163, CVE-2026-19667, CVE-2026-19666, CVE-2026-80274, CVE-2026-19662, CVE-2026-81563, CVE-2026-81736, CVE-2026-19668, CVE-2026-75029, CVE-2026-19941, CVE-2026-77119, CVE-2026-19033, and CVE-2026-78301. CVE-2026-77692 allows an unauthenticated party to crash named on BIND 9 servers handling DNS-over-HTTPS with a malformed SIG(0) request, while other issues can crash resolvers, exhaust CPU or memory, or enable DNS data integrity attacks under specific conditions. ISC reports no active exploitation; administrators should update BIND 9, noting that the unsupported 9.18 branch has no fixes for 12 of these issues.

Cisco has patched CVE-2026-76460, a maximum-severity authentication bypass affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which is being exploited in the wild. A crafted request to an affected API can let a remote attacker evade authentication and access the device's web management functions. Organizations should upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4, as Cisco has not provided a workaround.