Security news, decoded.

Attackers are actively exploiting two zero-day vulnerabilities in specific SonicWall SMA 1000 models, allowing for unauthenticated remote code execution when the flaws are chained together. The issues include a critical pre-authentication server-side request forgery vulnerability (CVE-2026-83548, CVSS 10.0) and a post-authentication OS command injection flaw (CVE-2026-83549, CVSS 7.8). SonicWall advises customers running versions 12.4.3-03453 or 12.5.0-02835 on models 6210, 7210, and 8200v to immediately update to firmware versions 12.4.3-03526 or 12.5.0-02952. Organizations should also monitor for indicators of compromise and consider reimaging or redeploying appliances if breaches are detected.

ServMask has released version 7.110 of the All-in-One WP Migration and Backup plugin to fix a high-severity second-order SQL injection vulnerability identified as CVE-2026-19949. Discovered by researcher Jack Taylor and reported via Wordfence, this flaw affects versions through 7.109 and enables unauthenticated attackers to inject malicious code through WordPress trackbacks. The payload executes only when an administrator performs a backup or restore operation, potentially exposing secret keys and allowing full site takeover via a compromised archive. With over five million active installations, approximately 35% of users have already updated, leaving roughly 3.25 million sites still vulnerable.

Attackers are actively exploiting a critical authentication bypass vulnerability, tracked as CVE-2026-82329, in self-managed JFrog Artifactory instances. This flaw exists within the default configuration and permits unauthenticated network attackers to forge administrative tokens, granting them full control over the repository manager. The compromise allows adversaries to tamper with trusted software artifacts, potentially injecting malicious code into downstream build and deployment systems that automatically pull packages from Artifactory. Because issued tokens remain valid even after binary upgrades, organizations must revoke existing credentials alongside applying patches. JFrog resolved the issue on August 28 in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.

Manifold Security has published details on a vulnerability class dubbed Git Spawn, affecting command-line AI coding agents from Anthropic, OpenAI, Cursor, and others. By exploiting the core.fsmonitor Git configuration, attackers can embed commands in a repository that execute as the user without sandboxing or approval prompts when the agent initializes. While patches have been released for goose, Claude Code, and Cursor, Manifold confirms that Hermes Agent, Qwen Code, and Grok Build remain vulnerable as of September 1. Affected CVEs include CVE-2026-19592 for Codex and CVE-2026-72718 for goose.

A working exploit for CVE-2026-62911 has appeared online, leaving nearly 22,000 instances of Microsoft Exchange Server vulnerable to a critical authentication bypass. This flaw allows attackers to elevate privileges over the network, with the United States and Germany reporting the highest concentration of unpatched systems. Microsoft issued a fix on August 11, 2026, following disclosure by Orange Tsai in collaboration with Trend Micro’s Zero Day Initiative.

Threat actors are actively exploiting an unauthenticated SQL injection vulnerability in Sangoma Switchvox, identified as CVE-2026-9586. The flaw affects the SMB Edition 8.3 and allows attackers to execute arbitrary code against the underlying PostgreSQL database via a specific HTTP POST request. Honeypot data indicates that attacks began on August 30, with intruders deploying reverse shells and enumerating system processes. Organizations should immediately verify whether they are running version 8.4.0.2, the patch released by Sangoma on July 14, 2026, which resolves this issue. If updating is not possible immediately, administrators should restrict network access to the affected "/pa" endpoint to mitigate risk.

Rockwell Automation has issued patches and workarounds for over a dozen vulnerabilities spanning several of its industrial automation platforms. The updates address high-severity denial-of-service issues in RSLinx Classic and ControlLogix, as well as remote code execution flaws in FactoryTalk Historian and arbitrary code execution risks in the ControlFLASH firmware management utility. Additional fixes resolve cross-site scripting attacks in ArmorStart Distributed Motor Controllers and privilege escalation vulnerabilities in both FactoryTalk Activation Manager and the Redundancy Module Configuration Tool. While an initial advisory flagged CVE-2026-9637 as exploited, CISA and subsequent documentation confirm there is no evidence of active exploitation.

A working exploit has been made available for CVE-2026-84115, a critical authentication bypass vulnerability affecting the Cleo Harmony file transfer application. The defect lies within the JWT refresh token logic, specifically allowing attackers to manipulate bearer tokens in HTTP headers to escalate privileges and bypass access controls. This poses a severe risk as organizations can suffer from persistent access or lateral movement across integrated systems. Users are urged to update to Cleo Harmony version 5.8.1.11 immediately, particularly because the product is a frequent target for ransomware groups such as Cl0p.

SonicWall has released patches for two zero-day vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series, confirming active exploitation in the wild where attackers may be chaining the flaws together. The issues include a critical pre-authentication SSRF vulnerability, CVE-2026-83548 (CVSS score: 10.0), and a post-authentication command injection flaw, CVE-2026-83549 (CVSS score: 7.8), both of which can lead to unauthorized access or remote code execution. Users running versions prior to 12.4.3-03526 or 12.5.0-02952 on SMA 6210, 7210, and 8200v models are urged to upgrade immediately and check for indicators of compromise.

SonicWall has verified that attackers are actively leveraging two newly disclosed flaws, identified as CVE-2026-83548 and CVE-2026-83549, against its SMA 1000 line of secure remote access appliances. The first issue is a pre-authentication server-side request forgery vulnerability, while the second allows administrators to execute remote code through OS command injection in the management console. Affected hardware includes physical models 6210 and 7210, as well as the virtual 8200v instance, whereas SMA 100 devices and other SonicWall firewalls remain unaffected. Given the critical nature of the risk, the vendor advises organizations to deploy the available emergency hotfix without delay and to perform a thorough compromise assessment.

OSGeo has released updates for GeoNetwork, addressing two vulnerabilities that allow attackers to achieve remote code execution without authentication. The exploit chain combines CVE-2026-63219, a missing authorization check on the formatter upload endpoint, with CVE-2026-58400, an unsafe configuration of the Saxon XSLT processor. These flaws affect versions prior to 4.4.12 and 4.2.17, which were fixed in July 2026. Because GeoNetwork underpins many government geoportals, including the European INSPIRE portal, this exposure is significant. Security researchers identified over 120 exposed instances worldwide, with the majority belonging to public sector organizations. Administrators should upgrade immediately or block write requests to the formatter endpoint as a temporary mitigation.

Google and Mozilla have released updated versions of their respective browsers to address numerous security vulnerabilities. The new Chrome 152 update includes fixes for 26 bugs, notably critical use-after-free flaws identified as CVE-2026-84353 and CVE-2026-84352, alongside nine high-severity defects. Concurrently, Firefox 155 was deployed to resolve 29 security issues, including 13 high-severity problems involving sandbox escapes and memory corruption within various core components. These updates are available for Windows, macOS, and Linux users, with corresponding patches also released for Thunderbird and Firefox ESR branches. Neither vendor has indicated that these specific vulnerabilities are currently being exploited in the wild.

Forescout Research utilized Anthropic's Claude to adapt a pre-authentication remote code execution exploit from one Siemens-made WAGO Programmable Logic Controller model to another, successfully executing shellcode on the target hardware. The attack leverages CVE-2021-31886, a critical stack-based buffer overflow in the Nucleus RTOS FTP server that allows unauthenticated attackers to inject malicious code via TCP port 21. As no software update is currently available for the affected WAGO devices, CERT@VDE recommends disabling the FTP service, implementing network segmentation, and closely monitoring traffic for suspicious activity.

Attackers are actively exploiting a critical unauthenticated SQL injection vulnerability, tracked as CVE-2026-9586, in Sangoma Switchvox SMB Edition 8.3 (104997). This flaw, which carries a CVSS score of 9.3, permits remote code execution as the PostgreSQL superuser without requiring any credentials by manipulating data through the /pa endpoint. Sangoma released a patch for this issue in version 8.4.0.2 on July 14, 2026, but recent reports indicate that exploitation attempts began appearing in the wild starting August 30, 2026. Security researchers have observed attackers deploying reverse shells and attempting to exfiltrate sensitive keys from roughly 4,000 exposed instances, many of which remain vulnerable.

SonicWall has issued an urgent advisory stating that threat actors are actively exploiting a pair of zero-day vulnerabilities in its SMA1000 secure remote access appliances. The attack campaign chains a maximum-severity command injection flaw (CVE-2026-83548), caused by a server-side request forgery weakness, with a second command injection vulnerability (CVE-2026-83549) accessible to administrators with valid credentials. This combination allows attackers to achieve remote code execution on affected devices. The vulnerabilities impact SMA1000 models 6210, 7210, and 8200v, while SSL-VPN services on other SonicWall firewalls and the SMA 100 Series remain unaffected. SonicWall strongly urges customers to apply the available hotfix release immediately to mitigate these risks.

SonicWall has identified active exploitation of two zero-day vulnerabilities affecting its SMA1000 secure remote access gateways. The critical flaw, CVE-2026-83548, allows unauthenticated attackers to execute unauthorized operations via a server-side request forgery vulnerability in the Appliance Work Place interface. This is often paired with CVE-2026-83549, an authenticated OS command injection issue that can lead to full remote code execution within the management console. SMA1000 models 6210, 7210, and 8200v are susceptible to these attacks. Administrators should apply hotfixes 12.4.3-03526 or 12.5.0-02952 immediately to mitigate the risk.

Hunt.io researchers uncovered an active data exfiltration campaign targeting the Philippines Nuclear Regulatory Authority and a maritime contractor supporting the Philippine Navy, revealing that long-unpatched systems remained exploitable despite available fixes. The intrusion leveraged CVE-2023-49105 in ownCloud and CVE-2024-2800 in the LiteSpeed Cache WordPress plugin, both of which have had remediations available for over two years. The attackers harvested approximately 9 GB of sensitive material, including reactor core component databases, fuel inventories, radiation safety protocols, and personnel records such as passports and financial disclosures. This incident underscores the persistent risk posed by internet-facing collaboration tools that lack timely patching and hardened configurations, particularly in regions facing heightened geopolitical cyber threats.