Threat briefs

Adversaries gain persistence on Linux systems by creating or modifying initialization scripts in /etc/init.d/ or /etc/init/, allowing for malicious code execution with root privileges during system boot.

Detection of polyglot file creation by Linux web server processes, where file headers conflict with extensions, indicating potential web shell implantation or upload-validation bypass.

Detection of web server processes creating high-entropy files with web-executable extensions, a behavior indicative of uploading obfuscated or packed web shells for persistence.

Attackers are observed using double-extension filenames (e.g., shell.php.jpg) to bypass file upload filters and achieve remote command execution or persistence on compromised Linux web servers.

A Universal Cross-Site Scripting (UXSS) vulnerability, CVE-2026-78997, allows attackers to bypass the Same-Origin Policy in UC Browser for Android by exploiting a flaw in the ucapi login callback mechanism.

The Kirki plugin for WordPress version 6.2.0 and below is susceptible to unauthenticated Stored Cross-Site Scripting (XSS) via the 'comment' parameter, potentially leading to unauthorized script execution in administrative or user sessions.

An improperly exported MiracastService component on Android TV devices using MediaTek chipsets allows local attackers to manipulate Wi-Fi Direct states and cause denial of service via a confused deputy attack.

WeenyGenius by Howyar Technologies contains a missing authentication vulnerability allowing unauthenticated network-adjacent attackers to spoof teacher or student roles and achieve remote control of student workstations.

The Kingdom Communication Associated Smart Video Intercom System is vulnerable to credential-based attacks due to the absence of rate limiting or account lockout mechanisms on the authentication interface.

UNC3569 exploited a command-line argument injection flaw in Sogou Input Method to trigger an insecure Chromium component and execute the GRAYRABBIT backdoor.

A configuration reference vulnerability in the multicluster-observability-addon allows a managed cluster identity to bypass namespace restrictions and exfiltrate sensitive hub-level secrets.

Attackers are actively exploiting a chain of three critical vulnerabilities (CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329) in JFrog Artifactory to bypass authentication and achieve full administrative control.

The Simple Ajax Chat plugin for WordPress contains a stored cross-site scripting vulnerability in versions <= 20260811, allowing unauthenticated attackers to inject malicious scripts due to exposed nonces and insufficient input sanitization.

The Vigilant security plugin for WordPress version 2.10.2 and earlier is vulnerable to Stored Cross-Site Scripting via the User-Agent header, allowing unauthenticated attackers to execute arbitrary scripts in the dashboard.

The UsersWP plugin for WordPress versions up to 1.2.70 allows authenticated attackers to delete arbitrary files on the web server via a path traversal vulnerability in the upload_file_remove() AJAX handler.

An unauthenticated stored XSS vulnerability in WP Photo Album Plus versions 9.2.08.003 and earlier allows attackers to inject malicious scripts via the HTTP_X_FORWARDED_FOR header, which is logged without sanitization.

The Unlimited Elements For Elementor WordPress plugin contains an unauthenticated SQL injection vulnerability via the addontype parameter, allowing attackers to perform unauthorized database extraction.

The Sticky Chat Widget plugin for WordPress (<= 1.4.2) is vulnerable to unauthenticated SQL injection via the 'scw_save_form_data' AJAX action, allowing potential exfiltration of sensitive database information.

The MIPL Grouped Checkout Fields plugin for WordPress is vulnerable to unauthenticated arbitrary file uploads via the mipl_wc_upload_file function, potentially resulting in remote code execution.

An arbitrary file upload vulnerability in the Drag and Drop File Upload for Elementor Forms WordPress plugin allows unauthenticated attackers to execute arbitrary code via MIME type validation bypass.

The AcyMailing WordPress plugin is vulnerable to unauthenticated directory traversal, allowing attackers to read arbitrary files on the server when the Embed images feature is enabled.

A critical unauthenticated remote code execution vulnerability in the SAP Extended Passport (EPP) kernel component allows attackers to execute arbitrary system commands via RFC or HTTP communication layers.

An authenticated SQL injection vulnerability in Pimcore's CustomReportsBundle allows users with specific permissions to execute arbitrary database commands by bypassing a weak keyword blacklist.

An insecure sandbox configuration in the Open WebUI terminal port preview feature allows authenticated users to execute arbitrary JavaScript in the application's origin, leading to session token theft and account takeover.

The mistralrs-server-core component allows unauthenticated attackers to perform SSRF and enumerate local files via unvalidated image_url and audio_url message parameters.

The mistral.rs /v1/chat/completions endpoint suffers from unbounded resource consumption vulnerabilities, allowing unauthenticated remote attackers to trigger OOM kills, disk exhaustion, or CPU saturation.

The @argos-ci/core package is vulnerable to OS command injection when processing unvalidated branch or reference names in environments where hasRemoteContentAccess is disabled, allowing arbitrary code execution on CI runners.

The @jhb.software/payload-alt-text-plugin v0.7.0 fails to restrict Payload Local API calls, allowing authenticated users to bypass collection-level access controls to read and modify document data.

A critical authentication bypass vulnerability in rclone's S3 serving mode allows unauthenticated attackers to spoof identity via forged SigV4 signatures when '--auth-proxy' is used without '--auth-key'.

Traefik fails to isolate connection-bound NTLM and Negotiate authentication on HTTP/3 routes, allowing unrelated clients to inherit victim-authenticated backend connections.