Threat briefs

The Event Tickets and Registration plugin for WordPress (v5.27.4 and earlier) contains an authorization flaw in the Stripe OAuth return endpoint, allowing unauthenticated attackers to hijack site payment processing.

The Live Composer plugin for WordPress (<= 2.1.18) contains a PHP object injection vulnerability that allows authenticated contributors to achieve remote code execution if a compatible POP chain exists in the environment.

Knight Office is an Adversary-in-the-Middle (AiTM) phishing kit designed to harvest Microsoft 365 session tokens via sophisticated redirects, enabling MFA bypass and rogue device enrollment.

Exploitation of CVE-2024-1709 in ConnectWise ScreenConnect allows attackers to bypass authentication via the SetupWizard.aspx endpoint, potentially leading to unauthorized administrative access and remote code execution.

Active Directory Rights Management Services (AD RMS) utilizes a non-rotatable Server Licensor Certificate master key that, if compromised, allows for the indefinite offline decryption of all protected corporate data.

Multiple vulnerabilities in Zoho ManageEngine Endpoint Central allow a local attacker to perform privilege escalation, potentially gaining user or administrator rights within the affected environment.

Multiple vulnerabilities in Samsung's Android implementation allow remote or local attackers to achieve arbitrary code execution with root privileges, escalate permissions, and cause denial-of-service.

A remote, unauthenticated attacker can exploit a vulnerability in Adobe Magento Open Source to achieve arbitrary code execution with administrator privileges.

A vulnerability in the libvirt virtualization API allows a remote attacker on an adjacent network to trigger a denial-of-service condition affecting the virtualization host.

Multiple vulnerabilities, including remote code execution and security policy bypass, have been disclosed in strongSwan versions prior to 6.1.0.

Adversaries achieve persistence on macOS by creating or modifying launch agent or daemon plist files and immediately loading them into the launchd subsystem using the launchctl utility.

Adversaries are utilizing blockchain RPC endpoints as a resilient, censorship-resistant covert channel to retrieve configuration data and commands for macOS malware.

An unauthenticated remote attacker can exploit a flaw in FreeIPA's self-managed OTP token access control instructions to create arbitrary Kerberos principals and grant them administrator group membership.

An improper authorization vulnerability in the EDD Product Catalog Feed plugin allows authenticated subscribers to delete arbitrary site options, leading to a denial of service.

A critical unauthenticated remote code execution vulnerability (CVE-2026-86218) in N-able N-central is under active exploitation, allowing attackers to gain full system control.

Roundup of Siemens security advisories published in September 2026.

Threat actors are performing password spraying against AWS root accounts by distributing authentication attempts across multiple AWS accounts from a single source IP to evade lockout mechanisms.

Threat actors disable AWS Security Hub to suppress centralized security findings and compliance monitoring, facilitating stealthy data exfiltration or ransomware deployment.

Threat actors with compromised AWS credentials may enable account-level email sending in Amazon SES to restore suspended infrastructure for mass phishing campaigns.

A stack-based buffer overflow vulnerability in the udhcpcd component of D-Link DIR-822A routers allows unauthenticated remote attackers to execute arbitrary code.

Roundup of SAP security advisories published in September 2026.

Ghost CMS versions prior to 5.59.1 are vulnerable to an authenticated arbitrary file read, exploitable through malicious symbolic link uploads via the administrative API.

Handlebars.js versions 4.0.0 through 4.7.8 are vulnerable to remote code execution via a crafted AST that injects arbitrary JavaScript through the `Handlebars.compile()` function.

An integer overflow in the Linux kernel eBPF verifier allows unprivileged local users to perform out-of-bounds kernel memory access, leading to privilege escalation.

A prototype pollution vulnerability, tracked as CVE-2026-3030, allows attackers to inject malicious properties into the global Object.prototype via insecure deep merge functions, potentially leading to privilege escalation.

CVE-2026-7777 is a use-after-free vulnerability in a Rust-based web server that occurs when raw pointers are accessed after a Mutex lock is dropped.

An authentication bypass vulnerability in 389 Directory Server allows unauthenticated LDAP clients to bypass access control rules by exploiting an error in the SELFDN ACI bind-rule evaluator.

Authenticated remote attackers can exploit vulnerabilities in SmarterTools SmarterMail to bypass path restrictions, access unauthorized files, and compromise administrative API functions or cached credentials.

CVE-2026-7861 is a critical deserialization of untrusted data vulnerability in Next4Biz CSM that permits unauthenticated remote code execution via malicious object injection.

A command injection vulnerability in the 389 Directory Server Cockpit console allows authenticated users with entry-creation privileges to achieve root-level command execution via crafted LDAP distinguished names.