Threat briefs

The PPWP WordPress plugin contains a PHP Object Injection vulnerability in the post_protection_roles parameter, allowing authenticated attackers to achieve remote code execution if a compatible POP chain exists in the environment.

A critical command injection vulnerability (CVE-2026-75094) in the COMFAST CF-N1-S CGI interface allows remote, authenticated attackers to execute arbitrary OS commands via the 'ssid' parameter.

An authenticated OS command injection vulnerability, CVE-2026-75616, in TP-Link Archer C20 v6 routers allows an administrator to achieve root-level code execution via the BPA WAN configuration interface.

CVE-2026-13736 allows unauthenticated attackers to scrape sensitive member PII from the NewPath WildApricotPress Member Directory WordPress plugin via an insecure REST API endpoint.

Netty's netty-handler library fails to perform TLS hostname verification when using the OpenSSL provider on Java 25+ systems, enabling potential man-in-the-middle attacks.

The WS Form LITE plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via unsanitized form submission meta values, potentially leading to RCE or data exfiltration if combined with a secondary POP chain.

NachoMDM is a vulnerability within the Windows Mobile Device Management (MDM) enrollment process that allows an attacker to achieve UAC bypass and execute arbitrary code with SYSTEM privileges.

Hashcat is vulnerable to argument injection when parsing restore files, potentially leading to arbitrary code execution if a user restores a malicious session file.

NLTK versions prior to 3.9.3 fail to verify package integrity after download, allowing remote attackers to perform MitM or DNS poisoning attacks to inject and execute arbitrary code.

The Advanced Product Fields for WooCommerce plugin for WordPress is vulnerable to improper input validation, allowing unauthenticated users to bypass mandatory paid add-ons during checkout.

WWBN AVideo versions through commit 9c39d8c8 contain a CSRF vulnerability in the releaseVideoNow.json.php endpoint that allows unauthenticated attackers to force administrative users to publish embargoed videos.

The better-npm-audit package is vulnerable to arbitrary command injection via improper sanitization of the --registry command-line argument when passed to a shell execution context.

An unauthenticated SSRF vulnerability in the Mailgun for WordPress plugin (<= 2.2.0) allows attackers to perform unauthorized API requests and potentially intercept password reset emails, leading to account takeover.

Microsoft's August 2026 security release addresses 415 vulnerabilities, including a zero-day (CVE-2026-68820) exploited in the wild that enables local privilege escalation in the Windows Ancillary Function Driver for WinSock.

Zbtlink router firmware ships with the ENDLESSDOORS remote-control implant, which runs as root, masquerades as a kernel process, and enables unauthenticated remote command execution.

J2Commerce versions 4.1.5 and earlier are vulnerable to stored XSS via guest checkout, allowing unauthenticated attackers to execute malicious JavaScript in the administrator's browser upon order review.

An unauthenticated or low-privilege authenticated user can leverage a missing capability check in the wpematico_import_settings function to modify site options, enabling unauthorized privilege escalation.

The Defuddle library contains an Improper Neutralization of Input vulnerability leading to Cross-Site Scripting (XSS) in applications that render unescaped site extraction output.

The Keystone @keystone-6/core package is vulnerable to a GraphQL input validation flaw, CVE-2026-63421, where negative values in the 'take' argument bypass configured result limits.

Atlantis versions 0.19.8 through 0.44.9 are vulnerable to path traversal (CVE-2026-64679) allowing unauthorized directory creation or deletion outside the intended workspace root.

An unauthenticated remote attacker can cause a denial-of-service via memory exhaustion by supplying a large integer index in a 'deepObject' style query parameter.

The YOURLS URL shortener is vulnerable to stored cross-site scripting (XSS) via the Referer header, allowing unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser context.

The hydra.utils.instantiate() function in hydra-core versions 1.3.3 and below is vulnerable to arbitrary code execution when processing untrusted configuration input, allowing attackers to hijack object instantiation.

Xinference is vulnerable to remote code execution due to the use of Python's unsafe eval() function to parse tool-call outputs generated by LLMs, allowing unauthenticated attackers to execute arbitrary code via prompt injection.

The JSONata library contains a critical vulnerability (CVE-2026-77415) allowing unauthenticated attackers to achieve arbitrary code execution via maliciously crafted JSONata expressions.

This report catalogs domain infrastructure identified in ongoing malware delivery and command-and-control operations linked to Chinese-based threat actors, facilitating improved network-level detection and defensive blocking.

Fourteen trojanized npm packages masquerading as utility libraries deliver the RedC2 4.0 'RedShell' Linux beacon, which features AI-assisted command execution and cross-platform post-exploitation capabilities.

Unix-like Artifacts Collector (UAC) versions prior to 3.3.0 are vulnerable to command injection via the _command_collector function, allowing arbitrary command execution through malicious filenames or artifact definitions.

A remote code execution vulnerability exists in NoMachine that allows an authenticated attacker to execute arbitrary code on the host system.

Synacor Zimbra Collaboration versions prior to 10.1.20 are vulnerable to multiple flaws, including actively exploited RCE (CVE-2026-73570), SSRF, and XSS, posing a high risk of unauthorized system access.