All news with #vulnerability disclosure tag

⚠️ cPanel warned on September 14 of a critical vulnerability in LiteSpeed Web Server Enterprise affecting versions before 6.3.7 that could allow a low-privilege hosting account to escalate to root on shared servers. Administrators are urged to install 6.3.7, released by LiteSpeed on September 11, using the provided manual update command. The advisory notes the flaw can bypass account isolation controls such as CageFS, but neither vendor has published technical details, a CVE, or evidence of exploitation.

🛡️ Security researchers at ExPatch disclosed a Telegram Desktop flaw that let bot messages embed hidden JavaScript into HTML chat exports. The script executed when an exported HTML file was opened in a browser, allowing exfiltration or page modification, and persisted in previously exported files even after Telegram shipped a fix. Telegram patched the export escaping in July; users should update and re-export or treat old HTML exports as untrusted.

🔒 ConnectWise issued an update for ScreenConnect five days after warning customers that active remote sessions could be used to transfer and execute files without authorization. Administrators were advised on Sept. 3 to remove the TransferFiles permission from any users with open sessions. The vulnerability, tracked as CVE-2026-84869, is fixed in ScreenConnect client version 26.6.5 and later. The update follows prior security incidents, including a 2025 nation-state attack and earlier 2024 exploitation reports.

🚨 GitLab has released urgent updates to address a maximum-severity path traversal vulnerability (CVE-2026-85706) discovered in the repository commits API and reported via HackerOne. The flaw allows unauthenticated attackers, under certain conditions, to read arbitrary files from vulnerable servers, potentially exposing credentials and secrets. GitLab patched this and a separate critical insecure deserialization bug (CVE-2026-87719) and strongly urges self-managed instances to upgrade to the fixed CE/EE releases immediately.

📢 This week's ThreatsDay Bulletin highlights a string of pragmatic security failures: malicious browser extensions exfiltrate crypto data, AI agents automate intrusions across multiple countries, and Google patches 200 Android flaws including a critical Wi‑Fi RCE. Other notable stories cover shadow AI risks, fake M&A wire fraud, sprawling fake-shop domains, exposed Plex servers, and a Singpass account scheme tied to over 170 victims.

🔒 MikroTik issued RouterOS patches addressing six vulnerabilities, including an SSH public-key validation flaw and an authentication escalation bug that can be chained to fully compromise devices. Researchers from CERT Polska reported active exploitation, dubbed MikroTrick, and the vendor released updates across 7.x and 6.x branches while urging administrators to avoid exposing SSH to the internet. The company added a "Flagged" state to indicate possible compromise, and users are advised to isolate, reset, and rotate credentials if flagged; temporary mitigations include blocking SSH, WWW/WWW-SSL, and bandwidth-test services from untrusted networks.

🛡️ Microsoft released a record 974 CVE fixes in its September 2026 Patch Tuesday, far surpassing the previous monthly high of 570. The update affects a broad range of products, with Windows accounting for 723 CVEs and Office 111. Microsoft highlighted two actively exploited zero-days and the bundle includes 119 critical vulnerabilities, prompting calls for a risk-based approach to prioritization.

🛡️ cPanel has patched an SQL injection flaw, tracked as CVE-2026-67401, that allows an authenticated hosting account with mail-related privileges to create files via EmailTrack and escalate to root. The advisory, published September 8, affects every supported cPanel & WHM release line and lists fixed builds for 11.110, 11.134, 11.136, 11.138 and WP Squared. cPanel provides update instructions but offers no interim mitigations, exploit details, or guidance for post-compromise verification.

🛡️ A researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash. The bug is described as a patch bypass for CVE-2026-69414 (ShieldBreak), which the researcher reported last month. The PoC shows an arbitrary file read as SYSTEM on up-to-date Windows installations, with all supported desktop versions affected. Microsoft recently updated the Malware Protection Engine to address CVE-2026-69414 and urges automatic updates for protection.

🔍 Check Point Research discovered a covert channel that allowed separate ChatGPT accounts to exchange tasks through an internal JFrog Artifactory service. The flaw let an attacker’s session inject instructions that made a victim’s assistant perform actions (e.g., read Gmail) and return results to the attacker while the victim saw a normal reply. OpenAI decommissioned the implicated Artifactory instance after disclosure. The finding highlights risks when AI assistants hold credentials and access connected apps.

🔒 Security researcher TantoSec published a proof-of-concept that chains an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution against applications in a specific, non-default configuration. Progress shipped a patch in July (2026.2.708) and published CVEs, and there are no confirmed in-the-wild exploit reports as of September 7. The chain targets RadAsyncUpload versions through 2026.2.519 and relies on an explicit custom encryption key and a server-side handler that reads upload results.

🔐 ConnectWise has disclosed a new vulnerability in ScreenConnect Remote Access affecting both cloud and on-premises deployments and plans to release a patch later this week. The company provided immediate mitigation steps requiring administrators to remove the TransferFiles (or TransferFilesInSession) permission from session groups via Administration > Security > Roles. Shadowserver currently tracks nearly 6,000 public ScreenConnect instances, and the vendor cautions that these flaws are often targeted by financially motivated and state-backed threat actors.

🔒 N-able released an emergency hotfix addressing a maximum-severity remote code execution flaw in its N-central RMM platform. Tracked as CVE-2026-86218, the vulnerability allows unauthenticated attackers to execute code on internet-exposed instances. N-able issued N-central 2026.3 Hotfix 4 and urged immediate on-premises upgrades, while Shadowserver reports nearly 1,500 exposed servers. Security firms flagged related high-severity bugs and evidence suggesting active exploitation cannot be ruled out.

🛡️ Wordfence reports that threat actors have been actively exploiting critical vulnerabilities in the WordPress plugins Super Forms and Elementor Pro, enabling unauthenticated file uploads that lead to remote code execution. Both flaws permit attackers to upload PHP web shells, which can be used to create admin accounts, exfiltrate data, or seize control of sites. Over 440,000 exploit attempts have been blocked, and site owners are urged to apply patches and scan for compromises.

🔒 Plex has released updates for Plex Media Server (1.43.3) and Plex Desktop (1.115.0) to address multiple security flaws and is urging users to upgrade immediately. The vendor has requested CVE identifiers for the patched issues but did not provide technical specifics. Plex recommends manual installation for NAS users if package managers have not yet received the updated builds. This advisory follows prior high-severity fixes and historical exploitation events involving Plex servers.

🔒 Google released security updates fixing 12 Chrome vulnerabilities, including an actively exploited high-severity V8 type confusion bug (CVE-2026-85046) with a CVSS of 8.8. Researcher Salvatore Gulizia (Serotav) reported the flaw on August 4, 2026, and received a $1,000 bounty. Google confirmed exploits exist in the wild and urges users to update Chrome to 152.0.7977.82/.83 on supported platforms. Other Chromium-based browser users should apply vendor fixes when available.

🔒 Cisco released patches for a critical Nexus 9000 vulnerability (CVE-2026-20212) that allows unauthenticated remote root code execution via TCP ports 43210 and 43211. The advisory affects 10 Silicon One-based Nexus 9000 PIDs and lists mitigations including iACLs and a Live Protect shield while customers use the Software Checker to pick fixed releases. Cisco also published an IOS XR hardening release bundling seven umbrella CVEs, two rated 9.8, and provided SMUs and upgrade guidance for affected XR trains.

🔒 Plex has urged users to immediately update Plex Media Server and the Plex Desktop client to patch multiple security vulnerabilities affecting Server v1.43.2 and earlier. The company released Plex Media Server 1.43.3 (May 19) and Plex Desktop 1.115.0 (Aug 13) and has emailed affected customers asking them to upgrade. CVE identifiers have been requested and Plex warns users to update before attackers reverse-engineer the fixes. NAS package managers may not yet carry the updated server build, so manual installation could be required.

🛡️ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. The list includes critical issues in SonicWall SMA, Sangoma Switchvox, JFrog Artifactory, Kludex Starlette, Kestra OSS, and Berri LiteLLM, ranging from SSRF and SQL injection to authentication bypasses and command injection. Several of the flaws have been observed in real-world attacks that deployed reverse shells, minted admin tokens, and delivered cryptocurrency miners. Federal agencies are being directed to prioritize patches under BOD 26-04 with staggered remediation deadlines in September 2026.

🛡️ A critical authentication bypass (CVE-2026-82329) in self-managed JFrog Artifactory is being actively exploited to mint admin tokens. The flaw exists in default configurations and allows unauthenticated attackers with network access to obtain administrative privileges. JFrog released fixes on August 28 for multiple Artifactory 7.x versions and says cloud instances were already protected.