Cisco ISE Zero-Day Exploited to Bypass Authentication
Cisco released emergency fixes for CVE-2026-76460, a maximum-severity vulnerability in Identity Services Engine and ISE Passive Identity Connector that was exploited as a zero-day. The CVSS 10 flaw allows a remote attacker to bypass authentication through a vulnerable API endpoint and access affected appliances regardless of their configuration.
Source: SecurityWeek

Issabel Framework RCE Actively Exploited Through Hard-Coded JWT Key
Attackers are exploiting CVE-2026-89026, a critical vulnerability in the Issabel PBX Framework caused by a JWT signing key that is identical across installations. An unauthenticated remote attacker can forge valid bearer tokens and execute arbitrary operating system commands through the PBX API.
Source: The Hacker News

Critical ScreenConnect Flaw Now Confirmed Under Active Exploitation
CISA confirmed that attackers are exploiting CVE-2026-84869 in ConnectWise ScreenConnect. The missing-authorization flaw can allow an attacker with basic privileges to transfer or execute files without user interaction, and ConnectWise has patched the issue in ScreenConnect 26.6.5 and later.
Source: BleepingComputer

Google Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched CVE-2026-58704 after observing limited targeted exploitation against Pixel devices. The modem vulnerability can enable a nearby attacker to escalate privileges remotely without user interaction, and CISA subsequently added the flaw to its Known Exploited Vulnerabilities catalog.
Source: SecurityWeek

Attackers Target WSO2 API Manager With Forged Administrator Tokens
Active exploitation attempts are targeting CVE-2026-5430, a critical JWT signature verification weakness in WSO2 API Manager. Attackers can use unsupported signing algorithms to bypass authentication and potentially obtain administrative account access or full account takeover.
Source: The Hacker News

One-Click Sogou RCE Exploited to Deploy GRAYRABBIT Backdoor
CVE-2026-51990 in the widely deployed Sogou Input Method chains weaknesses in a custom protocol handler, webview navigation, and an outdated unsandboxed Chromium engine into a one-click remote code execution path. Gen Threat Labs observed the vulnerability being exploited by UNC3569 to deliver the GRAYRABBIT backdoor.
Source: Gen Threat Labs

Brevo Supply Chain Compromise Injected ClickFix Scripts Into Customer Sites
Brevo confirmed that attackers stole a Cloudflare API key and used it to deploy a malicious Worker that modified content at the CDN edge. The compromise altered Brevo-hosted pages and JavaScript components embedded on customer websites, injecting ClickFix content for roughly five and a half hours and creating a direct software supply chain delivery path for malware.
Source: BleepingComputer

Artifactory Attacks Chain Three Vulnerabilities and Deploy Persistent Backdoors
Wiz observed attackers chaining CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 against JFrog Artifactory to bypass authentication, escalate privileges, and obtain administrative control. Post-exploitation activity included persistent administrator accounts, malicious Groovy plugins for code execution, and Rust-based backdoors.
Source: Wiz

Cyclops Blink Returns on Compromised Cisco Firewall Management Center Devices
Researchers identified a new variant of Cyclops Blink on multiple compromised Cisco Firewall Management Center systems. The modular Linux implant provides persistent remote access and is assessed as likely associated with the Russia-linked IRON VIKING threat group, also known as Sandworm and Seashell Blizzard.
Source: Sophos

Passkey-Themed Social Engineering Leads to Identity and Cloud Compromise
Microsoft is tracking active intrusions that begin with identity-focused social engineering and are followed by attacker-added authentication methods and persistent cloud access. Compromised identities were subsequently used for high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, email collection, and activity consistent with automated data exfiltration.
Source: Microsoft

Red Heron Exploits Gitea to Steal Source Code and Deploy Linux Rootkit
A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004 against internet-facing Gitea servers across multiple countries. The campaign progressed from source-code theft into credential collection, persistence, and lateral movement, while analysis of exposed attacker infrastructure uncovered a previously undocumented Linux implant.
Source: Acronis

Two Critical Events Calendar Chains Expose Hundreds of Thousands of WordPress Sites to RCE
Researchers disclosed two independent unauthenticated attack chains in The Events Calendar WordPress plugin. One chain uses PHP object injection to execute operating system commands, while the second can reset an administrator password and enable complete site takeover through a malicious plugin.
Source: Wordfence

Critical Unbound DNSSEC Flaw Can Lead to Remote Code Execution
All Unbound releases before version 1.26.1 contain CVE-2026-81642, a critical heap overflow in the DNSSEC validator. An attacker controlling a malicious DNS zone can trigger the vulnerability through queries handled by a vulnerable resolver, potentially achieving remote code execution.
Source: The Hacker News

Oracle September Security Update Fixes More Than 800 Vulnerabilities
Oracle’s September Critical Security Patch Update includes 673 new patches addressing more than 800 vulnerabilities across its product portfolio. More than 100 of the newly addressed issues are critical severity, while over 240 can reportedly be exploited remotely without authentication.
Source: SecurityWeek

Gyazo Breach Exposes 23.6 Million Users and Hundreds of Millions of Image Records
Image-sharing service Gyazo disclosed a breach affecting approximately 23.62 million user records, including email addresses and password hashes. The incident also exposed roughly 490 million image metadata records, including identifiers that in some cases could be used to access images without authorization.
Source: The Hacker News