Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.
74
Vendor
Shadowserver Foundation
- Mentions · 7d0
- Mentions · 30d0
- All mentions11
- First seenAug 26, 2026
- Last mentionedSep 16, 2026
Timeline
11 articles · newest firstHackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
76
Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication
CERT Polska confirms attackers exploit chained MikroTik RouterOS SSH flaws to hijack devices without authentication; patches released in four RouterOS versions.
82
International Operation Disrupts Sality P2P Botnet
US-led international operation with Europol, CrowdStrike, and Shadowserver sinkholed the 20-year-old Sality P2P botnet, once exceeding one million infected machines.
62
Dogged Russia-based botnet dismantled after 23-year run
Law enforcement, CrowdStrike and Shadowserver dismantled the 23-year-old Sality P2P botnet that infected more than 11 million devices.
72
Sality, one of the longest
US and European authorities, with CrowdStrike and Shadowserver, disrupted the 20-year-old Sality peer-to-peer botnet, severing 15,000+ infected machines from operators.
52
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.
62
Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.
72
Global sinkhole operation ends Sality botnet’s 23-year run
Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.
65
ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.
55
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
75
Related CVEs
by mentions- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
- CVE-2026-860606%9.2Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
- CVE-2026-672772%8.8Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest
- CVE-2025-6637620%6.1Stored Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI
- CVE-2026-4289771%6.1Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear
- CVE-2026-890263%9.3Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework
- CVE-2026-672769%9.2SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
- CVE-2026-62911<1%8.0Capture-Replay Authentication Bypass in Microsoft Exchange Server
Appears with
- Shadowserver Foundationorganization · 5
- Salitymalware · 5
- CrowdStrikevendor · 5
- Salityproduct · 3
- EggJaggermalware · 3
- EggJaggerproduct · 2
- CrowdStrikeorganization · 2
- US Department of Justiceorganization · 2
- Europolorganization · 2
- CERT Polskaorganization · 2
- U.S. Department of Justiceorganization · 2
- F5 BIG-IP APMproduct · 1
- Trend Microvendor · 1
- Asteriskproduct · 1
- Cisco Talosvendor · 1
- Sophosorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.