Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available.

Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root.

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains a critical authentication bypass (CWE-304) in the libpve-access-control package before 8.0.4. An unauthenticated attacker can send a POST request to the access/ticket API login endpoint and supply any value in the tfa-challenge parameter, which causes password verification to be skipped entirely for any existing enabled user that does not have a second factor configured. This grants full access as that account, including the root@pam superuser, effectively compromising the hypervisor and, by extension, the virtual machines and containers it manages. All affected Proxmox VE releases (7.0 through 8.0) are end of life, so systems that have not moved to a supported release remain exposed. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS currently estimates a 1.7% probability of exploitation within 30 days.

Do: Upgrade to a currently supported Proxmox VE release that ships libpve-access-control 8.0.4 or later, since all affected versions (7.0 through 8.0) are end of life and will not receive this fix. Until patched, restrict access to the Proxmox web UI/API (default TCP port 8006) to trusted networks only and review authentication logs for successful logins that occurred without a valid password or second factor. Confirm which accounts lack a configured second factor, because those accounts are the ones fully exposed to this bypass.

CVE-2026-34910 is an improper input validation flaw (CWE-20) in Ubiquiti UniFi OS that allows command injection on affected gateways and network video recorders. A malicious actor with network access to the device can send crafted, unvalidated input that triggers arbitrary command execution, with no privileges or user interaction required (CVSS 3.1 base score 10.0, network vector, scope changed). Successful exploitation grants full control of the device — high confidentiality, integrity, and availability impact — and can serve as a foothold into the attached network. Affected products span the UniFi gateway and recording line: UniFi OS Server, Cloud Gateway Industrial, Dream Machine/Pro/Special Edition/Pro Max, Enterprise Fortress Gateway, Dream Wall, Dream Router and Dream Router 7, UniFi Express 7, and the UniFi Network Video Recorder. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-23, public reporting describes in-the-wild exploitation being used to build a Mirai botnet, and EPSS estimates an 87.5% chance of exploitation within 30 days.

Do: Upgrade all listed UniFi OS devices to the fixed firmware in Ubiquiti's June 2026 security advisory (consult the vendor advisory for exact fixed versions per product), and per CISA BOD 26-04 patch within the required window or discontinue use of affected cloud-reachable assets. Restrict device management interfaces (UniFi Network UI, SSH, API) to trusted networks and audit internet-facing gateways for signs of compromise, including Mirai botnet traffic or unexpected outbound connections.

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update_many, remove, doActionFor, doActionFor_many, and getusers, do not enforce the senaite.core: Access JSON API permission before resolving attacker-selected objects. In src/bika/lims/jsonapi/init.py, set_fields_from_request passes raw request values for RecordsField and RecordField instances to eval() before field mutator write-permission checks execute. An anonymous attacker can discover the bika_setup object identifier through @@uuid, send a value such as RejectionReasons to /@@API/update, and execute arbitrary Python in the Zope worker before a later mutation failure rolls back ZODB changes. The same unsafe evaluation pattern is present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py. Successful exploitation can expose or modify laboratory data, files, and accounts and can disrupt the service.

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.

Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.

Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner.

WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label.

Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Nuclio, an open-source "serverless" framework for real-time event and data processing, ships a dashboard whose earlier fix for unauthenticated OS command injection on the local/Docker platform is incomplete. On the list-all resource path (taken when no specific resource name is provided), the resourceNamespace parameter is still interpolated unquoted into a /bin/sh -c command string, allowing unauthenticated attackers to inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers. A successful injection yields arbitrary command execution inside the dashboard container (CVSS 4.0: 8.7 High, network-exploitable with no privileges or user interaction required). Anyone running a Nuclio dashboard prior to version 1.17.4 on the local/Docker platform is affected, especially if the dashboard is reachable from an untrusted network. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates a 5.1% probability of exploitation within 30 days (92nd percentile).

Do: Upgrade Nuclio to version 1.17.4 or later, which completes the fix by properly quoting the resource namespace on the list-all path. Until patched, ensure the dashboard is not reachable from untrusted networks (restrict via firewall or require authentication in front of it), since exploitation requires no credentials. Operators of unpatched dashboards on the local/Docker platform should review container logs and running processes for signs of unexpected shell command activity.