45
60
60
60
60
60
60
50
60
60
60
60
60
60
60
60
60
60
60
US Gov adds surveillance firms Cytrox and Intellexa to Entity List for trafficking in cyber exploits
60
60
60
60
60
60
60
60
60
45
60
60
Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild
Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.
CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.
78
LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials
Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.
Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.
70
Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day
Researcher Chaotic Eclipse released GreenSection, a PoC exploit for an NVIDIA Windows user-mode shared-memory flaw enabling out-of-bounds writes and potential dwm.exe compromise.
Researcher Chaotic Eclipse (aka Nightmare Eclipse) released a PoC named GreenSection for a zero-day in NVIDIA's Windows user-mode components. Multiple NVIDIA components share a global memory section in BaseNamedObjects with full read/write access to all users; although checks prevent misuse, runtime reuse of section data can cause an out-of-bounds write. The unstable PoC crashes applications using Vulkan or OpenGL and could potentially cross user boundaries or compromise the Windows Desktop Window Manager (dwm.exe), though impact was not fully investigated. The researcher recently published similar zero-day PoCs against Kaspersky Endpoint Security, Avast Antivirus, and CrowdStrike Falcon.
50
Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day
Researcher Chaotic Eclipse released GreenSection, a PoC exploiting an unpatched out-of-bounds write in NVIDIA Windows user-mode shared memory.
Security researcher Chaotic Eclipse disclosed an out-of-bounds write in NVIDIA's Windows user-mode components, which share a global memory section (\BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}) with full read/write access to all users. The PoC crashes applications running Vulkan or OpenGL; the researcher says the bug could cross user boundaries or compromise dwm.exe but did not fully assess the impact. No CVE has been assigned and no patch is mentioned. The researcher recently released zero-day PoCs against Kaspersky, Avast, and CrowdStrike Falcon.
52
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
60
60
60
60