42
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
Drupal issues moderately critical advisory for XSS in bundled CKEditor affecting content editors; fixed versions released, exploitation theoretical.
Drupal published SA-CORE-2026-013, rated moderately critical (13/25), covering an XSS vulnerability in the CKEditor library used for WYSIWYG editing. An attacker able to create or edit content, even without direct CKEditor access, could exploit it to target users with WYSIWYG permissions. Affected versions include Drupal core 10.5.x, 11.0.x and 11.4.x below 11.4.7, and updated releases are available. Exploitation is rated theoretical.
32
60
CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production
CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.
Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.
62
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
NSA, CISA, and FBI warn DeepSeek, Alibaba, and other Chinese AI firms ran industrial-scale distillation of U.S. frontier models, threatening U.S. AI leadership.
A joint NSA, CISA, and FBI Cybersecurity Advisory (AA26-251A) says China-based firms DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from U.S. frontier models including Claude, GPT, Gemini, and Grok, likely with Chinese government knowledge. Campaigns running since at least late 2024 used native APIs, cloud providers, third-party aggregators, gray-market proxy "transfer stations", and shared premium subscriptions to bypass geographic restrictions, evade safeguards, and violate providers' terms of use. The agencies recommend detecting anomalous prompts, accounts, and usage patterns; subtly altering responses to suspected distillers; and cross-organization intelligence sharing. They also call DeepSeek's publicly cited $5.6M training cost misleading because it excludes data acquired through distillation.
76
55
30
Chinese AI firms are siphoning capabilities from American models, CISA warns
CISA, NSA and FBI warn Chinese AI firms including DeepSeek and Moonshot AI extracted billions of tokens from US frontier models via distillation campaigns.
A joint CISA, NSA and FBI advisory says China-based firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have run industrial-scale knowledge distillation campaigns against US frontier models such as Claude, GPT, Gemini and Grok since at least late 2024, likely with Chinese government knowledge. The campaigns used gray-market API proxies called transfer stations, premium account pools and traffic routing to bypass restrictions, evade safeguards and exfiltrate billions of tokens used to train models like DeepSeek R1/V3 and Kimi. The agencies challenge DeepSeek's reported $5.6 million training cost and recommend identity verification, usage monitoring, response variation, differential privacy and indicator sharing as defenses.
70
55
30
60
42
30
30
30
55
Oracle Critical Security Patch Update, September 2026 Review
Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.
Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.
55
Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families
Oracle's September 2026 Critical Patch Update ships 673 patches across 17 product families, including 100+ critical and 240+ remotely exploitable flaws.
Oracle's September 2026 Critical Security Patch Update ships 673 patches covering 672 unique CVEs, with more than 130 additional CVEs resolved through bundled fixes, pushing the effective total past 800. Over 100 flaws are critical severity and more than 240 are remotely exploitable without authentication. Oracle E-Business Suite received 159 fixes, Fusion Middleware 153 (78 unauthenticated and network-exploitable), and Hyperion 102. No in-the-wild exploitation of these specific flaws is reported, but Oracle cites CISA's earlier 72-hour remediation order for actively exploited CVE-2026-21962 (CVSS 10.0).
58
Microsoft confirms KB5002914 Excel update breaks copy and paste
Microsoft confirms KB5002914 Office security update silently breaks copy-paste, autofill, and formula dragging in Excel 2016 through 2024.
Microsoft confirmed the September 2026 KB5002914 security update breaks copy-and-paste, autofill, and formula dragging in Excel 2024, 2021, 2019, and 2016. Failures occur silently with no beep or error message, leaving the destination unmodified. Uninstalling KB5002914 via OfficeC2RClient or Oarpmany restores functionality while Microsoft investigates.
20
Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks
Google's September 2026 Android bulletin fixes over 30 critical flaws, including no-interaction system RCEs, a TIPC kernel RCE and a Qualcomm closed-source bug
Google's Android Security Bulletin for September 2026 (patch levels 2026-09-01 and 2026-09-05) fixes numerous critical System remote code execution flaws, including CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919 and CVE-2026-49921, none requiring user interaction or additional privileges. It also addresses critical kernel issues including a TIPC RCE (CVE-2026-52993) and elevation-of-privilege flaws in NFC and protected KVM, plus a critical Qualcomm closed-source component flaw (CVE-2026-25289). Affected versions span Android 14 through 17; the 2026-09-05 patch level extends coverage to Android TV and chipset components, with high-severity fixes for Arm Mali, PowerVR, MediaTek, Unisoc and Qualcomm components.
55
Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers
Google announced Android 17 will enforce OS-wide Encrypted Client Hello with ECH GREASE, plus Certificate Transparency by default and carrier 2G disablement.
Google announced Android 17 network security protections headlined by OS-wide support for Encrypted Client Hello (ECH), with ECH GREASE enabled by default so connections to non-ECH servers look identical. Google's Jigsaw noted OkHttp has integrated ECH, letting third-party Android apps adopt the standard. The release also enforces Local Network Protection permission prompts, enables Certificate Transparency by default, and lets carriers turn off 2G by default to prevent downgrade attacks, rogue base stations, and SMS blasters. ECH was previously added to Chrome 117 and Firefox 118 at the browser level only.
35
Slovakia Warns of Cyber Risks in Road Speed Cameras
Slovakia's NBÚ warns that speed camera systems from SODASUS, Simicon and NEROline pose cyber risks including undocumented remote access.
Slovakia's National Security Authority (NBÚ) warned of a significant cyber threat tied to several road speed camera products: NERO R-ONE units sold by Cyprus-based SODASUS, and Cordon-series cameras made by Russia's Simicon and sold by Croatia's NEROline. A security analysis requested by the Interior Ministry found weak protections, mismatches between documented and actual communication settings and software versions, unclear hardware/software provenance, and pre-configured remote-access mechanisms outside operator control. NBÚ warned that compromised cameras could expose vehicle and licence-plate data, tamper with records, or serve as a foothold into public-sector networks lacking segmentation. The Interior Ministry reportedly removed the units from its pilot deployment and asked the supplier to replace them with equipment meeting Slovak and EU security requirements.
45
US agencies warn of AI-powered attacks on Siemens industrial controllers
NSA, CISA, FBI, DOE, and EPA warn threat actors use AI-assisted scripts and snap7 libraries to access internet-exposed Siemens S7 PLCs in critical infrastructure sectors.
NSA, CISA, FBI, DOE, and EPA issued a joint advisory warning that threat actors combine open-source snap7.dll/python-snap7 libraries with AI-generated scripts to gain read/write access to Siemens S7-200 through S7-1500 PLCs over the S7comm protocol. Actors use Censys and ZoomEye to find internet-exposed devices and abuse default or weak credentials, with activity assessed as persistent reconnaissance and positioning for future write operations. Agencies urge device inventory, patching, removing PLCs from the internet, and hardening; the pattern resembles Iran-linked CyberAv3ngers targeting of Rockwell, Schneider, and Siemens PLCs.
70
Oracle Critical Patch Update, August 2026 Security Update Review
Oracle's August 2026 Critical Patch Update fixes 943 vulnerabilities; Oracle Fusion Middleware and Hyperion received the most patches at 262.
Oracle released its August 2026 Critical Patch Update, addressing 943 security vulnerabilities across multiple product families, including third-party components bundled in Oracle products. Oracle Fusion Middleware and Oracle Hyperion received the highest number of fixes with 262 patches. Several of the addressed vulnerabilities impact more than one product.
42
Wireshark 4.6.8 patches 28 security bugs, nine in file parsers
Wireshark 4.6.8 fixes 28 security bugs, including nine crash-prone capture file parsers, misdecoded 5G fields, and memory-safety issues.
Wireshark 4.6.8 fixes 28 security bugs spanning advisories wnpa-sec-2026-64 through wnpa-sec-2026-91, including nine crash bugs in file parsers such as pcapng, Endace ERF and Tektronix K12xx that trigger when opening capture files. Fixes cover dissectors for RDP, SSH, Kerberos, H.245, CMS, C12.22 and several Bluetooth protocols, plus unnumbered memory-safety issues like a stack buffer overflow in the K12/RF5 writer. The release also corrects eight misdecoded 5G NAS/5GSM fields and moves the Unix extcap path to /usr/libexec/wireshark/extcap.
35
30
30
42
42
30
55
42
30
60
60
55
55
30
55
55