Cisco patches another actively exploited SD-WAN zero-day (CVE-2026-20182)
60
60
60
60
60
60
Ivanti Releases Zero
60
60
Two Ivanti Zero
60
60
60
60
60
60
60
60
60
60
60
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.
Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.
70
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.
Wiz Research identified active exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 in JFrog Artifactory between August 15 and September 8, 2026. Attackers chain the anonymous-token exposure (CVE-2026-42018) with the token scope-validation flaw (CVE-2026-42016) to obtain admin-scoped tokens, while CVE-2026-82329 allows unauthenticated administrative access in default configurations. Observed post-exploitation includes persistent administrator accounts created in under five minutes, malicious Groovy plugin deployment, ad-hoc command execution, Rust-based C2 backdoors dropped to writable paths, and webshell uploads. Wiz measured that 59-62% of organizations running Artifactory remained vulnerable to the chained CVEs weeks after disclosure, and the vulnerabilities were already included in CISA KEV.
85
60
60
60
60
SessionReaper attacks have started, 3 in 5 stores still vulnerable
60
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
60
60
Exploit weaponizes SAP NetWeaver bugs for full system compromise
60
60
Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)
60
60
60
60
60
Attackers are chaining flaws to breach Palo Alto Networks firewalls
60