60
60
60
60
60
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
Acronis urgently patched CVE-2026-87886 (CVSS 7.8), insecure file permissions enabling privilege escalation, exploited in targeted attacks on cPanel & WHM backups.
Acronis released urgent patches for CVE-2026-87886 (CVSS 7.8), insecure file permissions in the Backup plugin for cPanel & WHM and the Backup extension for Plesk that allow attackers to gain elevated privileges. Exploitation has been detected in the wild in limited, targeted attacks against the cPanel & WHM plugin, but not against the Plesk extension. All Linux versions of the plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638 are affected; Acronis urges immediate updates and has not shared technical details.
72
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.
85
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.
A joint advisory from NSA, CISA, FBI, DOE and EPA describes an active threat in which AI-generated exploit scripts disguised as legitimate monitoring tools target Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers). The actors use Censys and ZoomEye scanning to find internet-exposed, outdated PLCs and a custom Python script using snap7 libraries over the S7comm protocol for initial access, credential access and denial of service; no attribution was given. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential for process disruption and cascading impacts. A related Dream report details a near-autonomous AI-agent campaign (July 1-4, 2026, 12 waves) against Taiwan government entities, using Hermes and OpenClaw agents with eight parallel sub-agents to crack 85 accounts via password spraying and exfiltrate over 2,564 personnel records, SSO client secrets and database credentials.
80
Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.
92
CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign
CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.
CISA ordered federal agencies to patch Windows Winsock vulnerability CVE-2026-68820, rated 7/10, by August 25 after confirming exploitation; no workaround exists and a restart is required. Check Point found Lazarus Group hackers impersonated Lockheed Martin and Enveil recruiters on LinkedIn, sent malicious PDFs enabling long-term remote access, then used the zero-day to escalate from limited access to full system control. Targets spanned defense sectors including surveillance, drones and robotics in France, Germany, Brazil and India, as part of Operation Dream Job tracked since 2020.
82
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
60
60
60
45
60
60
60
2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")
Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.
Disclosed on 29 April 2026, CVE-2026-31431 is a local privilege escalation in the Linux kernel's algif_aead module (AF_ALG crypto API), CVSS 7.8, stemming from a 2017 in-place optimisation. By chaining an AF_ALG socket operation with splice(), an unprivileged user can write 4 bytes into an arbitrary page-cache page, e.g. corrupting a setuid binary like /usr/bin/su to obtain a root shell. It affects virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16; the mainline fix landed 1 April 2026 but no vendor packages were available as of 30 April. CERT-EU recommends the interim mitigation (disable algif_aead) and blocking AF_ALG via seccomp, prioritising Kubernetes nodes and CI/CD runners.
68
60
60
83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure
60
Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network Platforms
60
Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero
60
60
60
60
September 2025 CVE Landscape
60
60
60
60
60
60
60
60
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update
60
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
60
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
60
60
45
60