U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog
60
60
60
60
60
60
60
60
60
60
60
45
60
60
57
45
45
45
45
60
60
60
60
60
60
Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges
Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.
CVE-2026-43502, dubbed ZcopyReaper, is a Linux kernel local privilege escalation flaw in the RDS zerocopy send path, present since kernel 4.17, allowing unprivileged local attackers to gain root. NebuSec researcher Yuan Tan demonstrated root escalation on openSUSE kernel 6.4.0-150600.23.100; the fix landed in commit 44b550d88b26 with Linux 7.1-rc3 the first patched mainline release. Exploitation requires CONFIG_RDS and CONFIG_RDS_TCP but not unprivileged user namespaces, and PoC exploit material is publicly released alongside more than 20 other exploitable 2026 kernel CVEs.
55
U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.
CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.
82
Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware
Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.
Cisco Talos warns of active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center allowing unauthenticated root-level code execution, and CVE-2026-20316 (CVSS 5.3), which permits login via a low-privileged static account for privilege escalation. Hotfixes are available now, with a broader hardening release planned for the week of September 14. Three post-compromise activity clusters were identified: UAT-12197 deployed a home.jsp web shell and cmd.jar command executor; UAT-11823, attributed with high confidence to a Sandworm-linked APT, deployed a Netcat reverse shell and Cyclops Blink; and UAT-11988 showed Qilin ransomware tactics including Active Directory enumeration and credential theft before deploying Qilin ransomware.
87
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.
CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center authentication bypass, CVSS 10.0), CVE-2026-19490 (Citrix NetScaler ADC/Gateway authentication bypass, CVSS 9.3), and CVE-2025-25249 (FortiOS heap buffer overflow, CVSS 7.3) to the Known Exploited Vulnerabilities catalog with a September 12, 2026 deadline for FCEB agencies. Cisco confirmed active exploitation of CVE-2026-20079 in August 2026, while Previdian honeypots logged 56 NetScaler exploitation attempts since September 3. SOCRadar attributes Fortinet exploitation to a financially motivated Russian-speaking actor deploying the PivotC2 Node.js RAT, infecting 178 of over 3,000 targeted IP addresses, mostly in the US.
85
Hackers drain $320M in Bitcoin from Liquid Network, claim they're the good guys
Attackers withdrew about 4,000 BTC (~$320M) from Liquid Network's federation wallet via a SideSwap peg-out, claiming whitehat status.
Hackers drained roughly $320 million in Bitcoin — about 4,000 BTC, 95% of holdings — from the federation wallet backing Blockstream's Liquid Network sidechain. The withdrawal occurred through SideSwap using its Peg-out Authorization Key (PAK), yet no PAK appears to have been compromised, and the exact mechanism remains under investigation. The actors embedded an on-chain message identifying themselves as whitehats, asked Blockstream to patch federation nodes first, and promised to return most of the funds after fixes are confirmed. Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals; other Liquid assets and the Bitcoin network were unaffected.
78
Apple macOS Screen Sharing Flaw Exploited on Internet
Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.
NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.
82
Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.
CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.
90
60
Researcher Explains Release of Undisclosed Zero
60
60
45
60
60
⚡ Weekly Recap: Instagram Account Hacks, Android Zero
60
60