60
45
[remote] mcp-server-kubernetes 3.8.x - Argument Injection
Argument injection in mcp-server-kubernetes 3.8.x MCP server could allow AI clients to execute unintended Kubernetes operations.
Exploit-DB entry 52638 documents an argument injection vulnerability in mcp-server-kubernetes version 3.8.x, a Model Context Protocol server that lets AI assistants interact with Kubernetes clusters. Crafted input can inject additional arguments into commands executed by the server, potentially enabling unauthorized operations or command execution against the cluster. This highlights growing security concerns around MCP servers bridging LLM agents and infrastructure.
50
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
45
60
60
60
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
60
60
45
60
60
60
60
60
45
45
45
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.
85
Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero
60
50
60
57
60
60
60
60
45
60
Microsoft Fixes Three Zero
60
60
60
60
60
⚡ Weekly Recap: Instagram Account Hacks, Android Zero
60
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
60
CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...
CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.
CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.
68