60
60
60
57
Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks
Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.
Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.
82
Acronis Plugin Vulnerability in cPanel and Plesk Exploited in the Wild
Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel and Plesk backup plugins, exploited in targeted attacks.
Acronis released fixes for CVE-2026-87886 (CVSS 7.8, CWE-276), an insecure file permissions flaw in Linux-based backup components for cPanel & WHM and Plesk that enables local privilege escalation. The vendor observed limited, targeted exploitation in the wild before patches shipped. Fixes are available in Backup plugin for cPanel & WHM 1.9.3 HF3 and Backup extension for Plesk 1.8.11. A local attacker with low privileges could gain elevated access to backup data, control panels, and other customer accounts on shared hosting infrastructure.
65
Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds
Attackers exploited pre-auth RCE CVE-2026-39987 in Marimo notebooks to steal AWS credentials and SSH into a bastion host in eight seconds.
Sysdig Threat Research Team documented an intrusion abusing CVE-2026-39987, an unauthenticated RCE in Marimo's terminal WebSocket endpoint affecting versions up to 0.20.4 and fixed in 0.23.0. The attacker harvested AWS credentials from the host environment and Redis backend, queried AWS Secrets Manager to retrieve an SSH private key, and authenticated to an internet-facing SSH bastion host just eight seconds after opening the WebSocket session. Human-operated custom tooling, not an AI agent, executed the full exploit-to-lateral-movement chain.
65
Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.
68
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.
85
CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks
CISA adds exploited Citrix NetScaler authentication bypass CVE-2026-19490 to the KEV catalog; federal agencies must patch by September 12.
CISA added CVE-2026-19490, a CWE-288 authentication bypass affecting NetScaler ADC and Gateway deployments configured as AAA virtual servers or Gateway services (including SSL VPN, ICA Proxy, and RDP Proxy), to the Known Exploited Vulnerabilities catalog. Citrix released fixes on August 19, 2026; honeypots recorded 56 attack attempts between September 3 and 8 after a public PoC, though no confirmed production compromises have been reported. Affected builds include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21; newer installations require SAML IdP configuration to be exposed.
76
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.
85
Langflow Remote Code Execution Vulnerability Exploited in Attacks (CVE-2026-0768)
Critical CVSS 9.8 RCE CVE-2026-0768 in Langflow is under active exploitation, with attackers probing for credentials and secrets.
CVE-2026-0768, a critical (CVSS 9.8) remote code execution flaw in Langflow's code validator, lets attackers execute Python code with root privileges via the validate endpoint's code parameter. VulnCheck honeypots in the UK detected Russian-origin exploitation performing reconnaissance and credential harvesting, querying environment variables like LANGFLOW_SUPERUSER and AWS keys and reading Langflow's secret key. Versions before 1.4.2 are affected; no vendor advisory or public PoC was available at reporting time.
65
BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
Attackers BGP-hijacked Softaculous IP space via Hetzner routing lapses to push malicious Virtualizor updates to hosting servers.
Unknown attackers hijacked the 162.55.80.0/24 prefix used by Softaculous' Virtualizor update service by abusing lax routing security at hosting provider Hetzner Online, announcing the range through AS6204, AS62390, and AS24940 with a forged but RPKI-valid origin. The hijack pulsed intermittently over roughly 33 hours, delivering modified update packages to Virtualizor servers, which lacked cryptographic code signing for updates. Softaculous says only a small number of servers were likely affected but cannot produce a definitive list, urging administrators to treat every Virtualizor server as in scope for checks.
65
Hackers Target Langflow in CVE-2026
Threat actors are actively exploiting CVE-2026-0768, an unauthenticated Python RCE in Langflow, hunting OpenAI, AWS, and SSH credentials.
Attackers began exploiting CVE-2026-0768 (CVSS 9.8), an unauthenticated remote code execution flaw in the code validator of the Langflow AI low-code platform, affecting all versions up to 1.4.2. VulnCheck observed 50+ Canary detections on the first day of exploitation, with attackers checking Langflow, OpenAI, and AWS keys in environment variables, reading the secret key, and looking for SSH access and shell history; most traffic originates from Russia and targeted UK-based canaries. The flaw was reported via ZDI by Trend Research in July 2025 and disclosed in January 2026; six other Langflow CVEs were added to VulnCheck's KEV list this year.
72
60
60
57
60
60
57
57
60