Source: The Register · Security

2 stories in the last 3d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Policy & legal 2 AI safety & security 2 Threat actor 2 Exploit / PoC 2 AI policy 1 Vulnerability 1 Industry 1 Phishing & fraud 1 Research 1

SeverityAll critical 2 high 4 medium 1 low 1 info 5 source: The Register · Security ✕

Cisco email security boxes can be rooted by... an email

Attackers actively exploit critical Cisco Secure Email Gateway flaw CVE-2026-76461, turning a malicious email into unauthenticated root access.

Cisco Secure Email Gateway appliances are being actively exploited via CVE-2026-76461, a CVSS 9.8 AsyncOS flaw requiring no authentication—a crafted email can yield root command execution with no workarounds. Cisco's PSIRT became aware of active exploitation in September; some Secure Email Cloud customers showed indicators of compromise and all cloud devices were upgraded to AsyncOS 16.5.0-780. The bug is in CISA's KEV catalog with federal agencies ordered to remediate by September 17; Shadowserver counted 400+ exposed appliances. Fixes are available in AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780, and attackers with root may tamper with logs to hide activity.

The Register · Securityupdated 20:46 UTC · 1h agofirst 16:01 UTC · 6h agoExploit / PoC in the wild 15 sources CVE-2026-76461 CVE-2025-20393

Perfect-10 GitLab bug under attack days after patch lands

CISA confirms active exploitation of CVSS 10.0 GitLab path traversal flaw CVE-2026-85706 days after patches shipped, enabling unauthenticated arbitrary file reads.

CISA added CVE-2026-85706, a maximum-severity 10.0 CVSS path traversal flaw in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog and confirmed active exploitation. The bug allows unauthenticated attackers to read arbitrary files, including configuration data and credentials, from self-managed GitLab CE/EE servers via a single HTTP POST request. GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6, and 19.1.8, covering versions 18.7 through 19.3. watchTowr is observing probes against internet-facing instances and warns widespread exploitation is likely to follow quickly.

The Register · Securityupdated 00:52 UTC · 21h agofirst Sep 14, 14:30 UTC · 1d agoExploit / PoC in the wild 17 sources CVE-2026-85706