35
30
35
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
Since March 2023, Unit 42 has tracked threat actors exploiting more than 20 IoT vulnerabilities to spread a Mirai botnet variant, first seen downloading payloads from zvub.us on March 14, 2023. Exploited flaws span CVE-2023-1389 (TP-Link Archer), CVE-2022-30525 (Zyxel), CVE-2022-31499 (Nortek) and many router, camera and DVR bugs. The variant decrypts configuration strings with an XOR key derived from 0xDEADBEEF and lacks built-in credential brute forcing, so spreading relies on manual operator exploitation. Two campaigns observed since October 2022 share infrastructure and near-identical samples.
42
35
35
35
35
30
30
35
Windows BitLocker Flaw Lets Attackers Execute Code on Vulnerable Systems
Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker allowing privileged local attackers to execute code; no exploitation reported.
Microsoft disclosed CVE-2026-69449 on September 8, 2026, an Important-severity heap-based buffer overflow (CWE-122) in Windows BitLocker with a CVSS 3.1 base score of 6.7. The attack vector is local (AV:L) with high privileges required, so exploitation needs privileged local access rather than remote access over the internet. Microsoft, as assigned CNA, has not reported public exploitation, and administrators are urged to inventory BitLocker-enabled systems and apply updates. Interim mitigations include least-privilege access, limiting administrative rights, and monitoring for unexpected elevated process activity.
40
35
30
Mirai Variant MooBot Targeting D
Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.
Unit 42 captured attacks exploiting four D-Link remote code execution vulnerabilities: CVE-2015-2051, CVE-2018-6530, CVE-2022-26258, and CVE-2022-28958, with three rated critical at CVSS 9.8. The exploits download the MooBot malware, a Mirai botnet variant, from infrastructure at 159.203.15.179 via wget. Compromised devices fall under full attacker control and can be used for distributed denial-of-service attacks. D-Link has published bulletins for all four flaws, but unpatched devices remain exposed.
40
35
35
[remote] ipTIME A3004T - Remote Code Execution
A remote code execution exploit was published for ipTIME A3004T routers, a flaw relevant to internet-facing devices.
Exploit-DB published exploit #52644 for the ipTIME A3004T router, demonstrating remote code execution. Router RCE flaws are typically exploitable by unauthenticated attackers on exposed devices. The disclosure text does not report exploitation in the wild.
24
[webapps] Joomla JCE_2.9.15 - Remote Code Execution
A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.
Exploit-DB added a webapps proof-of-concept for remote code execution affecting the Joomla Content Editor (JCE) component version 2.9.15. JCE is a widely deployed editor extension used on Joomla websites. The entry provides no CVE id and no evidence of in-the-wild exploitation.
40
[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution
A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.
Exploit-DB lists a proof-of-concept exploit chaining path traversal to remote code execution in Langflow 1.8.4, an open-source tool used to build LLM applications and agents. The chain allows an attacker to write arbitrary files outside the intended directory and achieve code execution on the host. The provided text does not include a CVE identifier or reports of exploitation in the wild, but RCE in a widely deployed AI tooling product is notable for defenders.
42
Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices
Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.
Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.
40
[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)
Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.
Exploit-DB entry 52681 documents a remote code execution vulnerability in FreePBX 17.0.2, a widely used open-source PBX platform. The listing contains no CVE id, authentication requirement, or evidence of in-the-wild exploitation. FreePBX is commonly internet-facing, so unauthenticated RCE would be significant for exposed deployments.
40
[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution
Exploit-DB published an authenticated remote code execution exploit targeting Metabase version 0.61.0.
A new Exploit-DB entry (ID 52680) describes an authenticated remote code execution vulnerability in Metabase 0.61.0. The listing provides minimal detail, but authenticated RCE in a widely deployed BI tool is notable for defenders running exposed instances. No CVE id or in-the-wild exploitation is mentioned in the listing.
40
35
[webapps] Ghost_CMS 6.19.0 - Remote Code Execution
A public proof-of-concept demonstrates remote code execution in Ghost CMS 6.19.0, the widely deployed open-source publishing platform.
Exploit-DB lists a remote code execution proof of concept affecting Ghost CMS version 6.19.0. Ghost is a popular open-source platform used by publishers and blogs worldwide. The listing does not cite a CVE id or report in-the-wild exploitation.
30
Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP
Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.
Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.
42
Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion
Flextype CMS v1.0.0-alpha.3 allows PHP remote code execution via path traversal in the Entries API combined with shortcode file inclusion.
Flextype CMS v1.0.0-alpha.3 exposes a remote code execution path through the interaction of the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts attacker-controlled entry identifiers containing path traversal sequences, allowing PHP-containing content to be written outside the intended entries directory. A subsequent attacker-controlled path can then be included and executed as PHP. Ron E posted the disclosure to the Full Disclosure mailing list on September 3, 2026.
34
35
VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers
Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.
CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.
50
30
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.
48
ZDI-26-594: NVIDIA Megatron Bridge load_model_config Code Injection Remote Code Execution Vulnerability
NVIDIA Megatron Bridge load_model_config code injection flaw (CVE-2026-24251, CVSS 7.8) enables remote arbitrary code execution on affected installs.
ZDI-26-594 describes a code injection vulnerability in NVIDIA Megatron Bridge's load_model_config function, tracked as CVE-2026-24251 with CVSS 7.8. Exploitation allows remote attackers to execute arbitrary code on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.
22
ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75862) in Adobe Photoshop DCM JPEG image parsing.
The Zero Day Initiative published advisory ZDI-26-679 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75862 with a CVSS 7.8 score. The flaw occurs while parsing JPEG data in DCM images. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.
32
ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed a CVSS 7.8 use-after-free remote code execution flaw (CVE-2026-81976) in Adobe Acrobat Reader DC triggered via malicious PDFs.
The Zero Day Initiative published advisory ZDI-26-675 describing a use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC, tracked as CVE-2026-81976 with a CVSS 7.8 score. The flaw resides in the annotation feature. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The advisory reports no evidence of in-the-wild exploitation.
40
ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability
ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.
Zero Day Initiative advisory ZDI-26-648 documents an External Control of System or Configuration Setting vulnerability in OpenAI Codex, demonstrated at Pwn2Own. A remote attacker could achieve arbitrary code execution, with user interaction required such as opening malicious content. The flaw is tracked as CVE-2026-19590 with a CVSS rating of 7.8. No exploitation in the wild is reported.
52
ZDI-26-616: Koha Eval Code Injection Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-19780, a CVSS 8.8 authenticated eval code-injection flaw in Koha enabling remote code execution.
Zero Day Initiative advisory ZDI-26-616 describes a code injection vulnerability in the Eval component of Koha, the open-source integrated library system. A remote attacker must authenticate before injecting and executing arbitrary code on affected installations. ZDI assigned the flaw a CVSS 3.0 rating of 8.8.
35
ZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.
ZDI-26-604 describes a use-after-free vulnerability in Foxit PDF Reader's annotation handling, tracked as CVE-2026-13126 and rated CVSS 7.8. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and allows remote attackers to execute arbitrary code. The advisory was published by the Zero Day Initiative on August 24, 2026.
25
ZDI-26-550: OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability
ZDI discloses a memory corruption flaw in OriginLab OriginPro OGW file parsing enabling remote code execution via malicious files (CVE-2026-18291, CVSS 7.8).
ZDI advisory ZDI-26-550 describes a memory corruption vulnerability in OriginLab OriginPro OGW file parsing that allows remote attackers to execute arbitrary code. User interaction is required: the target must visit a malicious page or open a malicious file. The flaw has a CVSS rating of 7.8 and is assigned CVE-2026-18291.
16
ZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability
ZDI publishes ZDI-26-646 for CVE-2026-8037, an authenticated uninitialized-memory remote code execution flaw in Progress Kemp LoadMaster, rated CVSS 7.2.
Zero Day Initiative published advisory ZDI-26-646 describing an uninitialized memory flaw in Progress Software Kemp LoadMaster's escape_quotes function. Successful exploitation allows remote authenticated attackers to execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-8037.
28
ZDI-26-598: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader AcroForm use-after-free (CVE-2026-57242, CVSS 7.8) permits remote code execution through malicious PDF files or pages.
ZDI-26-598 details a use-after-free in the AcroForm component of Foxit PDF Reader, tracked as CVE-2026-57242 and rated CVSS 7.8. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.
25