ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “sql injection”

77 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 32Vulnerability 19Advisory 11Data breach 7AI safety & security 6Threat actor 5Research 3Tools 3Industry 3Phishing & fraud 2Policy & legal 1Malware 1
SeverityAllcritical 18high 35medium 24low 5info 11

Apache Superset SQL Injection Flaw Gets Public PoC Exploit

A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.

A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.

GBHackers · 5h agoExploit / PoC 2 sourcesCVE-2026-23980

CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability

CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.

CVE-2026-9586 (CVSS 4.0: 9.3) is an unauthenticated SQL injection in the /pa endpoint of Sangoma Switchvox SMB Edition, where the unsanitized PhoneIP value in XML phone notification requests reaches the PostgreSQL database. Horizon3 demonstrated escalation to OS command execution, and honeypots run with Defused Cyber observed exploitation attempts on August 30, 2026, using PostgreSQL commands with nc and curl. Fixed in Switchvox 8.4.0.2 released July 14, 2026; one attacker IP (176.65.148.184) was documented.

Horizon3.ai · 14d agoExploit / PoC in the wildCVE-2026-9586

cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root

cPanel disclosed CVE-2026-67401, an authenticated SQL injection in EmailTrack that lets attackers write files and execute code as root.

cPanel disclosed CVE-2026-67401 on September 8, 2026: a SQL injection in the EmailTrack feature that allows authenticated account holders with mail-related permissions to create arbitrary files and execute code with root privileges. Fixes shipped in v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, and WP2 channel v11.138.1.9, with all supported versions before those releases affected. Root-level execution poses severe risk to shared hosting providers and multi-tenant servers, as it removes isolation between cPanel accounts, websites, mailboxes, and backups. Researchers Ali Mustafa (rz1027) and abed1526 responsibly reported the flaw.

GBHackers · 7d agoVulnerabilityCVE-2026-67401

5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.

Wordfence received a submission on August 14, 2026 for an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin. The plugin has more than 5 million active installations. The disclosure text does not include a CVE id, a patch version, or evidence of exploitation.

Wordfence · 14d agoVulnerability

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A CVSS 9.8 SQL injection zero-day in GeoServer's PostGIS datastore enables RCE and drew active exploitation; fixes shipped in versions 3.0.1, 2.28.5, 2.27.6.

A SQL injection flaw in GeoServer's jsonArrayContains function within the GeoTools PostGIS datastore (GHSA-mqjf-5f49-2fjh, CVSS 9.8) was disclosed August 12, 2026, and saw hundreds of exploitation attempts within hours per watchTowr. An attacker-controlled value is interpolated into a PostgreSQL jsonb_path_exists() expression without escaping; with superuser or pg_execute_server_program privileges it escalates to OS command execution via WFS 1.0. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6, and the flaw is a regression of CVE-2023-25158. GeoServer has a history of mass exploitation, including CVE-2024-36401 used for botnets and proxies.

The Hacker News · 29d agoExploit / PoC in the wildCVE-2024-36401CVE-2023-25158CVE-2023-251571

[webapps] CubeCart 6.7.4 - SQL injection

A second proof-of-concept SQL injection exploit for CubeCart 6.7.4 was published on Exploit-DB.

Exploit-DB lists a SQL injection proof-of-concept affecting CubeCart 6.7.4, the open-source shopping cart application. The entry demonstrates the flaw but the provided text does not include a CVE identifier or reports of exploitation in the wild. It appears alongside related CubeCart XSS and SQL injection listings published the same day.

Exploit-DB · 16d agoExploit / PoC1

Cisco Unified Intelligence Center SQL Injection Vulnerability

Cisco patched a blind SQL injection in Unified Intelligence Center's web interface allowing authenticated local attackers to read the internal database.

Cisco disclosed a blind SQL injection vulnerability in the web-based management interface of Unified Intelligence Center, caused by insufficient validation of user-supplied input. An authenticated local attacker can send crafted requests and read the contents of the device's internal database. Exploitation requires valid user credentials, and Cisco has released software updates.

Cisco Security Advisories · 27d agoAdvisory

[webapps] EasyAppointments 1.5.1 - Blind SQL Injection

A proof-of-concept exploit for a blind SQL injection vulnerability in EasyAppointments 1.5.1 has been published on Exploit-DB.

Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in EasyAppointments 1.5.1. The listing falls under the webapps category and enables reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.

Exploit-DB · 15d agoExploit / PoC1

[webapps] Payload CMS 3.72.0 - Blind SQL Injection

A proof-of-concept exploit for a blind SQL injection vulnerability in Payload CMS 3.72.0 has been published on Exploit-DB.

Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in Payload CMS 3.72.0. The listing falls under the webapps category and allows reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.

Exploit-DB · 15d agoExploit / PoC

Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.

Okta disclosed on September 8, 2026 three vulnerabilities: CVE-2026-85982, a CVSS 9.0 stored XSS in Auth0 AD/LDAP Connector before 8.0.0; CVE-2026-78626, a CVSS 8.1 Protected Rule authorization bypass in Access Gateway before 2026.9.1; and CVE-2026-78623, a CVSS 7.7 SQL injection in Access Gateway advanced-mode datastores. Exploitation requires authenticated access and specific configurations. Fixes require upgrading the connector to 8.0.0+ and Access Gateway to 2026.9.1+.

GBHackers · 5d agoVulnerability 2 sourcesCVE-2026-85982CVE-2026-78626CVE-2026-786231

Cisco Secure Email Gateway SQL Injection Vulnerability

Unauthenticated SQL injection in Cisco Secure Email Gateway email parsing enables root command execution via crafted messages; patches released.

A vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Insufficient validation in the email parsing logic lets a crafted email containing malicious SQL statements achieve arbitrary SQL execution and root command execution. Cisco has released software updates, and the companion September 2026 hardening advisory states this flaw is actively exploited.

Cisco Security Advisories · 1d agoVulnerability in the wild

CVE-2026-82583, CVE-2026-78224, CVE-2026-82578: NextGen Mirth Connect SQL injection and XXE

CISA advisory ICSMA-26-253-01 covers three NextGen Mirth Connect flaws, including SQL injection and XXE, with testing performed against version 4.5.2.

CISA has published ICS Medical Advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Mirth Connect, the open-source healthcare integration engine. The flaws include SQL injection and XML external entity (XXE) injection, tracked as CVE-2026-82583, CVE-2026-78224 and CVE-2026-82578, with testing performed against version 4.5.2. The findings were announced on the oss-security mailing list by researcher Abhinav Agarwal on September 11.

oss-security · 5d agoVulnerability 2 sourcesCVE-2026-82583CVE-2026-78224CVE-2026-825781

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.

cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.

The Hacker News · 7d agoVulnerabilityCVE-2026-67401

Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

Attackers exploit unauthenticated SQL injection CVE-2026-9586 in Sangoma Switchvox to run PostgreSQL commands and deploy reverse shells.

Threat actors are exploiting CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997), since August 30, 2026, running arbitrary SQL as the PostgreSQL superuser and achieving remote code execution. The /pa endpoint concatenates the user-controlled PhoneIP value into PostgreSQL queries; attackers can extract database contents, escalate to Switchvox web administrator, exfiltrate the cookie signing key to forge authentication, and invoke reverse shells. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, roughly 4,000 instances are internet-exposed (mostly in the US), and honeypot activity from IP 176.65.148.184 deploys reverse shells followed by Base64-encoded process enumeration.

The Hacker News · 14d agoExploit / PoC in the wildCVE-2026-9586

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog.

CISA adds three actively exploited flaws—Cisco ASA/FTD DoS, Windows Winsock SYSTEM-level UAF, and Metabase SQL injection—to its Known Exploited Vulnerabilities catalog.

CISA added CVE-2026-20349 (CVSS 8.6, heap inspection flaw crashing Cisco ASA/FTD via crafted HTTP requests to the Remote Access SSL VPN service), CVE-2026-68820 (CVSS 7.0, use-after-free in the Windows afd.sys Winsock driver allowing SYSTEM-privilege code execution, actively exploited per Microsoft) and CVE-2026-72898 (CVSS 10.0, unauthenticated SQL injection in Metabase) to the KEV catalog. Metabase disclosed its cloud service was attacked with the 0-day, giving the intruder a path to administrator rights and stored credentials for connected databases; cloud instances were patched while self-hosted deployments need urgent updates. Under BOD 22-01, federal civilian agencies must patch by August 14, 2026, except CVE-2026-68820, due August 25.

Security Affairs · 28d agoExploit / PoC in the wildCVE-2026-20349CVE-2026-68820CVE-2026-728981

New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server

cPanel disclosed critical SQL injection CVE-2026-67401 in EmailTrack, letting authenticated users with mail privileges gain root code execution; patched builds available.

cPanel disclosed CVE-2026-67401 on September 8, 2026, a critical SQL injection in the EmailTrack feature that monitors email delivery and routing. An authenticated attacker holding a valid cPanel account with mail-related privileges can create arbitrary files and achieve code execution as root, enabling full compromise of hosting servers and exposure of co-tenant customers. All supported cPanel/WHM versions before specific patched builds (11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and 11.138.1.9 WP2) are affected; upgrading is the primary mitigation. No exploitation was reported at disclosure.

Cyber Security News · 7d agoVulnerabilityCVE-2026-67401

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries) · 7d agoExploit / PoC in the wild 2 sourcesCVE-2026-63030CVE-2026-601371· 1 read

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.

Trezor disclosed that a breach at shipping provider ShipMonk exposed names, email addresses, phone numbers, shipping addresses, and order numbers of 67,000 additional US customers, with orders dating November 2019 to August 2021 despite written assurances the data had been deleted. This adds to the 13,689 customers previously disclosed after ShipMonk informed Trezor of unauthorized access on August 10, 2026. According to Holborn, the ShinyHunters extortion gang is behind the breach, which began with zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metaboobase analytics software Metabase. Trezor says hardware wallet security is unaffected but warns customers to watch for phishing and social engineering; ShipMonk has not publicly acknowledged the incident.

The Hacker News · 11d agoData breach in the wildCVE-2026-72898

Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls

Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.

Apache Syncope, an open-source identity management and access governance platform, disclosed CVE-2026-82232, a stacked-query SQL injection in the Task search sort parameter; CVE-2026-77147, a Groovy sandbox escape via malicious Command classes; and CVE-2026-73178, retrieval of signed JWT access tokens via REST enabling impersonation of more privileged users. All three flaws require administrator-level entitlements to exploit and affect Syncope 3.0, 4.0, and 4.1 releases. Fixes shipped in versions 4.0.8 and 4.1.3, with researchers Alon Galili and n0mi1k credited.

Cyber Security News · 1h agoVulnerability 3 sourcesCVE-2026-82232CVE-2026-77147CVE-2026-73178

WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...

Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.

CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries) · 9d agoExploit / PoC in the wildCVE-2026-63030CVE-2026-60137

USN-8765-1: python-sql vulnerability

Ubuntu patches python-sql SQL injection flaw where values passed to unary operators are incorrectly escaped.

Ubuntu Security Notice USN-8765-1 fixes a vulnerability in python-sql discovered by Cedric Krier. The library incorrectly escaped values passed to unary operators, allowing an attacker to potentially perform SQL injection attacks against applications using the library.

Ubuntu Security Notices · 1d agoAdvisory

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

ServiceNow patched four AI Platform flaws, including three pre-authentication CVSS 10.0 issues enabling unauthenticated code execution, SQL injection, and privilege escalation.

ServiceNow released patches on August 27, 2026 for four AI Platform flaws: CVE-2026-18885 (code injection in the GraphQL Composite Data API), CVE-2026-18886 (improper access control enabling privilege escalation), and CVE-2026-74820 (SQL injection), all self-rated CVSS 10.0 and exploitable without authentication, plus CVE-2026-6876, an 8.7 sandbox escape. Updates were deployed to hosted instances, but self-hosted customers must patch affected Xanadu, Yokohama, Zurich, and Australia release lines themselves. ServiceNow says it is not aware of exploitation of the new flaws, and no public exploit code existed as of August 28, 2026; separately, Defused reported in-the-wild exploitation of the earlier CVE-2026-6875 (CVSS 9.5), later noting the captured payload matched Searchlight Cyber's PoC.

The Hacker News · 19d agoVulnerability in the wildCVE-2026-18885CVE-2026-18886CVE-2026-74820+2 CVEs

Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586

Horizon3 disclosed CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox leading to RCE, now under active exploitation in the wild.

Horizon3.ai attack researchers discovered CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma's Switchvox VoIP appliance that can escalate to remote code execution. The researchers observed active exploitation of the flaw in the wild. A disclosure write-up was published alongside their findings, and defenders should treat internet-exposed Switchvox instances as at risk.

Horizon3.ai · 15d agoExploit / PoC in the wildCVE-2026-9586

Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)

Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.

CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3, lets crafted HTTP POST requests execute arbitrary SQL against the backend PostgreSQL database. Horizon3 honeypots first saw exploitation on August 30, 2026 from IP 176.65.148.184, and dozens of additional source IPs have since joined with scanning payloads and second-stage malware that appears to be a cryptominer. The flaw was patched in Switchvox 8.4.0.2 on July 14, 2026; roughly 4,000 exposed instances exist, mostly in the United States, and exploitation is likely against most of them.

Help Net Security · 14d agoExploit / PoC in the wildCVE-2026-9586

Critical Cisco Secure Email Gateway zero-day gives attackers root access

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.

CSO Onlineupdated · 1h agofirst · 19h agoExploit / PoC in the wild 16 sourcesCVE-2026-76461CVE-2025-20393

USN-8768-1: Shibboleth vulnerability

Ubuntu patches Shibboleth SQL injection in the ODBC storage plugin allowing remote attackers to extract sensitive information.

Ubuntu security notice USN-8768-1 fixes a Shibboleth vulnerability discovered by Florian Stuhlmann. The software incorrectly escaped input when using the ODBC storage plugin, allowing a remote attacker to perform SQL injection attacks and obtain sensitive information. Users are advised to update the Shibboleth package.

Ubuntu Security Notices · 23h agoAdvisory

USN-8743-1: PHP vulnerabilities

Ubuntu fixes three PHP flaws, including SQL injection in the PostgreSQL extension (CVE-2026-17543) and an out-of-bounds write in bccomp().

Ubuntu Security Notice USN-8743-1 patches three vulnerabilities in PHP. CVE-2026-17543 involves incorrect backslash escaping in the PostgreSQL extension enabling SQL injection. CVE-2026-17544 is an out-of-bounds write in bccomp() that could cause denial of service or arbitrary code execution on Ubuntu 26.04 LTS, and CVE-2026-7260 causes unbounded recursion via circular symlinks in phar archives.

Ubuntu Security Noticesupdated · 3h agofirst · 6d agoAdvisory 13 sourcesCVE-2026-17543CVE-2026-17544CVE-2026-72601

WebPros security advisory (AV26-908)

Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.

The Canadian Centre for Cyber Security published advisory AV26-908 covering vulnerabilities in WebPros products, including cPanel & WHM and ConfigServer Security & Firewall (CSF). Affected cPanel builds include versions prior to 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP2 11.138.1.9, while CSF versions 14.00-16.29 (CVE-2026-65638) and 2.15-16.29 (CVE-2026-65639) are also affected. CVE-2026-67401 describes SQL injection in cPanel's EmailTrack functionality. Users and administrators are encouraged to review the advisories and apply available updates.

Canadian Centre for Cyber Securityupdated · 5d agofirst · 5d agoAdvisory 3 sourcesCVE-2026-65638CVE-2026-65639CVE-2026-67401

Mathspace breach exposes data on over a million students and parents

Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Attackers accessed Mathspace's self-hosted Metabase reporting system without legitimate login, with unauthorized access dating back to 10 August 2026 and data downloaded on 27 August. Exposed data includes names, usernames, email addresses, country, and account metadata; no passwords, academic records, SSO tokens, or API credentials were taken. Framework, Tally, and Kilo Code disclosed similar breaches via the same Metabase SQL injection flaw in August 2026.

Help Net Security · 8d agoData breach in the wild

[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.

Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.

Exploit-DB · 22d agoExploit / PoCCVE-2026-421671

[webapps] CubeCart 6.7.4 - SQL

A proof-of-concept SQL injection exploit targeting CubeCart 6.7.4 was published on Exploit-DB.

Exploit-DB carries a proof-of-concept exploit for a SQL injection vulnerability in CubeCart 6.7.4, an open-source e-commerce platform. The listing demonstrates the injection issue but the provided text includes no CVE identifier or evidence of active exploitation. SQL injection in the storefront could expose or modify store data.

Exploit-DB · 16d agoExploit / PoC1

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackers · 1d agoIndustry in the wild

SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws

SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.

SAP released 19 new Security Notes plus one update, fixing four critical vulnerabilities and 15 additional flaws. The most urgent is CVE-2026-44756 (CVSS 10.0), memory corruption in Extended Passport (EPP) Processing affecting many SAP Kernel and Web Dispatcher releases. Other criticals include CVE-2026-58240 (NetWeaver Message Server missing authentication, 9.8), CVE-2026-76969 (credential disclosure in CAP sap/cds-mtxs, 9.4), and CVE-2026-66768 (improper access control in SAP GUI for Java, 9.0). High-severity fixes cover XXE in Integration Suite Trading Partner Management, deserialization in NetWeaver Business Client, and memory corruption in NetWeaver AS for ABAP.

GBHackers · 8d agoVulnerabilityCVE-2026-44756CVE-2026-58240CVE-2026-76969+8 CVEs1

SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.

SAP shipped 19 new security notes plus one update across NetWeaver, S/4HANA, Integration Suite, Commerce Cloud, and Cloud Application Programming Model. Top issues include CVE-2026-44756 (CVSS 10.0 memory corruption in SAP Extended Passport Processing across many KERNEL and Web Dispatcher versions), CVE-2026-58240 (CVSS 9.8 missing authentication in NetWeaver Message Server), CVE-2026-76969 (CVSS 9.4 credential disclosure in CAP library sap/cds-mtxs), and CVE-2026-66768 (CVSS 9.0 access control flaw in SAP GUI for Java). No exploitation is reported; organizations running affected kernels are urged to patch urgently.

Cyber Security News · 8d agoVulnerabilityCVE-2026-44756CVE-2026-58240CVE-2026-76969+17 CVEs

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News · 12d agoPolicy & legal

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker News · 29d agoExploit / PoC in the wildCVE-2026-59310CVE-2026-65400CVE-2026-688201

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.

CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.

The Hacker News · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-9586+10 CVEs1

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

Cisco PSIRT's advance notice previews August 19, 2026 advisories including Critical CVSS 10.0 hardening releases for Crosswork and Secure Workload.

Cisco PSIRT issued an advance notification for security advisories published August 19, 2026. The batch includes Critical-rated (CVSS 10.0) hardening releases for Cisco Crosswork and Cisco Secure Workload, a High-severity blind XML External Entity injection in BroadWorks (CVE-2026-20320, CVSS 7.5), a Medium SQL injection in Unified Intelligence Center (CVE-2026-20327, CVSS 6.5), and a RoomOS stack overflow. Full details and fixes follow in the individual advisories.

Cisco Security Advisories · 27d agoAdvisoryCVE-2026-20030CVE-2026-20357CVE-2026-20358+8 CVEs

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.

CISA added seven vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog on September 2, 2026. The additions cover Sangoma Switchvox SQL injection (CVE-2026-9586), Kludex Starlette request smuggling (CVE-2026-48710), Kestra OS command injection (CVE-2026-49869), BerriAI LiteLLM (CVE-2026-59822) and JFrog Artifactory (CVE-2026-82329) authentication flaws, and SonicWall SMA1000 SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) vulnerabilities. Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets.

CISA Advisories · 14d agoExploit / PoC in the wildCVE-2026-9586CVE-2026-48710CVE-2026-49869+4 CVEs

Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection

Adversa AI's Cryptographic Context Injection bypasses AI guardrails using AES-encrypted payloads, enabling zero-click theft of Grok users' full chat histories.

Adversa AI researcher Rony Utevsky disclosed Cryptographic Context Injection, which hides instructions in AES-256-GCM ciphertext and tricks models into decrypting them inside their own code execution runtime, where the output is treated as trusted. Demonstrated against xAI's Grok, it stole user names, locations, subscription tiers, and full chat histories with zero clicks, and against Google's Gemini to bypass safety rules, generate incendiary-device instructions, and expose system instructions. Reported to xAI on June 3, 2026, the Grok attack remained reproducible as of August 19, 2026; the Gemini issue was not formally reported because Google's bug bounty excludes jailbreaks.

Security Affairs · 24d agoAI safety & security