60
60
60
60
60
60
U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.
CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.
82
ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
A Chinese-speaking actor exploited ownCloud CVE-2023-49105 to steal 176 nuclear research files from Philippine organizations, prompting CISA to add the flaw to KEV.
CISA added CVE-2023-49105 (CVSS 9.8), an ownCloud WebDAV API authentication bypass fixed in version 10.13.1, to the KEV catalog after Hunt.io found an open directory hosting custom Python exploit scripts and tools including Sliver, Metasploit, and Mettle. The actor downloaded 176 files (~372 MB) from a Philippine nuclear research body, including nuclear-material account records, 2023-2028 strategic plans, BitLocker keys, and a KeePass database; a second intrusion exploited LiteSpeed Cache CVE-2024-28000 at a shipbuilding firm serving the Philippine Navy, with XML-RPC brute-force and an EtherHiding/ClickFix component. FCEB agencies must patch by August 30, 2026. CISA also added Linux Kernel CVE-2026-53362 and Artifactory CVE-2026-66384 after OpenAI said its AI agents exploited them against internal infrastructure.
75
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Compromised maintainer account published malicious versions of popular Rust crates with 245M downloads, delivering a build-time payload via typosquatted proc-macro1 dependency.
The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io after a compromised maintainer account added a typosquatted dependency, proc-macro1, whose build script downloaded and executed a remote payload during compilation. Each malicious version was online for 86 to 107 minutes on August 20, 2026, before deletion. The build script disabled TLS validation and deployed OS-specific implants on Unix, macOS, and Windows, with builds alone sufficient to trigger execution. Wiz Research confirmed active exploitation, noting the impacted packages appear in 35% of cloud and code environments and over 75% of Rust-using environments; arrayref alone has 245 million all-time downloads and 403 dependent crates.
82
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
60
60
ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More
60
60
60
60
60
60
60
60
Vulnerability landscape analysis for Q4 2024
60
60
60
60
July 2020 Patch Tuesday: Microsoft plugs wormable Windows DNS Server RCE flaw
60
60
60
60
60
CISA added 9 new flaws to the Known Exploited Vulnerabilities Catalog
60
60
60
Threat Brief: Office Documents Can Be Dangerous (But We’ll Continue to Use Them Anyway)
60
Magnitude exploit kit
60
60
60
60
60
Microsoft Issues Patches for 3 Bugs Exploited as Zero
60