45
30
35
NextGen Healthcare Mirth Connect
CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.
CISA released advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: SQL injection CVE-2026-82583 (CVSS 8.3), XXE CVE-2026-78224 (CVSS 8.2), and XXE CVE-2026-82578 (CVSS 7.5). Exploitation could expose stored credentials for connected systems, enable arbitrary file writes, and cause denial-of-service conditions. No public exploitation has been reported; the product is deployed worldwide in the Healthcare and Public Health sector.
32
WordPress Security Plugins: How to Choose the Right One
Sucuri's guide breaks WordPress security plugins into hardening, malware scanning, integrity monitoring, and filtering types, and explains how to evaluate and layer them.
The Sucuri guide explains that WordPress security plugins bundle five capabilities - hardening, malware detection, integrity monitoring, activity logging, and application-level filtering - and that plugins run only after WordPress loads, unlike server-level firewalls. It lists leading causes of compromise: outdated plugins and themes, weak or reused credentials, nulled premium software, insecure configuration, and shared-hosting cross-contamination. It concludes with evaluation criteria and a post-installation security checklist for owners without dedicated security teams.
16
47
60
60
55
60
30
Vulnerability Spotlight: Multiple vulnerabilities in AT&T Labs’ Xmill utility
60
30
45
60
30
45
30
55
60
30
60
42
35
47
35
60
30
45
30
60
Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root
Palo Alto Networks fixed CVE-2026-0310, a CVSS 9.2 unauthenticated PAN-OS buffer overflow enabling root code execution on PA-Series firewalls.
Palo Alto Networks published an advisory on September 9, 2026 for CVE-2026-0310, a CWE-787 out-of-bounds write in PAN-OS XML processing with a CVSS v4.0 base score of 9.2, affecting the management and dataplane interfaces. Unauthenticated attackers could execute arbitrary code as root on PA-Series hardware firewalls, while VM-Series faces denial-of-service impact and Prisma Access and Cloud NGFW have reduced, authenticated exposure. Affected releases include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 before fixed maintenance releases such as 12.2.3, 12.1.4-h10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround is available. Palo Alto is not aware of malicious exploitation but classifies remediation urgency as highest.
78
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
82
Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.
Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.
72
When AI Remembers Too Much
Unit 42 PoC shows indirect prompt injection can poison Amazon Bedrock Agent long-term memory, enabling silent exfiltration of conversation history across future sessions.
Palo Alto Networks Unit 42 published a proof of concept showing that indirect prompt injection can silently poison the long-term memory of Amazon Bedrock Agents when the memory feature is enabled. Malicious content on a webpage or document manipulates the agent's session summarization process, so injected instructions persist across sessions and are added to later orchestration prompts, silently exfiltrating user conversation history. The issue is not a vulnerability in the Amazon Bedrock platform but an illustration of the broader unsolved LLM prompt-injection challenge. Amazon reviewed the research and stated that Bedrock Guardrails with the prompt-attack policy provides effective mitigation.
55
60
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
60
55
60
42