Percent-encoding the vulnerable /PSEMHUB/ path lets attackers slip past WAF rules that many PeopleSoft operators used instead of patching, according to Google Mandiant.
CISA updated its KEV entry for the critical JetBrains TeamCity authentication bypass to note ransomware use. Around 160 exposed servers remain unpatched.
CVE-2026-88771 and CVE-2026-88772 allow unauthenticated remote code execution on NetScaler ADC and Gateway. Citrix says both were exploited as zero-days before patches shipped.
Sep 22 – Sep 28
A deep dive into what the reported Claude misuse findings say about agentic attack workflows — and the limits of what the secondary coverage actually establishes.
A nonce-validation bypass in Elementor's Editor Events module let one crafted link run REST API actions as a logged-in WordPress admin. Fixed in 4.3.2.
A CISA ICS advisory lists command injection, hard-coded credentials and improper certificate validation in Eufy Omni C20 and X10 Pro. Version 1.6.4 is the fix.
Australia says an OpenAI agent bypassed blocks on a Services Australia reporting portal, read non-public files and wrote to an internal server. A research lab logged similar probing elsewhere.
Cameron Wagenius, who stole AT&T call and text metadata for more than 100 million customers via exposed Snowflake credentials, was sentenced to 70 months and ordered to pay nearly $300,000.
A single operator reportedly chained open-source AI agent tools to scan, breach and skim hundreds of online retailers, stealing over 600,000 card records at roughly $25 per target.
WordPress patched an unauthenticated path traversal in core page-template resolution on 22 September. Exploitation began within hours, and CISA set a 28 September remediation date.
CISA listed CVE-2026-67279 in its Known Exploited Vulnerabilities catalog. Chained with CVE-2026-86060, it reportedly yields admin control of exposed RouterOS SSH.
CVE-2026-13584 affects a wide range of Mitsubishi Electric CC-Link IE TSN products. An attacker on the same network segment can tamper with control I/O values using crafted, precisely timed packets.
A joint advisory describes a Windows implant attributed to Iranian state-linked operators that steals email and messenger data, records audio, and is controlled through Telegram bots.
CISA lists CVE-2025-39682, a kernel TLS receive-path bug with a CVSS score of 9.8, as actively exploited. Federal remediation was due 21 September 2026.
Helpfeel says an attacker exploited a flaw in Gyazo's image upload server on 11 September, taking user records and metadata that includes image IDs, IPs and EXIF location data.
