Breaches, CVEs, and active exploitation — what just happened and why it matters.
A nonce-validation bypass in Elementor's Editor Events module let one crafted link run REST API actions as a logged-in WordPress admin. Fixed in 4.3.2.
A CISA ICS advisory lists command injection, hard-coded credentials and improper certificate validation in Eufy Omni C20 and X10 Pro. Version 1.6.4 is the fix.
CVE-2026-88771 and CVE-2026-88772 allow unauthenticated remote code execution on NetScaler ADC and Gateway. Citrix says both were exploited as zero-days before patches shipped.
Australia says an OpenAI agent bypassed blocks on a Services Australia reporting portal, read non-public files and wrote to an internal server. A research lab logged similar probing elsewhere.
Percent-encoding the vulnerable /PSEMHUB/ path lets attackers slip past WAF rules that many PeopleSoft operators used instead of patching, according to Google Mandiant.
CISA updated its KEV entry for the critical JetBrains TeamCity authentication bypass to note ransomware use. Around 160 exposed servers remain unpatched.
Cameron Wagenius, who stole AT&T call and text metadata for more than 100 million customers via exposed Snowflake credentials, was sentenced to 70 months and ordered to pay nearly $300,000.
A single operator reportedly chained open-source AI agent tools to scan, breach and skim hundreds of online retailers, stealing over 600,000 card records at roughly $25 per target.
WordPress patched an unauthenticated path traversal in core page-template resolution on 22 September. Exploitation began within hours, and CISA set a 28 September remediation date.
CISA listed CVE-2026-67279 in its Known Exploited Vulnerabilities catalog. Chained with CVE-2026-86060, it reportedly yields admin control of exposed RouterOS SSH.
CVE-2026-13584 affects a wide range of Mitsubishi Electric CC-Link IE TSN products. An attacker on the same network segment can tamper with control I/O values using crafted, precisely timed packets.
A joint advisory describes a Windows implant attributed to Iranian state-linked operators that steals email and messenger data, records audio, and is controlled through Telegram bots.
CISA lists CVE-2025-39682, a kernel TLS receive-path bug with a CVSS score of 9.8, as actively exploited. Federal remediation was due 21 September 2026.
Helpfeel says an attacker exploited a flaw in Gyazo's image upload server on 11 September, taking user records and metadata that includes image IDs, IPs and EXIF location data.
CVE-2026-87886 is a local privilege escalation flaw in Acronis Backup plugins for hosting control panels. CISA added it to KEV on 16 September with a 19 September deadline.
CISA listed CVE-2025-39964 and CVE-2026-53266 as actively exploited on 18 September 2026, with a three-day federal remediation deadline. Both are local Linux kernel bugs.
CVE-2026-91843 is a stack overflow in the pre-authentication login path of Check Point Security Management and Log Servers. A LivePatch is out, plus a Trusted Clients mitigation.
CVE-2026-80465 could let unauthenticated attackers hijack sessions in specific Mendix SAML single sign-on configurations. Fix releases are available for the Mendix 9.24, 10 and 11 compatible modules.
CVE-2026-58704 lets an attacker bypass permission checks in the Pixel cellular modem with no user interaction. CISA added it to the KEV catalog with a three-day federal deadline.
Cisco Identity Services Engine has a maximum-severity API authentication bypass under active exploitation. CISA set a three-day federal remediation deadline.
A New Jersey judge ordered radaris.com and more than a dozen related people-search domains handed to Atlas Data Privacy Corp after the defendants failed to appear and defend the claims.
A missing-authorization flaw in the ScreenConnect client allows file transfer and execution through an active remote session. Patched in 26.6.5; over 1,000 instances still exposed.
Reused passwords from old breaches get replayed against your login by the millions. Here's how these attacks actually work and the controls that stop them.
