F5 Labs Sensor Intel research, reported by BleepingComputer on 14 September 2026, describes a sustained August 2026 mass-scanning campaign against internet-exposed Vite development servers harvesting cloud credentials and IaC state. Activity is anchored on CVE-2026-39364, an unauthenticated server.fs.deny / file-read bypass via query parameters such as ?raw, ?import&raw, or ?import&url&inline on /@fs/ requests (GitHub advisory GHSA-v2wj-q39q-566r, published 6 April 2026). GitHub rates CVSS 4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N); F5 also cites CVSS 7.5 High for the same CVE. Affected: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4 (also vite-plus ≤0.1.15). Patched: 7.3.2, 8.0.5, and current patched lines on older branches per vendor. F5 honeypots saw ~807 session-grouped attacks and ~32,000 raw events in August, wordlisting .env files, AWS/Azure credential paths, Terraform/serverless state, and /proc environ; scanners also reused older Vite bypasses CVE-2025-30208, CVE-2025-31125 (CISA KEV), and CVE-2024-45811. Exposure usually comes from --host / server.host or Docker port maps (often 5173). Mitigations: upgrade; do not expose dev ports; block /@fs/; rotate secrets if an unpatched Vite was reachable. (sources: F5 Labs; GitHub advisory; BleepingComputer) Correction (28 Oct 2026): the card is now dated 11 September 2026, the date F5 Labs' report shows ("9/11/2026"). A 27 Oct correction wrongly said F5 Labs' report showed no date and dated the card 14 September from BleepingComputer. GitHub's April 2026 advisory covers the underlying flaw and does not set the date of this campaign report. (source: F5 Labs)
F5 Labs — Cloud Takeover: exposed Vite (CVE-2026-39364)
According to the CVE records published on 10 September 2026 UTC (11 September, 12:24 am Perth; HackerOne CNA), WebPros Plesk has two critical Backup Manager flaws. CVE-2026-68487 is a path traversal (CWE-36) in Plesk's Backup Manager that lets an authenticated customer write arbitrary files as root. CVE-2026-68488 is a time-of-check time-of-use (TOCTOU) race condition leading to insecure symlink following, which allows local privilege escalation to root through arbitrary file or directory ownership takeover. The records rate both CVSS 3.0 9.9 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and list Plesk 18.0.80.6 and earlier and 18.0.79.10 and earlier as affected; CISA's enrichment of the records lists no known exploitation. Plesk's own security articles, linked here, return 403 to Cyberstack. (source: CVE records) Correction (27 Oct 2026): removed details that came only from Plesk's articles and Cyber Security News, neither readable to Cyberstack: the Linux-only scope and the line that Plesk for Windows is not affected, the unsigned-backup-header and subscription-restore mechanics, the fixed versions 18.0.80.7 and 18.0.79.11, the no-interim-mitigation line and the shared-hosting priority note; the Cyber Security News link is removed. The card date has moved from 10 to 11 September 2026, the Perth date of the CVE records (10 September, 16:24 UTC; 11 September, 12:24 am Perth (AWST)). (source: CVE.org)
GitLab Critical Patch Release (10 September 2026) ships CE/EE 19.3.2, 19.2.6 and 19.1.8. CVE-2026-85706 is a Critical path traversal in the repository commits API (improper path confinement plus missing authentication enforcement) that can let an unauthenticated requester read arbitrary files from the GitLab server under certain conditions. GitLab CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Impacted: CE/EE from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Reported via HackerOne by s3ntago. Same release also fixes CVE-2026-87719 (EE GraphQL subscription serializer insecure deserialization; authenticated Duo Chat user; CVSS 9.9) plus further High issues. GitLab.com is patched; Dedicated customers need no action; self-managed must upgrade immediately. NEW 11 September 2026: watchTowr reports in-the-wild probes for CVE-2026-85706 within a day of disclosure (POST /api/v4/projects/{id}/repository/commits/ with file.path). Hunt those log lines. (sources: GitLab; watchTowr) UPDATE 11 September 2026: CISA added CVE-2026-85706 to KEV (dateAdded 2026-09-11; catalogVersion 2026.09.11). Self-managed instances that have not taken 19.3.2 / 19.2.6 / 19.1.8 should treat this as actively exploited and patch immediately. Correction (29 Oct 2026): removed SecurityWeek and BleepingComputer credits that were not linked, internal source labels and a duplicate GitLab link. (sources: GitLab; watchTowr)
Gen Digital Threat Labs (Alexandru-Cristian Bardaș, published 10 September 2026) details CVE-2026-51990 in Sogou Input Method for Windows: a one-click remote code execution chain combining unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF webview, and an outdated unsandboxed Chromium/CEF build (libcef.dll reported as CEF 80.1.16 / Chromium 80.0.3987.163). Gen observed UNC3569 exploiting the flaw in the wild via a crafted link to deploy the GRAYRABBIT backdoor. The issue was reported to Tencent on 9 April 2026 and fixed in Sogou Input Method version 16.3.0.3498 (released 21 April 2026): the patch validates URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved Sogou/Tencent domains — Gen and BleepingComputer (13 Sep 2026) still note the embedded Chromium remains outdated and unsandboxed. (sources: Gen Digital research; BleepingComputer) Correction (02 Nov 2026): removed The Hacker News as a source. (source: BleepingComputer)
Gen Digital — Gray Rabbits / one-click Sogou backdoor (10 Sep 2026)
Wiz Research (10 September 2026) documents in-the-wild chaining of CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between 15 August and 8 September 2026, often dropping a custom Rust C2 backdoor. CVE-2026-42018 is an authentication flaw that can return an internal anonymous-user token to an unauthenticated requester even when anonymous access is disabled. Alone it is not admin; chained with CVE-2026-42016 (token scope / privilege escalation) Wiz saw unauthenticated requests become admin-scoped tokens, with follow-on admin account creation, malicious Groovy plugins, and Rust backdoors. JFrog's advisory lists the patched versions for CVE-2026-42018 as 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 (rated High); for the chain, Wiz advises upgrading to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 or later, depending on the release branch. (sources: Wiz; JFrog) UPDATE 11 September 2026: CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities catalog (dateAdded 2026-09-11; catalogVersion 2026.09.11). Prioritise patching self-hosted Artifactory under BOD 26-04-style exploited-first triage; hunt anonymous/admin tokens, Groovy plugins, and Rust C2 per Wiz. Correction (26 Oct 2026): JFrog's own advisory lists 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched versions for CVE-2026-42018, and the JFrog CVE record agrees. The card had listed 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as still affected and given 7.117.28, 7.125.20, 7.133.29 and 7.146.9 as the fixed builds; that has been corrected. Wiz's separate upgrade advice for the two-flaw chain is kept and credited to Wiz. (source: JFrog security advisories) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Wiz; JFrog)
Wiz Research (10 September 2026) says CVE-2026-42016 is a privilege-escalation flaw from insufficient token scope enforcement: Artifactory validates signature/issuer but not intended scope, so a low-privileged token (including the anonymous token from CVE-2026-42018) can be escalated. Wiz observed the 42018→42016 chain in the wild 15 August–8 September 2026 alongside separate abuse of CVE-2026-82329; post-exploitation included persistent admin users, malicious Groovy plugins, and Rust C2 backdoors. Wiz lists CVE-2026-42016 impacted prior to 7.133.11 with remediated 7.133.11; for the overall campaign they urge upgrading to 7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20 or later and reviewing auth/admin activity. (sources: Wiz; JFrog advisories) UPDATE 11 September 2026: CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog (dateAdded 2026-09-11; catalogVersion 2026.09.11). Prioritise patching self-hosted Artifactory under BOD 26-04-style exploited-first triage; hunt anonymous/admin tokens, Groovy plugins, and Rust C2 per Wiz. Correction (02 Nov 2026): removed The Hacker News as a source. (source: Wiz; JFrog)
WatchGuard PSIRT CVE-2025-14733 is an out-of-bounds write in the Fireware OS iked process that can let a remote unauthenticated attacker execute code. It affects mobile-user VPN with IKEv2 and branch-office VPN using IKEv2 with a dynamic gateway peer; boxes that previously had those configs may still be vulnerable if a branch-office VPN to a static gateway peer remains. WatchGuard rates it CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and has observed in-the-wild exploitation, including config exfiltration variants. Fixed builds include Fireware OS 2025.1.4, 12.11.6, 12.5.15 and 12.3.1-b728352 (plus rotate locally stored secrets after confirmed compromise). CISA had already flagged active exploitation; BleepingComputer (10 September 2026) reports CISA now also confirms ransomware gangs are exploiting the same CVE. Shadowserver previously saw >115k exposed Fireboxes in December and nearly 9k still unpatched months later. (sources: WatchGuard PSIRT; BleepingComputer; CISA catalog for CVE-2025-14733)
iTnews (Juha Saarinen, 10 September 2026, 4:37 am Perth) reports that the Australian Signals Directorate has sent a critical alert about CVE-2026-75650, rated CVSS 10.0, an improper neutralisation of special elements used in a template engine in Adobe Commerce and Magento Open Source that leads to unauthenticated remote code execution. According to iTnews, ASD's ACSC said exploitation requires the /graphql endpoint to be exposed; the attack manipulates "styles" properties in a GraphQL request to slip PHP code past input sanitisation into a file the platform writes during normal operation, such as a payment failure report; and ACSC is aware of "a substantial number of potentially vulnerable instances" in Australia. iTnews says Sansec, which discovered and named the bug StyleSmuggler, said exploitation began on 4 September with the first confirmed compromise at 22:20 UTC, and published on 5 September before Adobe had issued a CVE or advisory; attackers had around three days before Adobe shipped a hotfix. ASD advises organisations to check for vulnerable versions, apply patches as soon as possible, and, if an MSP or IT provider manages the platform, confirm with them that it has been patched. According to iTnews, Adobe's guidance advises merchants to rotate the Magento encryption key and the credentials it protected, and warns that patching would not remove implants attackers placed during the window before the hotfix. CISA has added the bug to its Known Exploited Vulnerabilities catalog, iTnews reports. (source: iTnews) Correction (01 Nov 2026): Sansec's research page and Adobe's bulletin did not load for this desk, so the card now rests on iTnews alone: details only they or BleepingComputer gave (hotfix timings and tested versions, implant names and a second attacker's tooling) were removed, and the card is now dated 10 September 2026, the date of iTnews' report, instead of 5 September. (source: iTnews)
iTnews — ASD warns Aussie Adobe Commerce and Magento stores under attack (10 Sep 2026)
FortiGuard Threat Signal / Outbreak Alert (released 9 September 2026) tracks active attack attempts against CVE-2026-58138 in Orkes Conductor / conductor-oss: unauthenticated remote code execution via GraalVM script evaluators. According to the CVE record, attackers submit inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint before authentication, and evaluators configured with HostAccess.ALL or allowAllAccess(true) through the INLINE, LAMBDA, DO_WHILE and SWITCH task types then run arbitrary system commands; FortiGuard says the commands run with the privileges of the Conductor process. The CVE record gives the affected range as Conductor 3.21.21 before 3.30.2, and FortiGuard says 3.30.2 or later addresses the flaw. Public proof-of-concept code exists, including a working exploit targeting Conductor 3.23.0, and exploit material has been published on Exploit-DB (FortiGuard). FortiGuard telemetry: 1,290 IPS blocks in 24 hours (up 132%) and 6,696 over seven days; top observed sources Germany, Hong Kong, Indonesia, the UAE and India. The CVE record rates it CVSS 3.1 9.8 and CVSS 4.0 9.3. No Australian exploitation reported. (sources: FortiGuard threat signal; the CVE record) Correction (26 Oct 2026): the affected range and CVSS scores are now credited to the CVE record, and a SecurityWeek source this Cyberstack does not use has been removed, along with details no linked source supports: that Conductor often runs as root, that open-source Conductor leaves the workflow API unauthenticated by default, that 3.30.0 and 3.30.1 carried an incomplete partial blocklist, and an Empirical Security report of exploitation from about 21 August. (source: FortiGuard; CVE record)
FortiGuard — Orkes Conductor evaluator RCE Threat Signal (CVE-2026-58138)
Palo Alto Networks PSIRT CVE-2026-0307 (published 9 September 2026, updated 23 September 2026): multiple local privilege-escalation vulnerabilities in the GlobalProtect app (CWE-426 untrusted search path) let a local low-privileged user reach NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux, then run arbitrary commands with administrative privileges. iOS, Android and ChromeOS are not impacted. No special configuration required. Vendor CVSS-BT 5.9 MEDIUM (CVSS 4.0); CVSS-B 8.5; exploit maturity UNREPORTED; urgency MODERATE. Palo Alto Networks says it is not aware of malicious exploitation. 23 Sep advisory refresh: GlobalProtect 6.3.3-h15 fixed builds for Linux/macOS/Windows all show ETA 09/28 (Linux ETA previously ~17 Sep on the 16 Sep card); 6.2.8-h14 Win/macOS ETA 09/28; 6.0.15 Linux/macOS ETA 09/28, Windows ETA 10/29. NGFW customers must also upgrade PAN-OS / Prisma Access — Solution table now cites e.g. PAN-OS 12.2.3; 12.1.10 / 12.1.7-h6 / 12.1.4-h11; and listed 11.2/11.1/10.2 hotfixes (hotfix minor revs bumped vs 16 Sep card). Prisma Access via scheduled maintenance or on-demand Support upgrade. (source: Palo Alto Networks PSIRT) UPDATE 30 Sep–3 Oct 2026 (added 04:00 Perth 3 Oct): Palo Alto PSIRT advisory refresh dated 30 September 2026 slips GlobalProtect fixed-build ETAs — 6.3.3-h15 (Linux/macOS/Windows) and 6.2.8-h14 (macOS/Windows) now show ETA 10/06 (was 09/28 on the 23 Sep card); 6.0.15 remains ETA 10/29 across Linux/macOS/Windows. Severity still CVSS-BT 5.9 MEDIUM / CVSS-B 8.5; exploit maturity UNREPORTED; vendor still not aware of malicious exploitation. NGFW/Prisma Access PAN-OS upgrade requirement unchanged. (source: Palo Alto PSIRT CVE-2026-0307) UPDATE 17 Oct 2026: Palo Alto Networks revised the advisory on 17 October 2026 (timeline: 'Update versions and add build numbers for 6.2.8 and 6.3.3'), and the Solution table no longer shows any ETA, so the fixed GlobalProtect builds are now listed as available. The fix target moved on Windows and macOS: 6.3.0 through 6.3.3-h15 is affected and the fix is 6.3.3-h16 (build 6.3.3-1199) or later, and 6.2.0 through 6.2.8-h14 is affected with the fix in 6.2.8-h15 (build 6.2.8-1084) or later. Anyone who installed 6.3.3-h15 on Windows or macOS expecting it to be the fix still needs to move to 6.3.3-h16. On Linux, 6.2.0 through 6.3.3-h14 is fixed in 6.3.3-h15 (build 6.3.3-c63). On all three desktop platforms, 6.0.0 through 6.0.14 is fixed in 6.0.15. iOS, Android and ChromeOS still need no action. Severity is unchanged (CVSS-B 8.5, CVSS-BT 5.9, exploit maturity unreported), there is no workaround, and Palo Alto Networks is still not aware of malicious exploitation. The PAN-OS and Prisma Access rows of the Solution table are unchanged.
Palo Alto Networks PSIRT — CVE-2026-0307 (updated 17 Oct 2026)
UPDATE 23–24 Sep 2026: Check Point blog advisory and BleepingComputer confirm active exploitation of CVE-2026-85102 (pre-auth RCE in Security Gateway / Spark VPN certificate handling) beginning 12 September 2026 against Spark customers (anonymized VPN/proxy infra; observed cert subjects include CN=vpn / CN=vpn-user / CN=vpnuser under OU=users,O=global — list not exhaustive). CISA added CVE-2026-85102 to KEV on 22 Sep 2026 (due 25 Sep). Vendor disclosed + shipped fixes 9 Sep with no then-known exploitation; Dutch NCSC 12 Sep had assessed exploitation as imminent. Remediation: LivePatch Take 26 on supported R81.20/R82/R82.10 gateways, or Jumbo R81.20 Take 166 / R82 Take 126 / R82.10 Take 44 / R81.10 Take 190 or later; Spark R82.00.10 Build 2325 or R81.10.17 Build 4968+. Same advisory wave also covers Management CVE-2026-93616 (separate card; KEV 22 Sep). (sources: Check Point sk1000117; BleepingComputer)
Check Point sk1000117 — CVE-2026-85102 VPN certificate RCE
CERT/CC and BleepingComputer (9 September 2026) warn that Skullcandy Dime 3 earbuds (model S2DCW) on firmware 1.0.0.28 accept Bluetooth pairing from nearby unpaired devices without user interaction, PIN, or case access. Issue tracked as CVE-2025-20701 in the Airoha Bluetooth Audio SDK. Skullcandy says fixed in firmware 1.0.0.30, but end users have no supported update path via the Skullcandy app. Nearby attacker can hijack the audio link. Broader Airoha-based headset class affected per ERNW/TROOPERS research. (source: BleepingComputer citing CERT/CC)
