VulnHub

A serious vulnerability in Roundcube Webmail, which was patched back in May, is now being actively exploited by attackers. The Canadian Centre for Cyber Security has issued warnings about this flaw, emphasizing the urgency for users to secure their systems. The vulnerability allows for code injection attacks, which can enable hackers to execute malicious commands on affected servers. Users of Roundcube Webmail need to ensure they have applied the latest updates to protect against this exploitation. This incident highlights the importance of timely updates and vigilance in maintaining secure webmail services.

A recently discovered prompt-injection vulnerability has impacted the AI application Manus, which is valued at $4 billion. This issue arises from the app's reliance on external data interpretation, making it susceptible to attacks if proper security measures aren't in place. Researchers are warning that without stringent security filters, attackers could exploit this flaw to manipulate the app's behavior. The incident serves as a reminder for companies using AI technologies to prioritize security and implement safeguards against such vulnerabilities. As AI continues to integrate into various sectors, the need for robust security protocols becomes increasingly critical.

A serious vulnerability in WordPress, identified as CVE-2026-87902, has been exploited by attackers within hours of its public disclosure. This flaw, which has a CVSS score of 9.2, allows unauthenticated users to execute remote code by manipulating the get_page_template() function to include a local PHP file chosen by the attacker. This means that websites using WordPress could be at risk, particularly those that do not have the latest security updates. The rapid exploitation of this vulnerability highlights the urgent need for website administrators to assess their systems and apply necessary patches to prevent unauthorized access. Ignoring this vulnerability could lead to significant data breaches or further exploitation of compromised sites.

The FBI and CISA have issued a fact sheet aimed at critical infrastructure operators to address the risks associated with working with third-party industrial control system (ICS) integrators. These integrators can inadvertently introduce security vulnerabilities, particularly if they are given excessive access to systems or if they operate outside U.S. jurisdiction. A recent incident involved foreign cyber actors gaining access to a U.S. industrial automation company, potentially compromising sensitive customer data and schematics. The agencies emphasize the importance of applying the principle of least privilege and conducting thorough risk assessments when engaging third-party services. Operators are encouraged to implement strict cybersecurity measures in contracts and maintain independent operational capabilities to mitigate risks in case of integrator compromise.

Arista Networks has issued an urgent warning about a critical security flaw in its Virtual Cloud Optimizer (VCO) software that allows remote attackers to access sensitive internal features. This vulnerability poses a significant risk as it could enable unauthorized users to exploit internal functionalities, potentially leading to serious breaches. Companies using VCO are advised to act quickly to patch this vulnerability to prevent exploitation. The situation is serious, as the flaw is already being actively exploited in the wild, increasing the urgency for affected users to secure their systems. Prompt remediation is crucial to safeguard sensitive data and maintain operational integrity.

A Chinese hacking group known as UTA0565 has been exploiting a recently discovered exploit chain affecting Google Chrome and Microsoft Windows. The attacks, which took place on September 3 and 4, 2026, take advantage of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one in Windows (CVE-2026-85880). By using fake websites, the attackers are able to deploy a malware variant named CLEANGULP. This is concerning as it indicates a coordinated effort to target users of these widely-used platforms, potentially compromising sensitive information and system integrity. Users of both Chrome and Windows should be vigilant and consider updating their systems promptly to mitigate the risks associated with these vulnerabilities.

A group of Chinese-speaking hackers has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to access sensitive information. They managed to breach 996 devices and extract over 18,500 records from backend databases. This incident raises concerns for organizations using these products, as it highlights the risks associated with unpatched vulnerabilities. The targeted systems could include government or corporate networks, which makes the theft of data particularly alarming. Users and administrators of these platforms should prioritize security updates to mitigate the risk of similar attacks in the future.

Check Point Software has issued urgent hotfixes to fix a serious vulnerability in its Security Management Server. This flaw allows attackers to execute arbitrary scripts, which could potentially lead to unauthorized access and control of affected systems. The vulnerability has been actively exploited in the wild, putting various organizations at risk. Users of the Security Management Server need to apply the latest patches immediately to protect their infrastructure. This incident emphasizes the importance of timely updates in cybersecurity practices, especially for critical management systems.

D-Link has issued a warning about a serious vulnerability, identified as CVE-2026-86296, that affects its legacy DIR-822A dual-band Wi-Fi routers. This zero-day bug has been assigned the highest severity rating, and there is currently no patch available to fix the issue. With proof-of-concept exploit code publicly accessible, attackers could potentially exploit this vulnerability to compromise these devices. Users of the DIR-822A routers should take immediate precautions to secure their networks, as the lack of a fix leaves them vulnerable to attacks. D-Link's warning emphasizes the need for users to remain vigilant and consider upgrading to more secure router models.

The RatHat Android Trojan is a new piece of malware that uses artificial intelligence to enhance its ability to navigate and control infected devices in real-time. This makes it more adaptable and harder to detect by traditional security measures. Users of Android devices are particularly at risk, as the malware can exploit vulnerabilities to take control of their devices. The implications of this are significant, as it could lead to unauthorized access to personal information, financial data, and other sensitive content. As the malware continues to evolve, it raises concerns about the effectiveness of current security protocols against AI-driven threats.

CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, specifically targeting the Zyxel GS1900 Series Switches. This vulnerability, identified as CVE-2026-7273, is a stack-based buffer overflow that attackers can exploit to gain complete control over affected devices. The addition to the catalog signals an urgent need for federal agencies, as outlined in Binding Operational Directive 26-04, to prioritize the rapid patching of high-risk vulnerabilities. While the directive specifically applies to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based management strategies. Organizations are urged to monitor their systems for potential exploitation and apply necessary updates promptly to mitigate risks.