VulnHub

Helpfeel, the company behind Gyazo, has reported a significant data breach affecting 23 million user records. The breach occurred when an attacker exploited a vulnerability in Gyazo's image upload server, allowing unauthorized access to sensitive user information. This incident raises serious concerns about the security of user data on platforms that store images and personal information. Affected users should be vigilant and consider changing their passwords and monitoring their accounts for unusual activity. The breach underscores the need for companies to regularly assess and patch vulnerabilities in their systems to protect user data.

Check Point has reported a serious vulnerability affecting its Security Management and Log Servers. This flaw could allow attackers to execute code remotely with root privileges, which poses a significant risk to users' systems. Organizations using these products should take immediate action to protect their environments. The potential for unauthorized access and control over sensitive data makes this a pressing concern for businesses relying on Check Point's security solutions. Users are advised to apply the necessary patches as soon as they become available to mitigate this risk.

A serious vulnerability has been discovered in Check Point's Security Management and Log Servers, which could let attackers bypass authentication and execute code as root remotely. This flaw affects systems that manage firewall policies and administrator access, potentially putting sensitive data and network security at risk. Check Point has addressed the issue with a fix available through its LivePatch update channel. While the company states there is no evidence that this vulnerability has been exploited in the wild, it is crucial for users to apply the patch promptly to safeguard their systems. This incident serves as a reminder of the importance of maintaining up-to-date security measures in network management.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are currently being exploited by attackers. The vulnerabilities include CVE-2026-76460, which affects Cisco Identity Services Engine due to incorrect use of privileged APIs, and CVE-2026-87886, related to incorrect default permissions in Acronis Backup. These vulnerabilities pose significant risks, especially for federal agencies, which are required to prioritize their remediation under CISA's Binding Operational Directive 26-04. While this directive applies specifically to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based practices to handle vulnerabilities effectively. Organizations are urged to check for potential compromises before applying patches to ensure their systems remain secure.

Google has rolled out its September 2026 security patches to fix 110 vulnerabilities across its Pixel devices, including a significant zero-day flaw that has been actively exploited in targeted attacks. This zero-day vulnerability poses a risk to users, as it can be exploited by attackers to gain unauthorized access to devices. The timely release of these patches is crucial, as it helps protect users from potential data breaches and other malicious activities. Pixel device owners are encouraged to update their devices promptly to mitigate the risk associated with this flaw and the other vulnerabilities addressed in the patch. Staying up to date with security updates is essential for maintaining device security.

A Thai broadband provider has fallen victim to a cyber attack that exploited a vulnerability in Fortinet's security products. The attackers used various scripts for reconnaissance and probing, along with brute-force tools and methods to escalate privileges within the network. This breach raises concerns about the security of internet service providers and their ability to protect customer data. As the incident unfolds, it serves as a reminder for organizations to patch known vulnerabilities promptly and strengthen their defenses against such tactics. Users of the affected service may need to monitor their accounts for any unusual activity as a precaution.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that ransomware gangs are actively exploiting a serious vulnerability in VMware vCenter, which was patched back in July. This flaw allows attackers to execute remote code, posing a significant risk to organizations using affected versions of the software. Companies that have not yet applied the security patch are particularly vulnerable to these attacks. The involvement of ransomware groups in exploiting this vulnerability raises alarms about potential data breaches and financial losses. Organizations are urged to prioritize the application of the necessary updates to safeguard their systems against these ongoing attacks.

A reflected cross-site scripting (XSS) vulnerability has been identified in the authentication redirect flow of Siemens Teamcenter, allowing attackers to inject malicious JavaScript into the sessions of authenticated users. This exploitation could enable unauthorized actions or data access within the affected user's Teamcenter session. The vulnerability, tracked as CVE-2026-58113, affects several versions of Teamcenter, including V2412, V2506, V2512, and V2606, prior to specific patch levels. Siemens recommends users update to the latest versions to mitigate this risk. It's crucial for organizations using Teamcenter to act quickly to protect their systems from potential exploitation.

Siemens has identified multiple vulnerabilities affecting the Reyrolle 7SR5 device, specifically versions prior to 2.70. These vulnerabilities include issues like integer overflow, improper input validation, and insufficient authentication mechanisms, which could allow attackers to exploit the system in various ways, including unauthorized access and denial of service. Siemens urges users to upgrade to version 2.70 or later to mitigate these risks. The vulnerabilities have a high severity rating, with some classified as critical, emphasizing the potential impact on critical infrastructure sectors, particularly in energy. Users worldwide who rely on this device should take immediate action to secure their systems.

Wärtsilä FOS-Onboard, specifically version 5.07.0923.01, has been found to have critical vulnerabilities that could allow attackers to deliver unauthorized updates, execute code, or extract credentials. These vulnerabilities stem from hardcoded cryptographic keys in two components: the deployer-ng Update Controller and the robot testing framework. If exploited, these weaknesses could enable an attacker to impersonate a privileged client. Wärtsilä has stated that while these vulnerabilities are serious, they are not exploitable if the product is installed correctly. A security patch is available for users, who are advised to contact Wärtsilä for its installation. This situation raises concerns for critical infrastructure sectors, particularly in transportation systems worldwide, and emphasizes the need for organizations to implement strong cybersecurity measures.

A human attacker exploited a remote code execution (RCE) vulnerability in Marimo, gaining access to an SSH bastion in just eight seconds. This rapid exploitation raises significant concerns about the security of systems using this technology, as it demonstrates how quickly attackers can breach defenses. The incident underscores the necessity for organizations to promptly patch vulnerabilities and enhance their security protocols. As the threat landscape continues to evolve, companies must remain vigilant and proactive in addressing potential weaknesses in their systems. This incident serves as a stark reminder of the importance of timely updates and security measures.

The Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating they are being actively exploited. The vulnerabilities include CVE-2026-42016 and CVE-2026-42018, both affecting JFrog Artifactory, and CVE-2026-84869, which impacts ConnectWise ScreenConnect. These vulnerabilities can lead to unauthorized access and privilege escalation, posing significant risks to federal agencies and other organizations that use these products. CISA urges federal agencies to prioritize addressing these vulnerabilities rapidly as part of their security update strategies, while also encouraging all organizations to adopt similar practices to manage their exposure to cyber threats effectively.

CISA has added a new vulnerability, identified as CVE-2026-85706, to its Known Exploited Vulnerabilities Catalog. This vulnerability affects both the GitLab Community Edition and the GitLab Enterprise Edition and allows for path traversal, which can be exploited by attackers to gain unauthorized access to sensitive files. Federal agencies are required to prioritize addressing this high-risk vulnerability under the Binding Operational Directive 26-04, which emphasizes rapid remediation of vulnerabilities that could allow total control over affected systems. Although this directive applies specifically to federal agencies, CISA encourages all organizations to adopt similar risk-based strategies to manage vulnerabilities. Organizations aware of other exploited vulnerabilities not listed in the catalog can submit them for potential inclusion.

A threat actor has developed an exploit for vulnerabilities in PaperCut print management software, which they then used to breach 395 organizations across 48 countries. The attacker, believed to be Russian-speaking, created a private lab to test these vulnerabilities before deploying AI agents to automate the infiltration of these systems. As a result, at least 440 instances of PaperCut were compromised, raising concerns about the security of print management systems and the effectiveness of current defenses against automated attacks. This incident underscores the need for organizations using PaperCut to assess their security measures and patch any known vulnerabilities promptly.