CISA has issued a warning about a serious vulnerability in GitLab, which has a maximum severity CVSS score of 10.0. This flaw is currently being exploited by attackers, putting users at significant risk. Organizations using GitLab should take immediate action to safeguard their systems, as the vulnerability can lead to unauthorized access and potential data breaches. GitLab users need to ensure they are running the latest versions of the software to mitigate the threat. The urgency of this situation is underscored by the active exploitation of the flaw in the wild, emphasizing the need for prompt remediation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that hackers are actively exploiting a high-severity vulnerability in GitLab. This flaw could allow attackers to take control of affected systems, which poses significant risks for organizations using the platform. GitLab users must be vigilant, as the vulnerability is being targeted in the wild. It’s crucial for companies to apply any available patches or updates to secure their systems. Failure to address this issue could lead to unauthorized access and data breaches, impacting the integrity of their operations.
A group of hackers associated with a China-aligned espionage unit is taking advantage of a serious vulnerability in Tencent's Sogou Input Method for Windows, identified as CVE-2026-51990. This flaw allows attackers to install the GrayRabbit backdoor, which can give them unauthorized access to infected systems. The Sogou Input Method is widely used for typing Chinese characters, meaning a large number of users could be at risk. It's crucial for Tencent to address this vulnerability quickly to protect users from potential data breaches and espionage activities. Organizations using this software should prioritize patching and monitoring their systems for any unusual activity.
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
Security Affairs
Actively Exploited
GitLab disclosed a severe vulnerability, CVE-2026-85706, on September 10, 2026, which has a maximum severity score of 10.0. This path traversal flaw affects the repository commits API, allowing attackers to read files that should remain inaccessible without authentication. Within just 24 hours of the public announcement, malicious actors began exploiting this vulnerability, raising concerns about the security of GitLab instances. Organizations using GitLab should prioritize patching this vulnerability to protect sensitive information from unauthorized access, as attackers can exploit the flaw with a single crafted HTTP request. The rapid exploitation of this vulnerability underscores the need for timely updates and proactive security measures in software development environments.
Revolut has confirmed a significant data breach involving sensitive customer information, including KYC documents, selfies, and Bitcoin transaction histories. This incident occurred after fraudsters sent a fake email that appeared to be from a legitimate government agency, and it successfully passed the company's security checks. The breach was disclosed on September 12, 2026, raising concerns about the effectiveness of Revolut's verification processes. Customers affected by this breach may face risks such as identity theft and financial fraud. This incident serves as a reminder for companies to bolster their security measures against social engineering attacks that exploit legitimate-looking communications.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged five security vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS in its Known Exploited Vulnerabilities (KEV) catalog. These flaws have been reported as actively exploited, meaning attackers are taking advantage of them in the wild. One notable vulnerability, CVE-2026-42016, has a CVSS score of 8.1, indicating a significant risk due to incorrect authorization. Organizations using these products should take immediate action to address these vulnerabilities to prevent potential breaches or data loss. It’s crucial for users to stay updated on patches and implement necessary security measures to mitigate these risks.
Recent reports indicate that the BlueMoon exploit kit is being used by various espionage-focused threat actors to target vulnerabilities in Google Chrome and Windows. These attackers are taking advantage of zero-day vulnerabilities to deploy their exploits quickly and opportunistically. This poses a significant risk to users of these platforms, as the vulnerabilities are actively exploited, potentially allowing unauthorized access to sensitive information. Organizations and individuals using affected versions of Chrome and Windows should prioritize updating their systems to mitigate these risks. The situation underscores the continuing need for vigilance in cybersecurity practices, particularly for software that is widely used.
A serious vulnerability in GitLab has been identified, allowing attackers to exploit a path traversal flaw to read sensitive files on affected systems using only an HTTP request. This issue poses a significant risk to organizations that rely on GitLab for their software development and version control, as it could expose confidential information. Researchers are warning that this vulnerability is currently under active reconnaissance, meaning that attackers are likely probing systems to exploit this weakness. Companies using GitLab should assess their systems for exposure and implement necessary security measures immediately. The urgency of addressing this flaw cannot be understated, as failure to act could lead to data breaches and significant financial repercussions.
Check Point has addressed two serious vulnerabilities in their VPN gateways, both rated at 9.8 on the severity scale. These flaws could potentially allow attackers to exploit the systems, but so far, there are no reports of them being actively exploited in the wild. Users of Check Point's VPN products should take this matter seriously, as unpatched vulnerabilities can lead to unauthorized access and data breaches. The company has released patches to fix these issues, and it is crucial for affected users to apply them promptly to secure their systems against potential threats.
The article touches on several cybersecurity incidents and trends that are crucial for users and organizations to be aware of. One notable issue is the InjectEave attack, which seems to involve an exploit that allows attackers to bypass phishing detection systems using invisible Unicode characters. This could put many users at risk as they may unknowingly fall victim to phishing attempts. Additionally, a SIM swapper has been sentenced, highlighting the legal consequences of such cybercrimes, which can have devastating effects on individuals by allowing hackers to gain control of their phone numbers. Lastly, a $10 million bounty has been placed on an Iranian cyber official, indicating the high stakes involved in international cybersecurity. Overall, these stories reveal ongoing challenges in the cybersecurity landscape and the need for vigilance among users and organizations alike.
A threat actor has developed an exploit for vulnerabilities in PaperCut print management software, which they then used to breach 395 organizations across 48 countries. The attacker, believed to be Russian-speaking, created a private lab to test these vulnerabilities before deploying AI agents to automate the infiltration of these systems. As a result, at least 440 instances of PaperCut were compromised, raising concerns about the security of print management systems and the effectiveness of current defenses against automated attacks. This incident underscores the need for organizations using PaperCut to assess their security measures and patch any known vulnerabilities promptly.
Anthropic has reported that Russian hackers are targeting AI companies to exploit their technology for malicious purposes. In a recent incident, these attackers used the Claude AI model to automate their malware evasion techniques, which helped them evade detection while carrying out their operations. This breach highlights a concerning trend where cybercriminals are not only stealing intellectual property, like a pre-release Claude model, but also misusing advanced AI tools to enhance their cyberattacks. The implications are significant, as it raises questions about the security of AI systems and the potential for their misuse in future attacks. Companies in the tech sector need to bolster their defenses against such tactics to protect their infrastructure and intellectual property.
A Russian hacker group has harnessed artificial intelligence to exploit vulnerabilities in PaperCut software, impacting hundreds of organizations around the globe. These attacks involve creating and deploying sophisticated exploits that take advantage of specific flaws in the software. PaperCut is widely used for print management, making many businesses vulnerable to these AI-driven attacks. The implications are serious, as compromised systems can lead to unauthorized access to sensitive data and disruption of services. Companies using PaperCut should take immediate action to patch their systems and protect against these evolving threats.
Canonical has released Ubuntu 24.04.5 LTS, which includes important security updates and fixes for high-severity vulnerabilities. This update is significant because it is integrated into new installation media, meaning that users who install this version will have these security corrections included right from the start, reducing the number of updates needed post-installation. The release affects not only the standard desktop and server editions of Ubuntu but also nine other flavors such as Kubuntu, Xubuntu, and Ubuntu MATE. This is crucial for users and organizations looking to maintain a secure computing environment, as it helps protect against known vulnerabilities from the outset. Keeping systems updated is essential to defend against potential attacks that could exploit these weaknesses.
Indonesia is facing a cybersecurity threat from a group known as GoldFactory, which is using a technique involving the Android Work Profile feature to distribute the Gigabud Trojan. This malicious software targets Android banking apps, allowing attackers to steal sensitive financial information from users. Another group, Mantax Otax, is reportedly spreading malware independently. This situation raises concerns for Android users in Indonesia, particularly those who rely on banking apps for financial transactions. The ability of these groups to exploit legitimate features in Android underscores the need for heightened vigilance among users and better security measures from app developers.