Two zero-day vulnerabilities in the open-source Zammad ticketing system were exploited in an AI-powered attack against the Dutch Institute for Vulnerability Disclosure (DIVD). The flaws allowed attackers to hijack sessions, execute remote code, and escalate privileges to root. The attack led to data exfiltration within DIVD's environment, though network segmentation limited further compromise. Affected versions include Zammad 6.3.0 to 6.5.4, with later versions 7.0.0 to 7.1.3 containing the defect but not exploitable due to environment conditions. DIVD recommends upgrading to Zammad version 7 or taking the system offline. A verification script for detecting compromise is available.
CISA has issued a warning about a critical vulnerability in MikroTik RouterOS that allows for remote code execution or denial-of-service conditions without authentication. This flaw poses a significant risk to affected systems if exploited. No specific affected versions or patch information are currently provided.
Google Threat Intelligence Group (GTIG) reports that AI is significantly accelerating the discovery and exploitation of software vulnerabilities, with AI-discovered flaws more likely to enable remote code execution. The volume of disclosed vulnerabilities doubled in 2026, with a notable increase in high-risk and exploited vulnerabilities. AI-discovered vulnerabilities tend to have higher impact, with 50% enabling remote code execution compared to 26% for non-AI discoveries. Exploitation of known vulnerabilities (n-days) is rising, possibly due to AI-assisted automation in weaponizing these flaws. AI-related vulnerabilities in AI systems themselves are also increasing, though zero-day exploitation in AI infrastructure has not yet been observed. The trend suggests continued growth in vulnerability discovery and exploitation driven by AI capabilities.
TeamViewer has disclosed multiple high-severity vulnerabilities affecting its Full Client and Host software on Windows, Linux, and macOS. The most critical flaw is a remote session access control bypass (CVE-2026-92370) that could allow unauthorized remote code execution. Additional issues include path traversal, heap-based buffer overflow, TOCTOU race condition, and improper path validation vulnerabilities that may enable local attackers to execute code remotely or escalate privileges. TeamViewer urges users to update to version 15.82, which addresses these flaws. No evidence of active exploitation or public exploit code is currently known.
Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]
CVE-2026-96883 is a type confusion vulnerability in the pgcollection extension for PostgreSQL. It arises from incorrect type coercion logic when an authenticated user requests a stored icollection value as a type incompatible with its actual stored type. This flaw can cause the PostgreSQL backend to crash or allow arbitrary code execution. The vulnerability affects pgcollection versions 2.0.0 through 2.1.1. It has been fixed in version 2.1.2. Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL are not impacted as they ship version 1.1.1, which does not contain this issue. No workarounds are available.
ViewSonic vCast software, used in ViewBoard smartboards, contains multiple unauthenticated vulnerabilities that can be chained by a remote attacker with network access to fully compromise the device. These include screen content exfiltration via unauthenticated API endpoints, unprivileged APK installation through an unauthenticated download endpoint, and arbitrary input injection via exposed network services. No vendor fix is currently available. Interim mitigations include network segmentation and monitoring.
CVE-2026-87902 is a critical unauthenticated remote code execution vulnerability in WordPress versions 4.7.0 through 7.1.1. It allows attackers to include arbitrary PHP files outside the active theme directories, potentially leading to code execution. The flaw was patched in WordPress 7.1.2 and backported to supported branches down to 4.7. Exploitation attempts began shortly after the patch release, with attackers writing malicious PHP files to disk to execute shell commands. Immediate updating to version 7.1.2 or later is strongly advised.
A critical remote code execution vulnerability (CVE-2026-94127) affects F5 BIG-IP Access Policy Manager (APM) when configured as an OAuth Authorization Server. Unauthenticated attackers can exploit this zero-day flaw by sending malicious traffic to vulnerable BIG-IP appliances. The vulnerability impacts specific versions of BIG-IP APM and has been actively exploited in the wild. F5 has released hotfixes addressing the issue, and CISA has added it to its Known Exploited Vulnerabilities list, urging rapid patching.
WordPress patched a vulnerability called Click2Shell that allowed attackers to automatically install and preview inactive themes via specially crafted URLs. This flaw could lead to remote code execution (RCE) by abusing how theme slugs are interpreted differently by the themes API and JavaScript in an administrator's browser. Attackers could force installation of attacker-selected themes fetched from the official WordPress.org catalog without administrator consent. Some inactive third-party themes could be exploited for PHP code execution during the Customizer preview, enabling attackers to execute code under the WordPress server account without needing an attacker WordPress account. The vulnerability was fixed in WordPress version 7.1.1 and backported to versions as early as 4.7.
In late August 2026, two private water utilities in Colorado were targeted by cyberattacks aimed at their operational technology (OT) systems. Attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The disruptions were brief and did not affect water services or public safety. The attackers are described as foreign actors, with possible links to an Iranian-backed group known to target water and wastewater systems in the U.S. The incident is part of a broader pattern of cyberattacks against water sector infrastructure across multiple states. No specific technical details or affected versions are available.
A critical vulnerability (CVE-2026-91843) affects Check Point Security Management and Log Server products, allowing unauthenticated remote code execution with root privileges via the login process. No evidence of active exploitation in the wild has been reported. Check Point has issued patches and advises immediate updates for systems without automatic patching. Additionally, Tanium and Kaspersky have patched multiple vulnerabilities in their products, including SQL injection and code execution flaws. These vulnerabilities pose significant risks if left unpatched.
This analysis discusses the limited impact that slowing AI development would have on cybersecurity, noting that current AI models are already highly capable for both offensive and defensive purposes. It highlights the rise of ransomware activity in Japan driven by two groups, The Gentlemen and Qilin, with Qilin leveraging generative AI to accelerate attacks. The report emphasizes that foundational security practices remain critical despite AI advancements. It recommends strict management of internet-accessible devices, credential lockdown, multi-factor authentication, and robust endpoint detection to mitigate risks from AI-enhanced ransomware operations.
Cisco has released patches for multiple critical vulnerabilities affecting Secure Firewall Management Center (FMC), Identity Services Engine (ISE), and Nexus Dashboard. These vulnerabilities include remote code execution, command injection, authentication bypass, SQL injection, and other flaws that could lead to root access and denial-of-service conditions. Some of the vulnerabilities have been publicly disclosed and exploited in the wild, including a zero-day authentication bypass in ISE. Cisco has issued security advisories detailing these issues and providing fixes.
MLflow's dspy and statsmodels model flavors contain vulnerabilities that bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION safety control designed to prevent unsafe pickle deserialization. The dspy flavor conditionally applies this control only if the model path ends with .pkl, allowing bypass if the file extension differs. The statsmodels flavor does not apply the control at all. This allows arbitrary remote code execution via malicious pickle payloads when loading models through these flavors. The vulnerability was confirmed in MLflow 3.12.0. The statsmodels flavor issue is patched in versions 3.15.0 and later. Users should upgrade and avoid using the dspy flavor until a fix is available.
Two critical unauthenticated remote code execution (RCE) vulnerabilities affect The Events Calendar WordPress plugin versions before 6.17.3.1 and 6.17.4.1. These flaws allow attackers to execute arbitrary code and potentially take over affected WordPress sites. The first vulnerability (CVE-2026-78159) involves unauthenticated code injection via insufficient validation, patched in version 6.17.3.1. The second (CVE-2026-78006) is an unauthenticated PHP object injection exploitable if event comments are enabled, fixed in version 6.17.4.1. Approximately 240,000 sites using vulnerable versions may be exposed, though exploitation requires comments to be enabled. Both vulnerabilities lead to full site compromise if exploited.
Critical10.0KEVEPSS 98%Check Point ResearchCVE-2026-72898
The threat intelligence report from September 14, 2026, details multiple cyber incidents including data breaches, vulnerabilities, and AI-related threats. Notably, a data breach at Mathspace was caused by exploitation of CVE-2026-72898, a SQL injection vulnerability in the self-hosted Metabase tool, exposing user names, emails, usernames, and locations. Other significant vulnerabilities include Microsoft’s Patch Tuesday addressing 974 flaws including privilege escalation zero-days, and GitLab’s critical path traversal vulnerability CVE-2026-85706 allowing unauthenticated arbitrary file reads. MikroTik RouterOS vulnerabilities enabling passwordless SSH and privilege escalation were also fixed. The report includes AI threats involving prompt evasion and sandbox escapes. Check Point IPS provides protections for several mentioned vulnerabilities. The report does not specify affected versions for CVE-2026-72898. No CVSS score is provided for this vulnerability.
Ivanti released security updates addressing multiple critical vulnerabilities in its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) products. Six critical remote code execution flaws in Neurons for ITSM were fixed, including missing authorization and deserialization of untrusted data issues. Two authentication bypass vulnerabilities affecting Sentry and EPMM were also patched. The vulnerabilities were resolved in specific versions released in September 2026. Ivanti is not aware of any active exploitation in the wild.
Microsoft's September 2026 Patch Tuesday release addresses 973 vulnerabilities across multiple products, including 113 critical issues. Among these, several vulnerabilities have been exploited in the wild, notably CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC), both elevation of privilege flaws with CVSS scores of 7.8. The update also includes multiple remote code execution vulnerabilities with high CVSS scores, such as CVE-2026-69676 (Windows Kerberos) with a score of 8.8 and CVE-2026-69730 (Windows DNS Server) with a score of 9.8. Microsoft highlights some vulnerabilities as more likely to be exploited and others as less likely. The vulnerabilities affect a broad range of Microsoft products including Windows components, Azure services, and Microsoft SQL Server. No explicit patch links are provided in the source, but these vulnerabilities are part of the official monthly security update. The vendor manages remediation through this update.