F5 Labs Sensor Intel (11 September 2026; BleepingComputer 14 September) reports a sustained August 2026 mass-scanning campaign against internet-exposed Vite development servers harvesting cloud credentials and IaC state. Activity is anchored on CVE-2026-39364, an unauthenticated server.fs.deny / file-read bypass via query parameters such as ?raw, ?import&raw, or ?import&url&inline on /@fs/ requests (GitHub advisory GHSA-v2wj-q39q-566r, published 6–7 April 2026). GitHub rates CVSS 4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N); F5 also cites CVSS 7.5 High for the same CVE. Affected: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4 (also vite-plus ≤0.1.15). Patched: 7.3.2, 8.0.5, and current patched lines on older branches per vendor. F5 honeypots saw ~807 session-grouped attacks and ~32,000 raw events in August, wordlisting .env files, AWS/Azure credential paths, Terraform/serverless state, and /proc environ; scanners also reused older Vite bypasses CVE-2025-30208, CVE-2025-31125 (CISA KEV), and CVE-2024-45811. Exposure usually comes from --host / server.host or Docker port maps (often 5173). Mitigations: upgrade; do not expose dev ports; block /@fs/; rotate secrets if an unpatched Vite was reachable. Primary: F5 Labs; vendor: GitHub advisory; secondary: BleepingComputer.
Wordfence CNA (CVE published 12 September 2026; disclosed 11 Sep; vendor notified 23 Aug) documents CVE-2026-78175 in Themeum Tutor LMS (WordPress e-learning plugin): authenticated subscriber+ PHP object injection via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler (CWE-502). The handler relies on a nonce only (no capability/role check) and passes attacker-controlled values through esc_sql() before update_user_meta(); on retrieve, unserialize() over-reads into attacker-controlled bytes, enabling arbitrary object injection. Wordfence describes a GuzzleHttp\Cookie\FileCookieJar POP chain via the plugin's bundled PayPal Composer autoloader (TUTOR\RestAPI spl_autoload_register), writing attacker-controlled content to an attacker-chosen filename — remote code execution on the web server. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected: all versions ≤ 4.0.7; unauthenticated pathway when user registration is enabled (common for student/teacher sign-up) and monetization is enabled. CISA ADP SSVC (15 Sep): Exploitation none / Automatable no / Technical Impact total. No in-the-wild exploitation claimed in the CNA. Patch: Tutor LMS 4.0.8 (wire reporting: Themeum release ~10 Sep 2026). Credits: Chloe Chamberland / Wordfence Argus. Primary: Wordfence threat-intel / CVE record; wire: Cyber Security News 18 Sep.
ExPatch (Denis and Aleksander Rostilov; writeup 12 September 2026; The Hacker News 14 September) detail a stored XSS in Telegram Desktop’s HTML chat export: inline-keyboard button text was written into export HTML without escaping (message body and names were escaped). A bot could hide a script in button text; forwarded link-button messages keep the payload; opening an old export in a browser runs the script and can exfiltrate that file’s messages/metadata or rewrite the page (fake verification form demo). No in-the-wild use claimed. Reported to Telegram 3 June 2026. Affected stable: 4.15.1 (March 2024) through 6.9.3. Fixed: 6.9.4 beta (3 July 2026), 7.0.1 stable (14 July 2026) and later. App update does not scrub previously exported HTML. No CVE assigned as of THN’s 14 September check. Primary: ExPatch; vendor: tdesktop 7.0.1; secondary: THN.
ExPatch — Telegram Desktop HTML export XSS (12 Sep 2026)
GitHub advisory GHSA-3c86-2m5g-59q7 (published 28 August 2026; CVE-2026-90553) covers vLLM before 0.28.0. The LlavaOnevision2 processor loader calls transformers.dynamic_module_utils.get_class_from_dynamic_module with trust_remote_code=..., but that helper has no such parameter — the flag is swallowed into **kwargs and ignored — so attacker-supplied processing_llava_onevision2.py / video_processing_llava_onevision2.py top-level code runs even when the operator set trust_remote_code=False. Because LlavaOnevision2ForConditionalGeneration is a built-in vLLM architecture, model config load does not refuse the path. NVD: CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS 4.0 8.5 High. Patch to vLLM 0.28.0 or later. Category tech (LLM inference stack, not a model-vendor guidance item). No Australian exploitation reports on this pass. Primary: GitHub advisory; also NVD.
GitHub GHSA-3c86-2m5g-59q7 — vLLM LlavaOnevision2 (28 Aug 2026)
WebPros Plesk security articles (updated 10 September 2026) cover two Critical Backup Manager flaws on Plesk for Linux. CVE-2026-68487 is path traversal via an unsigned backup header that lets an authenticated customer write arbitrary root-owned files on the host (full server compromise). CVE-2026-68488 is a TOCTOU symlink race during subscription-content restore that can change ownership of directories outside the attacker’s subscription, likewise enabling root. Both carry CVSS 3.0 9.9 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) per the HackerOne CNA records. Affected: Plesk for Linux 18.0.80.6 and earlier, and 18.0.79.10 and earlier; Plesk for Windows not affected. Fixed: 18.0.80.7 and 18.0.79.11 or later. No interim mitigation listed — update is the remediation. Multi-tenant / shared-hosting boxes with customer Panel+FTP are the highest priority. Wire: Cyber Security News (13 Sep) on 68488. Primary: Plesk KB for CVE-2026-68487; companion KB for CVE-2026-68488.
GitLab Critical Patch Release (10 September 2026) ships CE/EE 19.3.2, 19.2.6 and 19.1.8. CVE-2026-85706 is a Critical path traversal in the repository commits API (improper path confinement plus missing authentication enforcement) that can let an unauthenticated requester read arbitrary files from the GitLab server under certain conditions. GitLab CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Impacted: CE/EE from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Reported via HackerOne by s3ntago. Same release also fixes CVE-2026-87719 (EE GraphQL subscription serializer insecure deserialization; authenticated Duo Chat user; CVSS 9.9) plus further High issues. GitLab.com is patched; Dedicated customers need no action; self-managed must upgrade immediately. NEW 11 September 2026: watchTowr reports in-the-wild probes for CVE-2026-85706 within a day of disclosure (POST /api/v4/projects/{id}/repository/commits/ with file.path). Hunt those log lines. Primary: GitLab docs patch release; secondary: watchTowr / SecurityWeek / BleepingComputer. UPDATE 11 September 2026: CISA added CVE-2026-85706 to KEV (dateAdded 2026-09-11; catalogVersion 2026.09.11). Self-managed instances that have not taken 19.3.2 / 19.2.6 / 19.1.8 should treat this as actively exploited and patch immediately.
Gen Digital Threat Labs (Alexandru-Cristian Bardaș, published 10 September 2026) details CVE-2026-51990 in Sogou Input Method for Windows: a one-click remote code execution chain combining unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF webview, and an outdated unsandboxed Chromium/CEF build (libcef.dll reported as CEF 80.1.16 / Chromium 80.0.3987.163). Gen observed UNC3569 exploiting the flaw in the wild via a crafted link to deploy the GRAYRABBIT backdoor. The issue was reported to Tencent on 9 April 2026 and fixed in Sogou Input Method version 16.3.0.3498 (released 21 April 2026): the patch validates URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved Sogou/Tencent domains — Gen and BleepingComputer (13 Sep 2026) still note the embedded Chromium remains outdated and unsandboxed. Primary: Gen Digital research; wires: The Hacker News (11 Sep 2026) and BleepingComputer (13 Sep 2026).
Gen Digital — Gray Rabbits / one-click Sogou backdoor (10 Sep 2026)
Wiz Research (10 September 2026) documents in-the-wild chaining of CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between 15 August and 8 September 2026, often dropping a custom Rust C2 backdoor. CVE-2026-42018 is an authentication flaw that can return an internal anonymous-user token to an unauthenticated requester even when anonymous access is disabled. Alone it is not admin; chained with CVE-2026-42016 (token scope / privilege escalation) Wiz saw unauthenticated requests become admin-scoped tokens, with follow-on admin account creation, malicious Groovy plugins, and Rust backdoors. JFrog's advisory lists the patched versions for CVE-2026-42018 as 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 (rated High); for the chain, Wiz advises upgrading to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 or later, depending on the release branch. Distinct from desk card cve-2026-82329 (also abused). Primary: Wiz; also JFrog advisories. UPDATE 11 September 2026: CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities catalog (dateAdded 2026-09-11; catalogVersion 2026.09.11). Prioritise patching self-hosted Artifactory under BOD 26-04-style exploited-first triage; hunt anonymous/admin tokens, Groovy plugins, and Rust C2 per Wiz. Correction (26 Oct 2026): JFrog's own advisory lists 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched versions for CVE-2026-42018, and the JFrog CVE record agrees. The card had listed 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as still affected and given 7.117.28, 7.125.20, 7.133.29 and 7.146.9 as the fixed builds; that has been corrected. Wiz's separate upgrade advice for the two-flaw chain is kept and credited to Wiz. (source: JFrog security advisories)
Wiz Research (10 September 2026) says CVE-2026-42016 is a privilege-escalation flaw from insufficient token scope enforcement: Artifactory validates signature/issuer but not intended scope, so a low-privileged token (including the anonymous token from CVE-2026-42018) can be escalated. Wiz observed the 42018→42016 chain in the wild 15 August–8 September 2026 alongside separate abuse of CVE-2026-82329; post-exploitation included persistent admin users, malicious Groovy plugins, and Rust C2 backdoors. Wiz lists CVE-2026-42016 impacted prior to 7.133.11 with remediated 7.133.11; for the overall campaign they urge upgrading to 7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20 or later and reviewing auth/admin activity. Primary: Wiz; vendor: JFrog advisories. UPDATE 11 September 2026: CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog (dateAdded 2026-09-11; catalogVersion 2026.09.11). Prioritise patching self-hosted Artifactory under BOD 26-04-style exploited-first triage; hunt anonymous/admin tokens, Groovy plugins, and Rust C2 per Wiz.
WatchGuard PSIRT CVE-2025-14733 is an out-of-bounds write in the Fireware OS iked process that can let a remote unauthenticated attacker execute code. It affects mobile-user VPN with IKEv2 and branch-office VPN using IKEv2 with a dynamic gateway peer; boxes that previously had those configs may still be vulnerable if a branch-office VPN to a static gateway peer remains. WatchGuard rates it CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and has observed in-the-wild exploitation, including config exfiltration variants. Fixed builds include Fireware OS 2025.1.4, 12.11.6, 12.5.15 and 12.3.1-b728352 (plus rotate locally stored secrets after confirmed compromise). CISA had already flagged active exploitation; BleepingComputer (10 September 2026) reports CISA now also confirms ransomware gangs are exploiting the same CVE. Shadowserver previously saw >115k exposed Fireboxes in December and nearly 9k still unpatched months later. Distinct from desk card watchguard-fireware-iked-20260827 (August 2026 five-critical advisory set). Primary: WatchGuard PSIRT; wire: BleepingComputer; KEV: CISA catalog for CVE-2025-14733.
Ubuntu Security Notice USN-8717-1 (noticed on HN 10 September 2026): Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who can place files in a directory that Tika subsequently parses can read arbitrary files accessible to the Tika process, with contents emitted into extracted text. Fixes via Ubuntu Pro ESM Apps: jammy libtika-java 1.22-2+deb11u1ubuntu0.1~esm2; focal libtika-java 1.22-1ubuntu0.1~esm3. Primary: Ubuntu USN-8717-1.
FortiGuard Threat Signal / Outbreak Alert (released 9 September 2026) tracks active attack attempts against CVE-2026-58138 in Orkes Conductor / conductor-oss: unauthenticated remote code execution via GraalVM script evaluators. According to the CVE record, attackers submit inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint before authentication, and evaluators configured with HostAccess.ALL or allowAllAccess(true) through the INLINE, LAMBDA, DO_WHILE and SWITCH task types then run arbitrary system commands; FortiGuard says the commands run with the privileges of the Conductor process. The CVE record gives the affected range as Conductor 3.21.21 before 3.30.2, and FortiGuard says 3.30.2 or later addresses the flaw. Public proof-of-concept code exists, including a working exploit targeting Conductor 3.23.0, and exploit material has been published on Exploit-DB (FortiGuard). FortiGuard telemetry: 1,290 IPS blocks in 24 hours (up 132%) and 6,696 over seven days; top observed sources Germany, Hong Kong, Indonesia, the UAE and India. The CVE record rates it CVSS 3.1 9.8 and CVSS 4.0 9.3. No Australian exploitation reported. Primary: FortiGuard threat signal; also the CVE record. Correction (26 Oct 2026): the affected range and CVSS scores are now credited to the CVE record, and a SecurityWeek source this desk does not use has been removed, along with details no linked source supports: that Conductor often runs as root, that open-source Conductor leaves the workflow API unauthenticated by default, that 3.30.0 and 3.30.1 carried an incomplete partial blocklist, and an Empirical Security report of exploitation from about 21 August. (source: FortiGuard; CVE record)
FortiGuard — Orkes Conductor evaluator RCE Threat Signal (CVE-2026-58138)
