Silent Signal (14 September 2026) documents a pre-authentication vulnerability chain in the IBM Db2 Mirror for i web interface (Db2MirrorServlet on the IBM i administrative Liberty instance; lab IBM i V7R5, GUI WAR build timestamp late 2025). The write-up describes how authentication/validation filters can be confused, enabling unauthenticated reach into powerful admin features (arbitrary file read via log/trace viewers, attacker-influenced writes into an expanded WAR path that becomes JSP execution in Liberty, then a native helper crossing to QSECOFR on the local IBM i system). No CVE identifier is assigned in the post; the author withholds exploit/JSP payload bodies and frames the piece as vulnerability mechanics plus hardening guidance. Confirm IBM PSIRT/bulletin status for your Db2 Mirror for i / IBM i web stack build before declaring patched. Primary: Silent Signal; no separate vendor bulletin URL confirmed at desk time.
Silent Signal — Db2 Mirror for i pre-auth RCE chain (14 Sep 2026)
BleepingComputer (14 September 2026) reports that the verified Reddit account u/hbomax was hijacked and used to run about 108 malicious advertisements over roughly 48 hours. Ads used ClickFix social engineering (victims paste commands into Windows Run/PowerShell or macOS Terminal) and redirected to lookalike sites (including hbomaxx[.]us). Hudson Rock and ADAMnetworks link the activity to a broader campaign they call PasteSwitch delivering information stealers, loaders, crypto clippers, and fake wallets on Windows and macOS; one macOS chain referenced “AMOS helper” persistence under a .com.apple.accountsd-style directory. Some ads impersonated HBO Max; others pushed fake AI/developer/macOS utilities. BleepingComputer said HBO / Warner Bros. Discovery had not responded at publication. Distinct from prior desk ClickFix/EtherHiding cards. Primary/wire: BleepingComputer.
BleepingComputer — HBO Max Reddit ClickFix (14 Sep 2026)
Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhX (14 September 2026) covers CVE-2026-76461, a Critical SQL injection in email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway (physical and virtual, any configuration). Unauthenticated remote attackers can send a crafted email with malicious SQL statements and gain command execution as root on the underlying OS. Cisco CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-89; Bug CSCwu56234. Not affected: Secure Email and Web Manager, Secure Web Appliance. Cisco PSIRT became aware of active exploitation in September 2026; Cloud customers with detected malicious activity were contacted directly; Cloud fleet already upgraded to 16.5.0-780. IoC guidance: grep mail_logs for suspicious SQL (example COPY.*TO PROGRAM); also review external network/firewall logs because root access can erase on-box evidence. No workarounds. Fixed AsyncOS: 15.5 and earlier → 15.5.5-014; 16.0 → 16.0.4-302; 16.5 → 16.5.0-780 (Cisco strongly recommends 16.5.0-780). CISA added CVE-2026-76461 to KEV with FCEB remediation due 17 September 2026 (wire: BleepingComputer / THN 15 Sep). Same-day Cisco also shipped other critical SEG/SEWM fixes (CVE-2026-76440/76441/20353/76443) without claimed in-the-wild use — covered here only as context, not separate desk cards. Primary: Cisco PSIRT; wires: BleepingComputer, The Hacker News, SecurityWeek (15 Sep 2026).
Apple published security-content pages dated 14 September 2026 for major releases including iOS 27 and iPadOS 27 (support.apple.com/en-us/149034; 100+ CVE entries on that page alone), macOS Tahoe 26.7 (149042), macOS Sequoia 15.8 (149043), Safari 27 (149039), plus tvOS/watchOS/visionOS 27 and macOS Golden Gate 27. Highlighted iOS 27 entries (Apple does not publish CVSS): sandbox breakout CVE-2026-65354; sandboxed app to kernel privileges CVE-2026-84607; WebKit universal cross-site scripting via crafted webarchive CVE-2026-86898; ImageIO/remote code-execution class issues including CVE-2026-65414; privileged-network IPSec authentication bypass CVE-2026-65329 (also listed on earlier 26.6.x content). No “actively exploited” callouts observed on the fetched iOS 27 page. UPDATE 16 September 2026 desk: macOS Golden Gate 27 security content (support.apple.com/en-us/149035) re-fetched — 200+ CVE entries on that page alone; SecurityWeek wire summarised ~200 fixes across the iOS 27 / Golden Gate 27 family. Primary remains Apple iOS/iPadOS 27; Golden Gate URL retained as secondary. Separate from prior desk card apple-ios-2661-20260817.
Hunt.io (14 September 2026; The Hacker News same day) describes an intrusion against 3BB, a major Thai broadband provider. Researchers captured an attacker-operated server still live on 3 June 2026 that held tooling run from inside 3BB’s network, a MeshCentral deployment reporting to www.ayuthayatech[.]com under device group TH-3BB (agents with root), cleanup scripts that preserved MeshCentral, SSH password spraying against 55+ internal hosts, probes of agent.3bb.co[.]th, and scripts aimed at copying RADIUS subscriber credential databases (targeted; Hunt.io does not state confirmed exfiltration). The same cache held a complete exploit for FortiGate SSL-VPN CVE-2024-21762 aimed at mail.3bb.co[.]th and a valid 3BB VPN certificate plus Jasmine-network sessions (shared infrastructure; Jasmine breach not confirmed). Primary: Hunt.io; secondary: THN.
The Hacker News (14 September 2026) summarises academic/industry research (KU Leuven, ETH Zurich, Durham University, Google; ACM CCS 2026) on DDRop, an active DDR5 memory-bus interposer that silently drops writes so encrypted confidential-computing memory stays stale without integrity alarms. Targets Intel TDX (including Scalable SGX) and AMD SEV-SNP as used on major clouds; researchers demonstrated stronger outcomes on Intel TDX default logical-integrity mode (mapping, plaintext debug copy, attestation forgery) and a narrower page-copy result on AMD SEV-SNP. Requires prior software control of the host plus brief physical access to fit a ~US$159-parts interposer; researchers report no evidence of in-the-wild use. Intel and AMD treat physical interposer attacks as outside published threat models; Intel indicated it does not plan a CVE for this class of attack. No simple firmware patch: durable fix needs hardware freshness; optional Intel cryptographic-integrity mode blocks some TDX variants. Wire-only pending vendor bulletins. Primary/wire: The Hacker News.
The Hacker News — DDRop vs TDX / SEV-SNP (14 Sep 2026)
Hacktron AI (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini; blog 13 September 2026; SecurityWeek wire 18 September) chained a heap buffer overflow in Debian-packaged libheif (CVE-2026-32882 / Discourse GHSA-vhm9-85gw-x335) with an OpenAI SSO/sign-in flaw on community.openai.com (Discourse). Attackers uploaded a crafted HEIF via forum image upload for RCE on the Discourse host, then abused OpenAI “Sign in with OpenAI” identity flow to take over employee ChatGPT and Codex accounts (connectors can reach GitHub/Slack/email). Impact proof: prompted a compromised employee Codex to open PR #1186742 in OpenAI’s internal monorepo without reading secrets. Exploit development used Claude Opus models (Opus 4.8 struggled with ASLR; Opus 5 produced a working exploit within hours). Timeline: discovery to internal-repo access under 72 hours (July 2026); OpenAI confirmed fix ~14 hours after Bugcrowd report; Discourse patched and added ImageMagick sandboxing (self-host: git pull && ./launcher rebuild app — web UI update alone may leave vulnerable libheif). OpenAI paid $6,500 for the OpenAI-side finding (Discourse-hosted forum was out of bounty scope). Discourse GHSA rates CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Broader HEIF Heist research notes the same libheif class across other image pipelines. Primary: Hacktron blog; also Discourse GHSA; wire: SecurityWeek 18 Sep.
Wordfence CNA (CVE published 12 September 2026; disclosed 11 Sep; vendor notified 23 Aug) documents CVE-2026-78175 in Themeum Tutor LMS (WordPress e-learning plugin): authenticated subscriber+ PHP object injection via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler (CWE-502). The handler relies on a nonce only (no capability/role check) and passes attacker-controlled values through esc_sql() before update_user_meta(); on retrieve, unserialize() over-reads into attacker-controlled bytes, enabling arbitrary object injection. Wordfence describes a GuzzleHttp\Cookie\FileCookieJar POP chain via the plugin's bundled PayPal Composer autoloader (TUTOR\RestAPI spl_autoload_register), writing attacker-controlled content to an attacker-chosen filename — remote code execution on the web server. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected: all versions ≤ 4.0.7; unauthenticated pathway when user registration is enabled (common for student/teacher sign-up) and monetization is enabled. CISA ADP SSVC (15 Sep): Exploitation none / Automatable no / Technical Impact total. No in-the-wild exploitation claimed in the CNA. Patch: Tutor LMS 4.0.8 (wire reporting: Themeum release ~10 Sep 2026). Credits: Chloe Chamberland / Wordfence Argus. Primary: Wordfence threat-intel / CVE record; wire: Cyber Security News 18 Sep.
Wordfence (CVE records published 12 September 2026, crediting Chloe Chamberland and Wordfence Argus) documents two critical unauthenticated remote-code-execution chains in StellarWP The Events Calendar plugin (600,000+ active installations per WordPress.org). CVE-2026-78159 (CVSS 9.8; versions up to and including 6.17.3): unauthenticated code injection via insufficient validation of the widget 'classes' map, triggered when the single-event HTML including the comment area is processed; it requires comments enabled on events and a crafted comment — version 6.17.3.1 is dated 26 August 2026 in the plugin's changelog. CVE-2026-78006 (CVSS 9.8; versions up to and including 6.17.4): unauthenticated PHP object injection when event comments are enabled/visible — payload reaches the vulnerable path before moderation; patched in 6.17.4.1 (10 September 2026). Both can fully compromise the WordPress site. Update to 6.17.4.1 or later. Primary research: Wordfence Argus blog (returns a bot check to this desk); CVE records: CVE.org; vendor changelog: WordPress.org. Correction (27 Oct 2026): the card said 6.17.3.1 was released on 25 August; the plugin's WordPress.org changelog dates it 26 August 2026. Removed an estimate of about 240,000 sites on vulnerable branches, which no readable source states. The vendor link now points to the plugin's WordPress.org page because theeventscalendar.com now redirects to another site, and the card is now dated 12 September, when the CVE records were published. (source: WordPress.org; CVE.org)
ExPatch (Denis and Aleksander Rostilov; writeup 12 September 2026; The Hacker News 14 September) detail a stored XSS in Telegram Desktop’s HTML chat export: inline-keyboard button text was written into export HTML without escaping (message body and names were escaped). A bot could hide a script in button text; forwarded link-button messages keep the payload; opening an old export in a browser runs the script and can exfiltrate that file’s messages/metadata or rewrite the page (fake verification form demo). No in-the-wild use claimed. Reported to Telegram 3 June 2026. Affected stable: 4.15.1 (March 2024) through 6.9.3. Fixed: 6.9.4 beta (3 July 2026), 7.0.1 stable (14 July 2026) and later. App update does not scrub previously exported HTML. No CVE assigned as of THN’s 14 September check. Primary: ExPatch; vendor: tdesktop 7.0.1; secondary: THN.
ExPatch — Telegram Desktop HTML export XSS (12 Sep 2026)
GitHub advisory GHSA-3c86-2m5g-59q7 (published 28 August 2026; CVE-2026-90553) covers vLLM before 0.28.0. The LlavaOnevision2 processor loader calls transformers.dynamic_module_utils.get_class_from_dynamic_module with trust_remote_code=..., but that helper has no such parameter — the flag is swallowed into **kwargs and ignored — so attacker-supplied processing_llava_onevision2.py / video_processing_llava_onevision2.py top-level code runs even when the operator set trust_remote_code=False. Because LlavaOnevision2ForConditionalGeneration is a built-in vLLM architecture, model config load does not refuse the path. NVD: CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS 4.0 8.5 High. Patch to vLLM 0.28.0 or later. Category tech (LLM inference stack, not a model-vendor guidance item). No Australian exploitation reports on this pass. Primary: GitHub advisory; also NVD.
GitHub GHSA-3c86-2m5g-59q7 — vLLM LlavaOnevision2 (28 Aug 2026)
TechCrunch (12 September 2026) and BleepingComputer (14 September) report Revolut confirmed it disclosed sensitive customer information to an unauthorised third party after fraudulent information requests were sent from a legitimate government-agency email domain. SecurityWeek (17 September 2026) reports that a threat actor using the name 'IAmNotAVillain' publicly demanded US$3 million, threatening to sell the data, and that Revolut said it had received no direct contact or demand; SecurityWeek says it understands about 680 customers were affected, and, citing Hudson Rock's contact with the hacker, that the fake requests impersonated an Italian government agency and ran for about five months (the hacker's own claim). Revolut has not published a number. A Revolut spokesperson described a sophisticated external impersonation scam; the company blocked the mailbox, alerted the agency, law enforcement and regulators, and said systems and customer funds were unaffected. Customer notifications list identity and contact details (name, date of birth, postal/email addresses, phone), copies of passports or driver’s licences, facial verification selfies, account statements (including IBAN), withdrawal records, and full transaction histories (including Bitcoin activity). Primary: TechCrunch with Revolut confirmation; NEW scope wire: SecurityWeek 17 Sep; secondary: BleepingComputer 14 Sep; not a core-system compromise. Correction (22 Oct 2026): an earlier version presented the 680-account figure, the five-month duration and a US$3 million ransom demand as established facts; they come from SecurityWeek and the threat actor, and Revolut told SecurityWeek it had received no demand. (source: https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/)
