Rosetta Daily · Sep 1, 2026

Network gear is turning up unauthenticated configuration takeovers in bulk (TOTOLINK, Tenda, D-Link), while AI tooling shows up on both sides of the same coin: METR had an API key stolen and Eclipse Theia's Agent Mode was found writing files outside its workspace, even as the Aurora ransomware crew used Cursor AI to help break in and a Brazil-focused fraud group used generative AI to help write malware — AI tools are moving from target to weapon.

Critical Vulnerabilities

TOTOLINK T6 router: 14 unauthenticated configuration-tampering flaws (CVSS up to 9.8)

Firmware 4.1.5cu.748_B20211015's /cgi-bin/cstecgi.cgi interface carries a batch of access-control failures: unauthenticated attackers can remotely rewrite Wi-Fi settings, change the admin password, enable WPS pairing, alter DHCP and access-control rules, and expose WAN-side administration. Most of the 14 CVEs score CVSS 9.1–9.8; no vendor patch has been announced.

Sources: NVD · CVE-2026-51674 · NVD · CVE-2026-51709

Tenda AC18 / AC1206 routers: unauthenticated Telnet and Web UI access (CVSS 9.3, exploit public)

Tenda AC18's Telnet handler and AC1206's Web UI both lack authentication, letting remote attackers open a Telnet backdoor or invoke admin functions directly. All three CVEs score CVSS 9.3 and public exploit code already exists.

Sources: NVD · CVE-2026-82695 · NVD · CVE-2026-82694

D-Link DNS-320L/327L/340L/345 NAS: five OS command injection flaws in CGI handlers (CVSS 8.5–8.6, exploit public)

Multiple CGI handlers — isomount_mgr.cgi, usb_device.cgi, ve_mgr.cgi, virtual_vol.cgi, iscsi_mgr.cgi — fail to validate parameters such as f_dev, f_sharename, and alias, letting a remote attacker inject OS commands. All five are remotely exploitable and public exploit code exists.

Sources: NVD · CVE-2026-82689 · NVD · CVE-2026-82692

hulumi IaC governance toolkit: nine CVSS 9.3 policy-bypass and privilege-escalation flaws

Versions before 1.3.2 of @hulumi/policies, @hulumi/baseline, and @hulumi/drift share a set of guardrail bypasses: IAM policy checks can be defeated with spoofed admin-equivalent paths, wildcard conditions in GitHub OIDC trust policies can be hidden from review, a deployment SCP template allows tag-on-create bypasses, and execute plans are accepted without provenance validation. All nine CVEs score CVSS 9.3 — essentially the same guardrail system failing at multiple checkpoints at once.

Sources: NVD · CVE-2026-82860 · NVD · CVE-2026-82854

Dell PowerStore: missing authentication on restricted management interface (CVE-2026-58574, CVSS 9.8)

An unauthenticated attacker with network access to the restricted management interface can read internal system information from the appliance filesystem, including credentials that could enable full administrative control.

Sources: NVD

ProfilePress WordPress plugin: unauthenticated remote code execution (CVE-2026-66047, CVSS 9.2)

Versions before 4.17.2 expose a ppress_connect_process AJAX handler protected only by a brute-forceable 32-bit connect token, letting attackers silently install and activate arbitrary plugins via a caller-controlled file request parameter.

Sources: NVD

Ebyte industrial wireless modules: three authentication and privilege flaws (CVSS 8.7–9.3)

The vendor's configuration utility lets an unauthenticated attacker on the adjacent network modify settings or credentials under certain conditions; the authentication mechanism relies on a deprecated hashing algorithm; and administrative functions aren't separated from limited ones, letting low-privileged users reach security-sensitive configuration.

Sources: NVD · CVE-2026-76133 · NVD · CVE-2026-73819

Google Cloud Build: webhook suppression bypasses review to run unreviewed code (CVE-2026-19410, CVSS 9.4)

An authorization flaw in GitHub trigger comment control let a remote attacker suppress webhook notifications and execute unreviewed code in the build environment. Patched June 24, 2026; no customer action needed.

Sources: NVD

Actively Exploited

[Added detail] PaperCut NG/MF zero-day chain now used for data theft

Two flaws previously exploited as zero-days, patched August 31 and added to the CISA KEV catalog the same day, are now confirmed in use for data-theft attacks rather than the initial-access activity reported earlier.

Sources: Bleeping Computer

Langflow and Ruby on Rails flaws exploited for credential-probing and C2

VulnCheck reports attackers exploiting two flaws in Langflow and Ruby on Rails (CVE-2026-0768, CVSS 9.8, arbitrary Python code execution as root; CVE-2026-66066) for credential-probing and command-and-control activity. Neither is yet listed in the CISA KEV catalog.

Sources: The Hacker News

AI Security

Eclipse Theia Agent Mode: unchecked file writes escape the workspace (CVE-2026-82217, CVSS 8.8)

In versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and related helpers) resolved a model-supplied file path without a workspace-containment check — a crafted relative path like ../.bashrc, an absolute path, or a ~-expanded path could write or delete files outside the workspace.

Sources: NVD

METR's API key stolen; attackers burn roughly $600,000 in AI credits

METR, the nonprofit that evaluates frontier models' agentic capabilities, disclosed two security incidents in which external actors attempted unauthorized access to its systems — one of which led to a stolen API key that was used to consume roughly $600,000 worth of AI usage. METR says no sensitive information is believed exposed.

Sources: The Hacker News

Russia-aligned hackers plant a "nuclear weapon" prompt in malware to disrupt AI-assisted analysis

ESET disclosed a technique called GuardBreaker, used by the Russia-aligned UAC-0099 against a target in Ukraine: malware is deliberately laced with text designed to trip an LLM's safety refusal (such as nuclear-related content), so that analysts' AI tooling refuses to process the sample — disrupting LLM-assisted malware analysis workflows.

Sources: The Hacker News

Aurora ransomware operators use Cursor AI to help breach at least 10 targets

CloudSEK and Gambit Security, working from infrastructure exposed by the group, found that attackers tied to Aurora (aka Aur0ra) ransomware used SpaceX's Cursor AI coding assistant to help break into target networks, confirming at least 10 victims.

Sources: The Hacker News

Brazil-focused fraud group BREEZE COMET is using generative AI to help build malware

Google's Threat Intelligence Group reports that BREEZE COMET (formerly UNC5669), a financially motivated actor that has long targeted Brazilian financial, retail, and e-commerce firms for fraudulent transfers, is now using generative AI to support malware development alongside its custom malware suite and compromised trusted websites — a step GTIG says could increase the scale, speed, and sophistication of future operations.

Sources: Mandiant

Other

China-linked Fire Ant expands from VMware into Cisco routers and TACACS servers

Sygnia's incident response investigation found the long-running China-linked espionage actor Fire Ant has expanded beyond VMware hypervisor compromise into Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, using the foothold to steal credentials and blind security logging.

Sources: Bleeping Computer · The Hacker News

ValleyRAT backdoor hides inside signed Chinese wallpaper software to dodge AV exclusions

Kaspersky found the Silver Fox group disguising the ValleyRAT backdoor as a signed installer for QN Wallpaper, a genuine Chinese desktop wallpaper tool, so users add it to antivirus exclusions and the malware then runs under that trusted process.

Sources: The Hacker News

Nodemailer: two flaws — SMTP command injection and disabled TLS certificate checks (both CVSS 8.3)

Versions before 8.0.4 fail to sanitize a custom envelope.size parameter, letting CRLF characters inject arbitrary commands into the SMTP MAIL FROM sequence; versions before 8.0.8 disable TLS certificate verification (rejectUnauthorized: false) during OAuth2 token requests, letting a machine-in-the-middle capture OAuth client secrets and tokens.

Sources: NVD · CVE-2026-82854 · NVD · CVE-2026-82662