Rosetta Daily · Sep 3, 2026
Five of today's seven KEV entries carry a remediation deadline of Sep 5 — three days, against CISA's usual two weeks. One of the seven is BerriAI LiteLLM's MCP endpoint: an LLM gateway now sits in the known-exploited catalog alongside SonicWall and JFrog perimeter appliances.
Actively Exploited (KEV)
CISA adds seven exploited flaws at once, five with a three-day remediation deadline
The seven are: Sangoma Switchvox SQL injection (CVE-2026-9586), Kludex Starlette HTTP request/response smuggling (CVE-2026-48710), Kestra OSS OS command injection (CVE-2026-49869, which lets an unauthenticated attacker create and execute arbitrary workflows), BerriAI LiteLLM improper authentication (CVE-2026-59822), JFrog Artifactory improper authentication (CVE-2026-82329, which under default configuration hands an unauthenticated attacker administrative privileges), and a pair in SonicWall SMA1000 — a pre-authentication SSRF (CVE-2026-83548, CVSS 10.0) and an OS command injection (CVE-2026-83549). Switchvox, Kestra, JFrog and both SonicWall entries are due Sep 5; Starlette and LiteLLM are due Sep 16.
Sources: CISA · The Hacker News
AI Security
BerriAI LiteLLM: any Bearer token establishes an authenticated MCP session (CVE-2026-59822)
The flaw sits in the MCP Streamable HTTP endpoint: an unauthenticated attacker who presents an arbitrary Bearer token gets a session the server treats as authenticated. LiteLLM is commonly deployed as a single gateway in front of several model providers, so a forgeable session puts every tool call and credential routed through it within reach.
Sources: CISA KEV
A repository's own Git config can make Claude, Codex, Cursor and other coding agents run attacker code
Manifold Security disclosed eight flaws across seven command-line AI coding agents: a repository's Git configuration can name a command that the agent then runs on the developer's machine. It executes as the user, outside the agent's sandbox, with no approval prompt; the only precondition is that the repository is cloned locally. Four were still unpatched at publication.
Sources: The Hacker News
Omnigent: four flaws in Databricks' agent harness, the worst turning a shared template into runner code execution
Omnigent is a meta-harness that runs tools like Claude Code and Codex under policy and sandbox constraints. CVE-2026-62674 (Critical) lets an authenticated user with edit access to their own session overwrite a shared or template agent through PUT /sessions/{session_id}/agent — the interface marks templates as not MCP-editable, but this upload path still accepts a replacement bundle. Adding a stdio MCP server to the shared agent means every later runner session built on that template executes it. The other three: a Python callable tool in an uploaded bundle can point at subprocess.check_output for RCE (CVE-2026-62675), an unvalidated os_env.cwd yields arbitrary host filesystem read/write and environment-secret disclosure on the runner (CVE-2026-62677), and the guardrail's shell-command parser fails open when parsing fails (CVE-2026-62676). One of them was reported by Aeon, an autonomous security agent.
Sources: GitHub Advisory · GitHub Advisory
Google ships Gemini 3.8 Flash Cyber, gated to vetted defenders
The model targets vulnerability discovery and automated patching. On CWE-Bench, an external patching benchmark, it scores pass@1 47.2% against a leading frontier model's 47.8% — parity at lower cost, not a capability lead — while Google's own internal benchmark spanning 20 languages puts its discovery success rate above 70%. Chrome's security team reports it produced 2.6 times more correct patches than the best commercial models, which are far larger. Google says it deliberately prioritised fixing over exploitation in training, and that this build ships with more permissive cybersecurity mitigations than the general model, which is why it is distributed only through the Fairwind Program to governments, critical-infrastructure operators and core technology platforms — participants must confine use to their own security, incident-response or penetration-testing teams.
Sources: Google DeepMind · Google · The Hacker News
Critical Vulnerabilities
Google Chrome 152.0.7977.75: nine high-severity fixes, most of them sandbox escapes
Four CVSS 9.6 flaws all execute code outside the sandbox: incorrect authorization in FileSystem (CVE-2026-84354) and use-after-free bugs in Shared Tab Groups (CVE-2026-84353), WebGL (CVE-2026-84352) and Dawn (CVE-2026-84333), the last three on Android. The one to patch first is CVE-2026-84324 (CVSS 9.0, use-after-free in Proxy) — it is reached through crafted network traffic with no need to lure the user to a page, where the others are all documented as requiring social engineering. Also fixed: CVE-2026-84325 (CVSS 9.8), which bypasses system access restrictions via a co-installed app, plus CVSS 8.8 issues in V8, WebRTC and TabStrip.
AOS-CX switch software: unauthenticated remote code execution and arbitrary file write (CVSS up to 9.8)
CVE-2026-73749 (CVSS 9.8) sits in a daemon where crafted packets from an unauthenticated attacker can execute code with elevated privileges. CVE-2026-73752 is an unauthenticated arbitrary file write on an API endpoint that can also lead to RCE, and CVE-2026-73782 is a format string flaw in the command line interface allowing unauthenticated RCE. Three further CVSS 8.8 issues need either a low-privileged account or input from a hostile authentication server.
Thunderbird: calendar invitations can launch local or network-hosted executables (CVE-2026-84637, CVSS 9.8)
A malicious calendar invitation uses file URI attachments to launch programs on the local machine or a network location, bypassing Thunderbird's normal protections against executable attachments. With the new invitation display enabled, the attachment can also be shown under a misleading filename. Fixed in Thunderbird 154 and 153.2. The same batch includes CVE-2026-84639 (CVSS 9.1), where an error condition in certain MIME bodies causes uninitialized memory to be used.
Proxmox VE: an arbitrary tfa-challenge value bypasses two-factor authentication (CVE-2023-54391, CVSS 9.3)
Affects libpve-access-control before 8.0.4 in Proxmox VE 7.0 through 8.0. An unauthenticated attacker who POSTs any value as tfa-challenge to the access ticket API endpoint authenticates as any existing enabled user that has no second factor configured.
Sources: NVD
Predis: CRLF in keys or values injects commands into Redis cluster connections (CVE-2026-84372, CVSS 9.8)
Predis is a widely used Redis and Valkey client for PHP. From 3.0.0-RC1 until 3.3.0, pipeline handling on aggregate cluster and replication connections has AbstractAggregateConnection::write() re-parse an already serialized RESP buffer by splitting on explode("\r\n") instead of honouring RESP length prefixes. Attacker-controlled keys or values containing CRLF are therefore read as new protocol frames.
Sources: NVD
Phison PS3111-S11 SSD controller firmware: implants survive power cycles (CVE-2026-84696, CVSS 9.3)
Firmware through SBFQT1.3 exposes privileged vendor unique commands over the ATA interface with authentication that is either absent or defeatable. Bypassing the weak CRC-16 unlock handshake — or simply targeting builds shipped with no VUC lock at all — gives read and write access to controller memory and raw flash, so an implant persists across power cycles rather than living in the operating system.
Sources: NVD
Next.js: unescaped backslashes in route segments escape the cache directory on Windows (CVE-2026-75604, CVSS 9.0)
Affects 13.4.0 through 15.5.24 and 16.3.3 for applications using the Pages Router, or the App Router without Cache Components, on Windows-hosted servers, where backslashes in route segments are not consistently escaped before incremental-cache paths are constructed.
Sources: NVD
Supply Chain and Web Security
WordPress All-in-One WP Migration and Backup plugin carries an unauthenticated SQL injection
The plugin is installed on millions of sites. Unauthenticated attackers can use the injection to execute remote code and take over the site.
Sources: Bleeping Computer
Malicious Apache modules divert Brazilian government and university traffic to betting pages
Check Point has tracked a Chinese-speaking cluster it calls Gambling Goblin since mid-2025, installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions and using them to send visitors to attacker-controlled gambling and sports-betting pages. The modules sit inside the web server itself, leaving the site's own content untouched.
Sources: The Hacker News
GeoNetwork fixes two flaws that chain into unauthenticated RCE
Chained together the two bugs give unauthenticated remote code execution on the open-source geospatial metadata catalog that sits behind many government and agency geoportals. Fixes shipped in 4.4.12 and 4.2.17 on July 8, 2026; the details were published on August 31. GeoNetwork originated at the UN Food and Agriculture Organization.
Sources: The Hacker News
Other
FalconFlank: public PoC for a CrowdStrike Falcon Sensor privilege escalation
The researcher known as Chaotic Eclipse published a proof of concept on GitHub, describing the flaw as a zero-day privilege escalation that abuses Falcon Sensor's remediation handling for malicious Office macros.
Sources: The Hacker News
Fake software installers disable Windows Update and weaken Microsoft Defender
Microsoft describes an active campaign in which bogus download sites impersonate trusted vendors to distribute malicious installers that then switch off system updates and weaken Defender. The compromises span multiple industries but primarily affect China-based operations of multinational organizations and Chinese-speaking users.
Sources: The Hacker News
StreamRat Android trojan pushed through Meta ads, granting near-complete device control
ThreatFabric documented a new Android banking trojan promoted to Spanish-speaking users through a fake television-streaming campaign. The advertising focused on Spain and reached an estimated 570,950 Meta accounts in the European Union.
Sources: The Hacker News
Dropbox accounts breached through a Lenovo email verification flaw
Dropbox is warning some users that an unauthorized party reached their accounts by exploiting a flaw in Lenovo's email verification process to register fraudulent Lenovo IDs.
Sources: Bleeping Computer
Russian national extradited over Excel malware sent to about 80,000 freelancers
Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited on August 28. Prosecutors say he used roughly 255 fake accounts on a freelance platform in 2016 and 2017 to send malware-laced Excel attachments to about 80,000 of its users, delivering TVRAT and DarkVNC.
Sources: The Hacker News · Bleeping Computer
Attackers abuse the Faronics Deploy admin tool to install ScreenConnect
Phishing actors are using the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control of victim computers, then installing ScreenConnect remote support software to hold that access.
Sources: Bleeping Computer