Rosetta Daily · Sep 4, 2026
Today's critical set sits in build and AI infrastructure rather than on endpoints. Orval shipped nine RCEs reachable from an OpenAPI spec, several of which execute at module import; Coder's registry infrastructure was compromised to push Terraform modules carrying credential-stealing code; and Helicone let an admin in any organization retrieve other tenants' plaintext OpenAI, Anthropic and Bedrock keys. In all three, attacker-controlled input is executed or trusted before anyone runs the program.
Actively exploited
Elementor Pro: critical flaw exploited to take over WordPress sites (CVE-2026-32475)
Attackers are using it to deliver a webshell and execute arbitrary commands on the server. A patch is out, but the CVE is not in the CISA KEV catalog at this point.
Sources: Bleeping Computer
Coder's registry infrastructure compromised to serve credential-stealing Terraform modules
Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered Terraform modules containing credential-stealing code. The tampering happened at distribution, not in the source repository, so verifying the upstream repo would not have caught it.
Sources: Bleeping Computer
Pegasus zero-click exploit infects the iPhone of a Serbian student movement member
Citizen Lab, working with the SHARE Foundation, confirmed an iMessage zero-click exploit was used to install NSO Group's Pegasus spyware, and found high-confidence indicators of infection.
Sources: The Hacker News
Attackers turn the Node.js runtime itself into a malware delivery tool
Symantec's Threat Hunter Team recorded the technique in attacks on government departments, technology companies and hotels since February 2026. It works because node.exe is a signed, legitimate executable that endpoint controls generally do not block.
Sources: The Hacker News
Shai-Hulud's credential hunt grows from 189 to 469 locations
The variant GitGuardian examined scans developer environments, CI/CD tooling, cloud configuration and, newly, AI tool configs. That last category is the addition worth noting: the list of places credentials sit is growing along with the developer toolchain.
Sources: The Hacker News
Critical vulnerabilities
Cisco Nexus 9000: unauthenticated remote attackers can run code as root (CVE-2026-20212, CVSS 9.8)
Ten Silicon One-based Nexus 9000 switches are affected. Cisco also shipped an IOS XR hardening release bundling seven CVEs, two of them rated 9.8, with no workaround for any IOS XR version — upgrading is the only option.
Sources: The Hacker News
Orval: nine critical RCEs let a malicious OpenAPI spec run code at generation and at import
This OpenAPI-to-client code generator interpolates spec strings into generated code without escaping, in several places: paths and servers[].url land in template literals (backtick breakout, CVE-2026-62681 / CVE-2026-62682); property and parameter names become object keys (computed-property-key injection, CVE-2026-71867 / CVE-2026-71865 / CVE-2026-71864); schema defaults become module-level template literals (CVE-2026-72717 / CVE-2026-71871 / CVE-2026-71868 / CVE-2026-71869). That last group executes when the module is imported — no generated function has to be called.
Sources: GitHub Advisory · GitHub Advisory · GitHub Advisory
unstructured: full-read SSRF in URL-based partitioning (CVE-2026-71428)
The url= argument of partition(), partition_html() and partition_md() is fetched via requests.get() with no host validation, and the response body is returned as Element text. An attacker reaches loopback admin APIs, internal HTTP services and cloud metadata endpoints — and reads the full response back. The library is a common component in document ingestion pipelines.
Sources: GitHub Advisory
MISP: authentication bypass in the LDAP and LinOTP components (CVE-2026-85216, CVSS 9.5)
The custom LdapAuthenticate and LinOTPAuthenticate components replaced CakePHP's FormAuthenticate without replicating its credential validation, so empty or non-string values could reach the underlying authentication mechanism. MISP is a threat intelligence sharing platform; one instance typically aggregates sensitive data from several organizations.
Sources: NVD
IXON VPN Client: CRLF injection leads to remote code execution with elevated privileges (CVE-2026-75925, CVSS 9.6)
Versions below 1.4.7 are affected. CISA's ICS advisory notes deployment across commercial facilities, critical manufacturing, energy, IT, and water and wastewater.
Sources: CISA
zlib: heap buffer overflow in gz_vacate()(CVE-2026-85091, CVSS 8.3)
Versions 1.3.1.2 through 1.3.2 are affected. Calling gzprintf() or gzvprintf() after a write stall causes an unchecked memmove() to write past the internal input buffer boundary. zlib's dependency surface is broad enough that this needs tracing through distribution patches layer by layer.
Sources: NVD
Eclipse Arrowhead: certificate signatures never verified, and management auth bypassed by URL encoding (CVE-2026-82180, CVSS 9.5; CVE-2026-80515, CVSS 8.9)
In the first, with the MQTT certificate authentication policy enabled, an X.509 certificate the client places in its own message payload is decoded and its Subject DN taken as the authenticated identity — the signature is never checked. In the second, the gate protecting every management endpoint decides whether to apply by calling request.getRequestURL().toString().contains("/mgmt/"); Tomcat returns the URL undecoded while Spring MVC routes on the decoded path, so /serviceregistry/%6Dgmt/systems walks straight past it.
Mendix SAML module: SAML response signatures not validated, allowing session hijacking (CVE-2026-80465, CVSS 8.8)
Affects the SAML module below V4.2.3 (and V3.6.27) across the Mendix 9.24, 10 and 11 compatible builds. In specific SSO configurations an unauthenticated remote attacker can hijack an account session.
Sources: NVD
util-linux: post-mount hooks run after the mount helper fails, allowing privilege escalation (CVE-2026-76642, CVSS 8.5)
Versions through 2.41.5 and 2.42.2 are affected. Because the helper's exit status is not checked, unprivileged users can use the X-mount.idmap or X-mount.owner hooks to perform privileged operations on pre-existing filesystems — cloning filesystems with inherited suid bits, or modifying target inode permissions after a helper fails.
Sources: NVD
AI security
Helicone: an admin in any organization can retrieve other tenants' plaintext model keys (CVE-2026-85178, CVSS 8.3)
VaultManager.getDecryptedProviderKeyById(), behind GET /v1/vault/key/{providerKeyId}, does not validate the requester's organization against the vault key's organization. Any account with admin or owner privileges in any organization can retrieve decrypted upstream credentials belonging to other tenants, including plaintext OpenAI, Anthropic and Bedrock API keys.
Sources: NVD
Ollama: redirect destinations unvalidated when pulling models, reaching cloud metadata endpoints (CVE-2026-85180, CVSS 8.7)
Ollama does not validate redirect destinations when pulling tensor-layer models. An attacker who controls a registry and serves a malicious tensor-layer manifest can make the server issue GET requests to arbitrary internal hosts, cloud metadata endpoints included.
Sources: NVD
Label Studio: cross-tenant cloud storage reads, and webhooks pointed at internal services (CVE-2026-85211, CVSS 8.3; CVE-2026-85179, CVSS 8.4)
The first fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py; an attacker creates a separate organization and supplies arbitrary file URIs to presign or stream another tenant's bucket contents. The second does not validate webhook URLs, letting authenticated users target RFC 1918 addresses and cloud metadata endpoints, and exfiltrate annotation data by enabling payload transmission.
n8n: expression sandbox escape in the $fromAIhandler (CVE-2026-85169, CVSS 8.7)
Versions before 1.123.73, 2.35.4 and 2.36.2 are affected. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile code.
Sources: NVD
Hermes Agent: a repository's own .git/configmakes the agent run attacker commands (CVE-2026-71963, CVSS 8.6) [Added detail]
Versions 0.18.2 through 0.21.0, fixed in commit f6234d0. A malicious repository sets core.fsmonitor to an attacker-controlled command; when a user opens the repository and sends any message, the agent triggers a git status index refresh that executes it. This is the first named product with its own CVE for the repo-config-hijacks-a-coding-assistant class.
Sources: NVD
Vendor advisories
Microsoft patches a batch of privilege escalation flaws across cloud and AI services
The September 3 advisories cover an authentication bypass in Entra ID reachable by an unauthorized attacker (CVE-2026-62916), missing authentication for a critical function in Azure AI Language (CVE-2026-70352), and improper cryptographic signature verification in Copilot Studio (CVE-2026-80098). Azure AD B2C (CVE-2026-83711), an SSRF in Power Automate (CVE-2026-65818), Microsoft Fabric, Azure Cosmos DB and Discovery Studio are also covered. These are managed services with nothing to patch on the customer side, but the associated grants are worth reviewing.
Other
Thomson Reuters court software breach may have exposed SSNs and sealed records
The intrusion into C-Track, the court case management platform sold by its West Publishing unit, occurred in March 2026 and was discovered on June 30. Courts in 11 US states, the US Virgin Islands and Ontario, Canada are affected, and a subset of court records could contain individuals' names.
Sources: The Hacker News
French hospital fined €500,000 for failing to protect patient data
France's data protection authority CNIL fined Hôpital privé de la Loire €500,000 ($580,000) over a breach exposing the data of 727,000 patients and their relatives.
Sources: Bleeping Computer
RMM phishing campaign spans 46 countries, with the US as its top target
The operation was initially read as Canada-focused because it used Canada Revenue Agency tax forms as lures. ANY.RUN connected 601 cases to the wider campaign, with around 45% of observed activity associated with the United States.
Sources: The Hacker News
BraZetsu: a Python framework that turns compromised Windows hosts into marketplace inventory
Researchers described a framework built for initial access brokers: rather than only stealing information, it packages compromised systems into listable commercial goods.
Sources: The Hacker News