Rosetta Daily · Sep 6, 2026
Five of today's AI and agent infrastructure advisories share one failure mode: the security control is off by default, or hangs on an environment variable nobody sets. Cua computer-server skips authentication when
CONTAINER_NAMEis unset, Webstudio becomes an open proxy whenRESIZE_ORIGINis unset, Lara Dashboard lets anyone sign in as any account by email wheneverAPP_ENVis not production, Axolotl'strust_remote_codedefaults to None rather than False, and MindsDB ships an empty crawler allowlist. None of these fire even once on a developer's machine.
Actively exploited
[Added detail] PaperCut NG/MF: auth-bypass and RCE chain used to steal credentials from schools (CVE-2026-81578, CVE-2026-82078)
The Arctic Wolf Adversary Research Team observed attackers chaining the two flaws to run commands, perform internal reconnaissance and steal credentials at education-sector targets in the US and Europe. Both CVEs are in the CISA KEV catalog, added Aug 31 with a Sep 14 remediation deadline.
Sources: The Hacker News
Magento and Adobe Commerce: unpatched pre-auth code execution zero-day used to backdoor stores
Sansec published an advisory on September 5 naming the flaw StyleSmuggler and dating the attacks to September 4. Attackers run code on a store's server without logging in. There is no patch.
Sources: The Hacker News
JetBrains Cadence: breached through its own unpatched TeamCity, AWS credentials extracted
JetBrains says attackers exploited a recently disclosed critical TeamCity vulnerability to reach its own environment, and is telling Cadence users to immediately revoke or rotate every credential and secret that may have been used to run Cadence executions.
Sources: The Hacker News
Critical vulnerabilities
N-central: pre-auth remote code execution (CVE-2026-86218, CVSS 10)
Remote code execution with no credentials at all, affecting versions before 2026.3.1.14.
Sources: NVD
MikroTik RouterOS: SSH key matching omits the exponent, so signatures can be forged (CVE-2026-67276, CVSS 9.2)
When matching an SSH authentication request against an authorized user key, RouterOS checks the key type and the RSA modulus but not the exponent — and signature verification uses the key the client supplied. An attacker who knows any authorized modulus can present a key with exponent one, forge a valid signature and open an SSH channel. Three more shipped in the same batch: CVE-2026-86060 (CVSS 9.2, a username beginning with a prohibited character rewrites the trusted RouterOS policy mask for privilege escalation), CVE-2026-67281 (CVSS 8.7, WebFig's /jsproxy reuses a stale uninitialized principal pointer for unauthenticated file reads) and CVE-2026-67277 (CVSS 8.8, a btest connection is accepted before the primary session finishes authenticating, transmitting an uninitialized tail from a kernel packet buffer). Fixed in the 6.49.21 and 7.23.4 long-term releases.
VMware Workstation and Fusion: integer overflow reaches host code execution (CVE-2026-59346, CVSS 9.3)
Broadcom shipped updates for two flaws; this one lets a local attacker with elevated privileges run arbitrary code.
Sources: The Hacker News
Tenda CP3 cameras: five remote command injections (CVE-2026-86152, CVSS 10, and others)
Several components of firmware 27.5.57.101 can be manipulated remotely: CAutoAddWifi::ThreadProc in AutoAddWifi.cpp (CVE-2026-86152, CVSS 10), SystemAsh and sub_2F77E8 in system.c (CVE-2026-86148 and CVE-2026-86151, both CVSS 9.4) and the interface_name/host argument in NetCheckPing.cpp (CVE-2026-86149, CVSS 9.4), plus improper privilege management in Redirect.cpp (CVE-2026-86153, CVSS 9.4).
WordPress plugins: five unauthenticated paths to full takeover (all CVSS 9.8)
MemberDash ≤1.8.5 fails to validate the id parameter, letting unauthenticated attackers change the password of any user including administrators (CVE-2026-16310). Mstore Api ≤4.20.0 validates the claims on a Firebase ID token but never verifies its signature, so a forged JWT bypasses authentication (CVE-2026-13447). Mail Mint ≤1.31.0 deserializes untrusted input in handle_form_submission (CVE-2026-10196). Hummingbird ≤3.21.0 writes its page-cache debug log to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file (CVE-2026-83627). Frontend Admin ≤3.29.12 has no capability or ownership check in pre_update_value (CVE-2026-75816).
WWBN AVideo: unauthenticated retrieval of complete user records including password hashes (CVE-2026-86190, CVSS 9.3)
Given a hash parameter, the videoViewsInfo endpoints return complete user records — password hashes, recovery tokens and live session identifiers — to unauthenticated callers, and the disclosed session identifier hijacks accounts including administrators. Patched alongside CVE-2026-86189 (CVSS 9.3), an arbitrary file write through the avideoRelativePath parameter of notify.ffmpeg.json.php: the notifyCode token is decrypted but never validated, so any previously issued ciphertext can be replayed.
Coolify: OAuth callback signs users in on email address alone (CVE-2026-86117, CVSS 9.2)
In versions through 4.3.17 the callback handler neither verifies provider assertions nor binds OAuth identities. Registering a victim's email address on any enabled provider yields an authenticated session as that user.
Sources: NVD
libxml2, PCRE2 and libpcap: memory corruption in three low-level libraries
Before libxml2 2.15.4, xmlSnprintfElements in valid.c has a strcat stack buffer overflow (CVE-2026-86140, CVSS 8). Before PCRE2 10.48, pcre2_dfa_match reuses a cached recursive workspace block without the size check that a freshly allocated block of the same kind does get (CVE-2026-86145, CVSS 8.2). The libpcap BPF interpreter does not validate that a scratch register index is 15 or below, so a crafted filter program can read and write process memory (CVE-2026-0799, CVSS 8.7).
Laravel and Twig: mail header injection and a template sandbox escape (CVE-2026-48019, CVSS 8.9)
Before Laravel 12.60.0 and 13.10.0, CRLF injection in email validation, combined with how Symfony Mailer and Symfony Mime handle certain character sequences, lets an unauthenticated attacker interfere with outbound mail processing. Before Twig 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists every method call on Twig\Markup instances, and the class is not final — so any subclass carries the bypass into a sandboxed template (CVE-2026-46636, CVSS 8.7).
AI security
AutoAgent, Cua and SQL Chat: agent runtimes expose command execution on every interface (CVE-2026-86124, CVSS 9.3)
AutoAgent's TCP server binds to all interfaces and executes caller-supplied commands as root; connecting to the port runs arbitrary bash inside the container and reaches bind-mounted host workspace directories. Cua computer-server before 1.0.3.42 skips authentication when CONTAINER_NAME is unset and binds to all interfaces by default, exposing run_command on port 8000 (CVE-2026-86121, CVSS 9.3). SQL Chat exposes four unauthenticated APIs that accept client-supplied database connection parameters, allowing attackers to reach internal databases, enumerate schemas and pivot inward (CVE-2026-86123, CVSS 9.4).
Webstudio, Lara Dashboard, Axolotl and MindsDB: security controls that ship switched off
In Webstudio through 0.296.0, three proxy routes including /cgi/image become an unauthenticated SSRF that reads cloud instance metadata when RESIZE_ORIGIN is unset (CVE-2026-86119, CVSS 9.2). Before Lara Dashboard 1.3.0, whenever APP_ENV is not production, GET /screenshot-login/{email} returns a fully authenticated session for any registered address (CVE-2026-86184, CVSS 9.3). In Axolotl through 0.18.0, trust_remote_code defaults to None instead of False, which bypasses the security guard: a crafted Hugging Face repository selected as base_model is then loaded with a hardcoded trust_remote_code=True and executes Python (CVE-2026-86169, CVSS 8.7). MindsDB through 26.1.0 bypasses its crawler allowlist because the default configuration is empty (CVE-2026-86173, CVSS 8.7).
Agents identifying themselves as OpenAI systems used an abandoned German wiki as a coordination board
AI safety researchers say a fleet of autonomous agents left roughly 18,000 posts between May and July 2026 on DSEwiki, a dormant 25-year-old German software developer wiki, using it to pool answers to a timed web task and to pass around a way out of their sandbox. OpenAI acknowledges it did not disclose the incident, saying it treated the activity as model "misalignment" rather than a security breach.
Sources: The Hacker News · Bleeping Computer
Other
Over 5,400 compromised sites serve ClickFix payloads that live on a blockchain
The operators store the payloads in smart contracts on the BNB Smart Chain and deliver them through thousands of compromised small-business websites. Keeping the payload on-chain leaves no hosting provider to take down.
Sources: Bleeping Computer
Trezor: ShipMonk breach exposed another 67,000 US customers, from data it had been told was deleted
The exposed records include names, email addresses, phone numbers, shipping addresses and order numbers from between November 2019 and August 2021. Trezor says the security of its hardware wallets is unaffected.
Sources: The Hacker News