Rosetta Daily · Sep 16, 2026

Five products are reported under exploitation in this 36-hour window — Pixel's September zero-day, a WSO2 API Manager JWT bypass, an Acronis cPanel backup plugin, a WooCommerce plugin, and the Admin Menu Editor Pro update channel. The KEV catalogue added nothing on September 15 or 16; its most recent entry is still the Cisco email gateway flaw from the 14th, and the one item here that carries a confirmed number, WSO2's CVE-2026-5430, is not in the table.

Actively exploited

WSO2 API Manager: forged admin tokens pass JWT verification (CVE-2026-5430, CVSS 9.8)

Improper verification of a cryptographic signature lets an attacker mint their own JWT and take over an account. watchTowr reports exploitation attempts in the wild; Hacktron Team is credited with the discovery. A query against kev_catalog returns no entry for this CVE.

Sources: The Hacker News

Google Pixel: September patches close a zero-day used in targeted attacks

The September 2026 Pixel security patches address 110 vulnerabilities, one of them a zero-day already exploited in targeted attacks. The source does not give a CVE for the zero-day.

Sources: Bleeping Computer

WooCommerce Wholesale Lead Capture: unauthenticated file upload plants PHP web shells

The premium WordPress plugin has more than 6,000 active installs. Wordfence describes the flaw as letting unauthenticated attackers upload arbitrary files, including PHP backdoors, and reach remote code execution, and says it has been blocking attacks against it.

Sources: The Hacker News · Bleeping Computer

Acronis backup plugin for cPanel, WHM and Plesk: Linux local privilege escalation

Acronis's own advisory says the high-severity local privilege escalation may already be exploited in the wild. The affected surface is the hosting control panel layer, where several tenants typically share one machine.

Sources: Bleeping Computer

VMware vCenter: CISA says ransomware gangs have joined attacks on the July RCE

CISA warned defenders that ransomware crews are now part of the ongoing exploitation of a critical vCenter remote code execution flaw patched in July. The source does not name a CVE.

Sources: Bleeping Computer

[Added detail] Cisco Secure Email Gateway: the flaw is classed as SQL injection (CVE-2026-76461, CVSS 9.8)

Rapid7's emergency advisory classes it as a SQL injection in AsyncOS, and CISA's KEV entry carries the same name — more specific than the "insufficient validation in the email parsing logic" of the initial disclosure. An unauthenticated remote attacker executes commands as root on the appliance.

Sources: Rapid7

Supply chain

Admin Menu Editor Pro: the maintainer's site was compromised and malicious updates went to 200+ customers

The attacker took over the plugin maintainer's website and pushed backdoored versions through the official update channel, creating a hidden account on roughly 1,500 WordPress sites. The update came from the legitimate channel, so there is nothing suspicious to find on the site side.

Sources: Bleeping Computer

Critical vulnerabilities

Apple: 108 CVEs in one wave across iOS, macOS and Safari

The wave covers iOS 26.7 and 27, iPadOS, macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27 and Safari 26.6.1. The highest, CVE-2026-65414 (CVSS 9.8), is an out-of-bounds write a remote attacker can use to terminate an app or execute code. CVE-2026-65374 (8.8) reaches code execution by connecting to a malicious WebDAV server, and CVE-2026-43686 (8.8) corrupts kernel memory through a malicious NFS server. On the WebKit side, CVE-2026-65390 and CVE-2026-65391 (both 8.8) are memory corruption from web content.

Sources: NVD CVE-2026-65414 · NVD CVE-2026-65374 · NVD CVE-2026-43686

WHMCS 9.0.0–9.0.8 and 8.0.0–8.13.7: deserialization of untrusted data gives remote code execution (CVE-2026-67399, CVSS 9.3)

A remote attacker executes arbitrary code. WHMCS is the billing and automation panel hosting providers run, so one compromised instance carries the provisioning and billing records of every customer under it.

Sources: NVD

Envoy Gateway before 1.7.4 and 1.8.1: the path validator misses double slashes and Lua reads the controller pod (CVE-2026-53713, CVSS 9.1)

Under default Strict validation, to_absolute_normalized_path does not collapse redundant separators before is_critical_path evaluates. Linux resolves a double-slash absolute path as the single-slash path, but the validator does not match the redundant form — so Lua submitted through EnvoyExtensionPolicy reads arbitrary files from the gateway controller pod, Kubernetes service-account material included.

Sources: NVD

IBM MQ: deserialization of untrusted data gives remote code execution (CVE-2026-13293, CVSS 8.8)

Affects LTS and CD branches from 9.1.0.0 through 10.0.0.0. A remote authenticated attacker executes arbitrary code on the system.

Sources: NVD

Plesk Ruby before 1.6.6 and Node.js Toolkit before 2.5.0: custom environment variables run code as root (CVE-2026-68489, CVSS 8.7)

Static code injection, reachable by a remote authenticated user. Same layer as the Acronis flaw above: the shared-hosting control panel.

Sources: NVD

LiteSpeed Web Server Enterprise: one hosting account reaches root on a shared server

cPanel's advisory of September 14 explains that a low-privilege website user can gain root on the machine. On shared hosting many customers' sites run on one host, so a single compromised account reaches the others and the server itself.

Sources: The Hacker News

Vendor advisories

Http4s: a batch of 13 advisories covering both Ember's HTTP/1.1 and HTTP/2 paths

CVE-2026-69204 (CRITICAL) is the parser accepting both Transfer-Encoding and Content-Length — RFC 9112 §6.1 requires treating such a message as a framing error and closing the connection, and not closing it produces CL.TE request smuggling. CVE-2026-69205 is the TE.CL / TE.0 variant from how the Transfer-Encoding value is parsed. The rest cluster on unbounded HTTP/2 buffering (frame payloads, continuation frames, the outbound queue) and on DigestAuth replay plus an unbounded nonce map.

Sources: GHSA-8h4c-x2wg-6xp8

CISA industrial advisories: mySCADA, Wärtsilä, Siemens, Digital Watchdog

mySCADA myPRO Manager ≤2.1 (CVE-2026-73807, CVE-2026-82567, CVSS 9.8) is missing authorization and missing authentication on a critical function, letting an attacker reach privileged management functions and send arbitrary SMS through the connected GSM modem. Wärtsilä FOS-Onboard 5.07.0923.01 (CVE-2026-78225, CVE-2026-81855, 9.1) uses a hard-coded cryptographic server key that can deliver an unauthorized update or extract credentials to impersonate a privileged client. Siemens Reyrolle 7SR5 before 2.70 takes 14 CVEs at once (9.8). Six flaws across the Digital Watchdog VMAX DVR and NVR lines grant full administrative control and turn the device into a network pivot. Siemens Mendix SAML (CVE-2026-80465, 8.7) allows unauthenticated account hijack in specific SSO configurations.

Sources: mySCADA myPRO Manager · Wärtsilä FOS-Onboard · Digital Watchdog VMAX

Microsoft: the September updates' side effects keep landing

Emergency out-of-band updates fix the Remote Desktop Services failures this month's security updates caused, along with Hyper-V and USB audio problems on some versions. Separately, Microsoft confirmed that KB5002914 makes copy and paste silently fail for some Excel users.

Sources: Bleeping Computer · Bleeping Computer

AI security

@zereight/mcp-gitlab: three advisories in one day, one for each safety control

CVE-2026-61559 (CVSS 8.5): with ENABLE_DYNAMIC_API_URL=true the server takes the X-GitLab-API-URL request header as the base URL for its outbound GitLab API calls, validating that the value is a well-formed URL but not where it points, so credentials travel to an attacker's host. No patch existed at report time. CVE-2026-61568: the Streamable HTTP endpoint has no effective Host or Origin allowlist, so a malicious web page can use DNS rebinding to drive a victim's local MCP listener. The third finds that execute_graphql defeats both read-only mode and the GITLAB_ALLOWED_PROJECT_IDS allow-list — the two controls this server relies on to expose GitLab to an LLM agent.

Sources: GHSA-2h44-8472-frjj · GHSA-vmp7-252j-cwp7 · GHSA-5648-rgj9-v224

emp3r0r: the C2 server starts processing before authentication finishes (CVE-2026-61554)

The http_poll transport accepts attacker-controlled polling sessions before CBOR MsgAuth authentication completes, and forwards the request bodies into the C2 dispatch path. A remote unauthenticated attacker can create arbitrary sessions and trigger pre-auth C2 processing.

Sources: GHSA-4595-rvpx-4q34

Incidents

CenterPoint Energy confirms customer data was stolen

An attacker first leaked data allegedly taken from the utility; the company then confirmed that some customers' personal information was compromised in the intrusion.

Sources: Bleeping Computer

Research

Trail of Bits: 1Password's AI patching benchmark counts runs that should not be in the denominator

1Password's FLAWED report, published August 6, leads with models producing clean fixes only 26% of the time. Trail of Bits points out that the figure folds in two kinds of run: experiments that deliberately instructed agents to apply the wrong fix, and experiments in which the agents could not compile or test their patches at all.

Sources: Trail of Bits

Sysdig: from a vulnerable Marimo notebook to an SSH bastion in eight seconds

In an incident Sysdig documented, the operator moved from an exposed Marimo notebook to an SSH bastion within eight seconds of gaining initial access. The speed came from a skilled human, not from tooling.

Sources: The Hacker News