Rosetta Daily · Sep 17, 2026

Twelve advisories landed for the djust framework in one day, and read together they are twelve faces of one defect: authorization bypass, broken object-level access control, multi-tenant isolation failure, client mass-assignment, unsigned state restored as trusted, CSRF over SSE. They share a sentence — the check exists on the HTTP path and not on the WebSocket/SSE path. Add a transport and the controls on the old one do not come with it.

Actively exploited (KEV)

Cisco Identity Services Engine: unauthenticated attackers bypass the web management interface to reach the device (CVE-2026-76460)

Cisco says the flaw is being exploited in attacks and shipped updates at maximum severity, covering ISE and the ISE Passive Identity Connector. CISA added it to the exploited catalogue on September 16 with a federal remediation deadline of September 19. The number sits next to the Cisco Secure Email Gateway SQL injection added on September 14 (CVE-2026-76461), but these are two products and two separate flaws.

Sources: Bleeping Computer · CISA

[Added detail] Acronis backup plugin for cPanel / WHM / Plesk: local privilege escalation (CVE-2026-87886, CVSS 7.8)

CISA has placed it in the exploited catalogue with a September 19 deadline. The cause is insecure file permissions, and it is local — the attacker needs an ordinary account on the host first.

Sources: The Hacker News · CISA

[Added detail] Google Pixel cellular modem: a logic error lets permission checks be bypassed (CVE-2026-58704, CVSS 8.0)

CISA issued a separate alert adding it to the catalogue, same September 19 deadline. September's Pixel patches fixed 110 vulnerabilities in total; this is the one under targeted exploitation.

Sources: The Hacker News · CISA

Issabel Framework: a hard-coded credential allows unauthenticated remote OS command execution (CVE-2026-89026, 9.8 under CVSS 3.1 and 9.3 under 4.0)

Issabel is the web management framework for an open-source unified-communications PBX. An unauthenticated remote attacker can use the hard-coded credential to run arbitrary operating system commands, and the flaw is under active exploitation. It is not in the KEV catalogue.

Sources: The Hacker News

Critical vulnerabilities

djust: 12 advisories, an entire authorization layer missing from the live transport (CVE-2026-61594 and others, up to CRITICAL)

The worst is an authorization bypass on the WebSocket/SSE mount path: the live transport authorizes through its own check_view_auth rather than Django's View.dispatch() chain, so LoginRequiredMixin, PermissionRequiredMixin, custom dispatch() guards and the admin extension's staff gate are all skipped. The same batch includes multi-tenant isolation set only by the HTTP middleware, leaving the tenant unset on the live path while the tenant-aware queryset fails open and returns other tenants' rows (CVE-2026-61595); per-object permissions enforced on mount and event but not on the initial HTTP GET render, SPA navigation or embedded child views (CVE-2026-61596); an unsigned state_json from the page restored as trusted state on reconnect, so a client can flip is_admin to true itself (CVE-2026-61591); and a default update_model handler that setattrs a client-supplied field name behind nothing but a 14-entry denylist of framework internals (CVE-2026-61598). Fixed in djust 1.0.7.

Sources: GHSA-xhhm-f6hp-2qwj · GHSA-3492-cvg7-9mr2 · GHSA-c7c5-5j6r-q957 · GHSA-c67v-vqrp-m5wj

@zereight/mcp-gitlab: unauthenticated arbitrary file read yields the server's GitLab access token (CVE-2026-61560, CRITICAL)

SSE=true mode exposes every MCP tool with no authentication, and among them upload_markdown reads arbitrary local files through an unsanitized file_path parameter and uploads them to a GitLab project. Together, any unauthenticated network-reachable attacker can read /proc/self/environ to take the GITLAB_PERSONAL_ACCESS_TOKEN and fully take over that GitLab account.

Sources: GHSA-cv3r-c5h8-f4g5

Parallels Desktop for Mac: an ordinary local account can run code as root, and Intel Macs cannot install the fix

JFrog says the attack needs code already running on the machine as a normal user and does not work over the network. The fix is in Parallels Desktop 27, a version Intel Macs cannot install — for those users there is effectively no patch.

Sources: The Hacker News

AI security

LMdeploy: the RPC server pickle-deserializes whatever it receives (CVE-2025-59953, CRITICAL)

call_and_response(), the core function of AsyncRPCServer, calls pickle.loads() on incoming messages with no sanitization, so sending a message to that RPC server is remote code execution.

Sources: GHSA-5h8j-6crg-7rmw

RMCP: the OAuth resource identifier goes unvalidated, and an unauthenticated request permanently grows the session table (CVE-2026-63127, CVE-2026-63128, both HIGH)

The first is that rmcp does not validate the resource parameter in OAuth Protected Resource metadata (RFC 9728), so a malicious MCP server can redirect the OAuth flow to a legitimate authorization server and steal the resulting access token. The second is that handle_post in the Streamable HTTP server allocates the session before validating the body and early-returns on failure without calling close_session — every well-formed JSON-RPC POST that is not an InitializeRequest leaks one permanent entry.

Sources: GHSA-33f5-2c5q-wgwj · GHSA-9pj6-vhgr-3mwh

One ordinary browser extension can take over the AI assistants built into five products

Forever Security showed that once an ordinary extension is installed, a single click gives it access to the AI built into each of five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. The researchers demonstrated takeover on Comet, Edge and others.

Sources: The Hacker News

vLLM: the chat endpoint has no duration cap against audio decompression bombs (CVE-2026-57173, MEDIUM)

The decode-duration guard max_duration_s (600 seconds by default) that protects against audio decompression bombs is wired only into the speech-to-text path, /v1/audio/transcriptions. The input_audio parts of /v1/chat/completions call the same decoder with no limit at all, so an unauthenticated client needs only a few kilobytes of crafted audio.

Sources: GHSA-hcwq-8wjf-3gcr

Supply chain

The Shai-Hulud worm reached about 100 repositories through one hijacked AI coding-assistant session

Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider. Before the repository spread, the assistant recommended software the attacker had poisoned, and the recommendation was accepted. The worm then stole repository secrets and source code.

Sources: The Hacker News

Vendor advisories

Windows 11 KB5124008 breaks domain trust on some enterprise systems

Microsoft is investigating reports that the update breaks domain trust relationships, leaving users unable to log in with valid domain credentials on affected systems.

Sources: Bleeping Computer

Windows Server 2022 reaches end of mainstream support next month

It then enters extended support, running to October 2031.

Sources: Bleeping Computer

Security research

Talos: some of the vulnerabilities AI finds cannot actually be patched

Talos expects more of them, with a subset difficult or effectively impossible to patch under real conditions, and argues for network segmentation, rigorous visibility and NGFW/IPS combinations as a compensatory layer.

Sources: Cisco Talos

CISA publishes guidance on deploying cyber decoys

The target is adversaries who use legitimate credentials, native tools and living-off-the-land techniques for discovery, lateral movement and data access — behaviour conventional detection struggles with. The guidance covers how defensive teams at varying maturity levels plan and implement decoy strategies.

Sources: CISA

Two library flaws about resources and paths: a socket leak in node-opcua and PATH hijacking by OpenTelemetry on macOS (CVE-2026-68904, CVE-2026-81192, both HIGH)

Under its default configuration (keepSessionAlive: true), node-opcua accumulates TCP sockets in FIN-WAIT-2 during automatic reconnection whenever the OPC UA server has clock skew relative to the client, until memory is exhausted and the process is OOM-killed. OpenTelemetry.Resources.Host separately launches sh and ioreg by bare name rather than absolute path on macOS, resolving both through PATH, which lets a less-privileged local attacker run code as the host application.

Sources: GHSA-r2pf-9cw4-5j65 · GHSA-v8pv-4842-x354

Other

Spain's data protection agency receives its first report of an AI-powered data breach

The reported attack was allegedly carried out with an AI agent powered by a known large language model.

Sources: Bleeping Computer