Rosetta Daily · Sep 19, 2026
Four of today's items turn on the same weakness: the identifier stayed the same while what it resolves to did not. Plugin4Shell swaps a plugin a coding agent had pinned to a reviewed version; a CDN domain that thousands of pages still hardcode was re-registered by someone else; and two new stealers arrive under npm package names and search-ranked GitHub repositories carrying vendor names. What was pinned, in each case, was the name.
Actively exploited (KEV)
Linux kernel: three flaws added to the KEV catalogue on one day (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266)
CISA cited evidence of active exploitation for all three and set remediation for 21 September — three days, the shortest interval the catalogue uses. CVE-2025-39682 (CVSS 9.8) is an improper check in the TLS receive path, where a zero-length record retrieved from rx_list bypasses the intended recvmsg() record-type handling. CVE-2025-39964 is a race condition: concurrent writes to the same AF_ALG socket interleave data unpredictably and leave the socket's internal state inconsistent. CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT target, where rewriting an ARP sender hardware address writes directly into a nonlinear socket-buffer fragment backed by a splice-imported file page.
Sources: CISA · The Hacker News
Linux kernel: working exploit code published for four other local-root flaws
A researcher released exploit code for four kernel flaws that each let a local user gain root. Maintainers fixed all four over the past few weeks, so a machine on a current kernel is not affected; what changed is that the code is now public, and the window for unpatched machines closed with it. These four are separate from the three KEV entries above.
Sources: The Hacker News
Critical vulnerabilities
Google Chrome 153.0.8010.52: three sandbox escapes in one release (CVE-2026-93372, CVE-2026-93374, CVE-2026-93373)
All three let a remote attacker execute code outside the sandbox: a WebGL buffer overflow on Android through a crafted page (CVSS 9.6), a use-after-free in Dawn on Android (9.6), and a use-after-free in Extensions reached through a crafted Chrome extension (9.6). The same release fixes a V8 type confusion and two PDFium memory bugs that stay inside the sandbox (CVE-2026-93377, CVE-2026-93381, CVE-2026-93382, all 8.8).
Sources: NVD
Microsoft Azure: privilege escalation in three data-plane services (CVE-2026-85878, CVSS 9.9; CVE-2026-87701, CVSS 9.6; CVE-2026-70009, CVSS 9.3)
Improper authorization in Azure Database for PostgreSQL, injection into a downstream component in Azure Cosmos DB, and path traversal in Azure Arc. The first two need an authorized attacker on the network; Arc does not. This is a different product line from the Copilot and Azure AI batch of the previous day.
Sources: NVD
[Added detail] Azure AI Foundry: the missing-authentication flaw is scored CVSS 10.0 (CVE-2026-85889)
NVD published the score. Missing authentication for a critical function lets an unauthorized attacker elevate privileges over a network. Microsoft says the fix is server-side and no customer action is required.
Sources: The Hacker News
WordPress core: Click2Shell forces a theme install from a crafted link, and can chain to code execution
WordPress patched a set of core flaws, one of which lets a crafted link opened by a logged-in administrator install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported it, calls the chain Click2Shell. On its own the flaw only installs a directory theme; reaching code execution takes more.
Sources: The Hacker News
kcp front-proxy: any authenticated tenant becomes system:masters in any workspace (CVE-2026-61682, CRITICAL)
The front-proxy does not strip client-supplied identity headers before forwarding to shards. A tenant injects its own X-Remote-Group and X-Remote-Extra-* values, and the shard trusts them as authenticated identity.
Sources: GitHub Advisory
Grav CMS: five advisories, two of them CRITICAL (CVE-2026-75827, CVE-2026-75828, CVE-2026-72819, CVE-2026-75837, CVE-2026-74907)
Two are the same kind of failure: a safety gate that recognises a shape rather than a behaviour. The blueprint dynamic-data bare-function branch is gated by a denylist that omits error_log, giving arbitrary file write (CVE-2026-75827); and detectXss() misses an event-handler attribute that follows an unpaired quote inside an unquoted attribute value, giving stored XSS (CVE-2026-75828). A third goes further — one invalid UTF-8 byte disables all six detectXss patterns at once, because every one carries the PCRE u modifier (CVE-2026-75834). The rest: a logged-in user reaches command execution through a .zip upload (CVE-2026-72819), an admin.users operator escalates to super-admin because the group blueprint omits the security@: admin.super guard its sibling account blueprint carries (CVE-2026-75837), and the static asset server has no directory-boundary check (CVE-2026-74907).
Sources: GitHub Advisory
HGiga OAKlouds: unauthenticated deserialization gives remote code execution (CVE-2026-93467, CVSS 9.3; CVE-2026-93468, CVSS 8.7)
Sending crafted serialized content runs arbitrary code on the server with no authentication. A companion relative path traversal reads arbitrary system files.
Sources: NVD
Perses: three authorization gaps in one day (CVE-2026-63199, CVE-2026-63445, CVE-2026-63458, all HIGH)
The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check — and the two are distinct, independently grantable roles. Separately, a user who is only a viewer on one project reads another project's dashboards and datasources by appending ?project=. And on filesystem-backed deployments the project value is bound from the request into the Query struct and never checked for traversal characters.
Sources: GitHub Advisory
Mnemosyne: the sync server decoded JWTs and never verified them (CVE-2026-59163, CRITICAL)
The authentication check decoded bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, letting an unauthenticated attacker impersonate any user.
Sources: GitHub Advisory
AnyIO: internationalized host names encoded with IDNA 2003 allow TLS certificate spoofing (CVE-2026-63374, CRITICAL)
It affects connect_tcp() and TLSStream.wrap() where the connection has already been hijacked by other means. Two more in the same batch: open_process() forwards the wrong variable when extra_groups is set and can retain the parent's supplementary groups (CVE-2026-63349, HIGH), and process-pool workers can block indefinitely because their stderr pipe is never drained (CVE-2026-64847).
Sources: GitHub Advisory
Browsertrix and OpenReception: a Git URL and a passkey, neither validated (CVE-2026-54501, CVSS 9.4; CVE-2026-54460, CVSS 9.8)
Browsertrix 1.15.0 through 1.22.8 passes Git URLs supplied as Custom Behaviors into a command without sanitization. OpenReception before 1.1.1 accepts a request-body userId and an attacker-supplied passkey at POST /api/auth/passkeys with no authenticated session, and never calls verifyRegistration.
MongoDB C Driver: the server a client connects to can overflow the client's heap (CVE-2026-93393, CVSS 9.2)
Built with the Windows platform TLS backend, the driver can be made to write uncontrolled data outside a heap allocation while processing incoming encrypted data from the remote endpoint. The direction is the point: this is the server attacking the client.
Sources: NVD
XWiki rendering: eval injection lets anyone who can edit a document run Groovy or Python (CVE-2025-53837, CRITICAL)
Being able to edit one's own user profile is enough. Script macros give arbitrary code execution, including unrestricted read and write access to all wiki content.
Sources: GitHub Advisory
Five WordPress plugins: unauthenticated SQL injection on AJAX actions (CVE-2026-87767, CVE-2026-87770, CVE-2026-87771, CVE-2026-87774, CVE-2026-87775, all CVSS 8.6)
wp shortcut link and advertisement baner, Price Drop Alert for WooCommerce, Product Question and Answer, and Tz Weekly Radio Schedule (two entries) each build a query from an unsanitized parameter on an action reachable without logging in. Separately, AF Companion before 2.2.0 does not validate the type of files uploaded through one of its import features, letting a low-privileged store-management role upload PHP (CVE-2026-84738, CVSS 9.1).
Sources: NVD
Grafana: a plugin archive escapes its install directory through chained symlinks (CVE-2026-15815, CVSS 8.8)
Grafana OSS and Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted archive chains relative symlink entries to escape the plugin installation directory and write arbitrary files, including an executable.
Sources: NVD
NASA CryptoLib: the telecommand receiver picks its security association out of the frame it is verifying (CVE-2026-79954, CVSS 8.7)
CryptoLib 1.5.0 selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, and does not verify that the selection matches what the channel should be using — an authentication downgrade on the uplink path.
Sources: NVD
AI security
AWS AgentCore Harness: prompt injection reaches agent credentials under the default configuration
Unit 42 analyses how AgentCore Harness's default settings let prompt injection exfiltrate credentials, and publishes the configuration steps that close it.
Sources: Unit 42
Plugin4Shell: a repository owner can swap a plugin four coding agents had pinned
Air Security says whoever controls a plugin's code repository can substitute the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version. The firm says Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0.
Sources: The Hacker News
MCP servers: three projects, three ways the boundary is not where it looks
Obot fetches an attacker-controlled remote MCP server URL server-side at registration with no validation of the destination, and no guard against loopback, link-local or RFC1918 ranges (SSRF, HIGH); its MCP Registry endpoints under /v0.1/* stay readable by unauthenticated callers even with OBOT_SERVER_ENABLE_REGISTRY_AUTH=true (MEDIUM); and its OAuth dynamic client registration accepts an arbitrary external redirect URI and auto-completes without a consent screen, giving API token theft through audience confusion (HIGH). ToolHive's default network profile (insecure_allow_all) lets a containerized MCP server reach host-local services via host.docker.internal, the ToolHive API among them (CVE-2026-58197, HIGH). Process Compose's MCP SSE listener accepts browser-origin requests before any Host or Origin validation, so a malicious website can drive a developer's local tools by DNS rebinding (CVE-2026-77339, MEDIUM).
Sources: GitHub Advisory · GitHub Advisory · GitHub Advisory
LMDeploy: a value from a HuggingFace model config reaches eval() (CVE-2026-33625, HIGH; CVE-2025-66455, CRITICAL)
lmdeploy/pytorch/config.py evaluates the quant_dtype value taken from a model's quantization config, so publishing a crafted HuggingFace model is enough to run Python on whatever loads it. The same batch fixes pickle deserialization on the PD-disaggregation control plane (recv_pyobj on a ZeroMQ PULL socket) and a bypass of the _is_safe_url SSRF check.
Sources: GitHub Advisory · GitHub Advisory
vLLM: requests with max_tokens=0 exhaust decode-worker memory (CVE-2026-93436, CVSS 8.7)
Through 0.29.0, prefill/decode disaggregated deployments never clean up decode-side metadata for rejected requests, so a remote attacker submitting such requests consumes worker memory without bound until it stops serving.
Sources: NVD
Supply chain
An abandoned CDN domain was re-registered, and thousands of sites still call it
The CDN was wound down years ago and the domain it served assets from was allowed to expire; in July 2025 someone else registered it. Websites, code repositories and documentation pages still carry hard-coded references to hostnames beneath it, and what those hostnames now serve is decided by whoever holds the domain.
Sources: The Hacker News
Two new stealers arriving through developer channels: WeaselBiscuit and Rapuncel
Thirteen npm packages deliver a previously undocumented JavaScript stealer called WeaselBiscuit, which OpenSourceMalware says overlaps functionally with BeaverTail and another strain tied to North Korea's Contagious Interview campaign. Separately, SEO-optimized GitHub repositories impersonating well-known software firms — a fake LastPass Authenticator among them — push a stealer called Rapuncel.
Sources: The Hacker News · Bleeping Computer
Other
Microsoft: three September update side effects closed
Microsoft fixed the bug producing false "Defender Antivirus is turned off" alerts after recent updates, and the copy-and-paste failures in Excel 2016 caused by the September KB5002914 update. Teams will also let administrators adjust the list of file extensions it blocks.
Sources: Bleeping Computer · Bleeping Computer · Bleeping Computer