Rosetta Daily · Sep 24, 2026

The three products confirmed under exploitation today all sit on the authentication boundary: Check Point's VPN certificate handling, F5 BIG-IP APM's OAuth authorization server, and MikroTik RouterOS's SSH login path. What is being taken is not the application — it is the box that decides who reaches the application.

Actively exploited (KEV)

Check Point Security Gateway: pre-authentication remote code execution in VPN certificate handling (CVE-2026-85102)

Check Point has confirmed active exploitation. The flaw is in the Security Gateway's VPN certificate-handling functionality and requires no credentials. CISA added it to the KEV catalogue on September 22, alongside but distinct from CVE-2026-93616, which affects a different product surface.

Sources: Bleeping Computer

MikroTrick: two RouterOS flaws chained for full takeover with no password or SSH key (CVE-2026-67279, CVE-2026-86060)

CERT Polska calls the chain MikroTrick: an SSH state-machine flaw (CVE-2026-67279) combined with argument injection in the RouterOS login process (CVE-2026-86060) gives full administrative control of an internet-exposed router without a password, an SSH key, or a completed authentication. Attack logs predate the disclosure. CVE-2026-86060 entered KEV on September 10; CVE-2026-67279 is not in the catalogue.

Sources: The Hacker News

[Added detail] F5 BIG-IP APM: exploitation requires a non-default configuration (CVE-2026-94127, CVSS 9.8)

Rapid7's analysis supplies the precondition: the flaw is reachable only where a BIG-IP virtual server has both an APM access policy and an OAuth profile configured — that is, where APM acts as an OAuth authorization server issuing access tokens to applications. Default configurations are not exposed. F5 has shipped engineering hotfixes. Affected systems typically process traffic at the network edge.

Sources: Rapid7 · The Hacker News

WordPress CVE-2026-87902: attackers moved from probing to writing web shells

Traffic against this flaw had been reconnaissance. Threat actors are now using it to write files to disk that execute shell commands when accessed. The CVE is not in the KEV catalogue.

Sources: Bleeping Computer

Unpatched Ubuntu container escape with public exploit code (CVE-2026-80521, CVSS 7.8)

DepthFirst published research on September 22 showing that a use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host. The flaw was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04 or 22.04 LTS releases. The fix exists; the distribution has not carried it, and the exploit is public.

Sources: The Hacker News

Critical vulnerabilities

cPanel: one hosting account is enough to become root

cPanel disclosed on September 22 that a flaw in its CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and, in the company's own words, take "full control of the server." A second bug disclosed the same day, in the WP Toolkit plugin, allows an account holder to change databases belonging to other accounts. Fixed versions are available for both.

Sources: The Hacker News

Next.js ImageResponse: crafted SVG input leads to server-side code execution

The flaw is in ImageResponse, the feature that generates Open Graph and other social preview images. It applies when an application puts attacker-controlled values — such as text read from the request URL — into the image. Vercel fixed it on September 22. Any site that reflects URL parameters into an OG image route should check itself.

Sources: The Hacker News

GitHub Enterprise Server: notebook-viewer SSRF where response timing becomes a character-by-character secret oracle (CVE-2026-77987, CVSS 9.3)

The notebook viewer validated the scheme and host of a user-supplied URL but not the port, so requests could be directed at internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted one character at a time. An extracted secret could then be used against an internal service to obtain remote code execution.

Sources: NVD

IBM Financial Transaction Manager for OpenShift: more than a dozen advisories in one day

CVE-2026-18163 (CVSS 9.8) is remote code execution through deserialization of untrusted data; CVE-2026-18162 (9.8) passes user-controlled input to the new Function constructor; CVE-2026-18169 (9.9) discloses sensitive information through improper symbolic-link validation; CVE-2026-17645 and CVE-2026-17635 (both 9.1) cover improper privilege management and misconfigured HTTP method-based security constraints. The same batch includes several OS command injections in IBM DataStage on Cloud Pak for Data, among them CVE-2026-16346 (9.9).

Sources: NVD

OpenC3 COSMOS: a user-writable config overlay is executed as code (CVE-2026-77602, CRITICAL)

COSMOS reads configuration from a user-writable overlay (targets_modified/) before the read-only plugin-installed tree, and the config subsystem executes code on those files: ConfigParser renders every file as ERB by default, GENERIC_READ_CONVERSION and GENERIC_WRITE_CONVERSION blocks are evaluated by GenericConversion, and Script Runner suite analysis requires a procedure file. The storage-upload endpoint exempts that area from the admin gate, so an authenticated user below the admin tier can write into it. The same batch carries CVE-2026-77601 (the pypi_url setting interpolated into a shell backtick) and CVE-2026-77394 (stored cross-user XSS via a telemetry screen BUTTON widget).

Sources: GitHub Advisory

plone.app.portlets: a Classic portlet's template field is evaluated as a full TALES expression (CVE-2026-57149, CRITICAL)

The Classic portlet used its user-supplied template and macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user who can add or edit a Classic portlet can supply a value that escapes simple path traversal and is evaluated as arbitrary code. With the default role map, that includes regular users on their personal dashboard.

Sources: GitHub Advisory

WP OAuth Server: the identity assertion is bound to whoever logged in most recently (CVE-2026-82843, CVSS 9.0)

Versions before 6.4.0 do not bind the OpenID Connect identity assertion they issue to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently. A user with the Subscriber role or above can therefore obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.

Sources: NVD

Vaultwarden: revoked organization members keep read and write access to the vault (CVE-2026-95814, CVSS 8.6)

Versions through 1.37.3 omit organization membership status validation from three cipher access-restriction queries — get_user_collections_access_flags, get_group_collections_access_flags and is_in_full_access_group. Revoked and not-yet-confirmed members retain read, write, delete and attachment access to organization ciphers, and the check is missing server-side.

Sources: NVD

Apache BuildStream: a malicious source tarball writes files on the host via symlinks (CVE-2026-82331, CVSS 9.8)

A link-following flaw in the tar source plugin, on Python below 3.12, lets malicious source tarballs write files on the host with the privileges of the user running BuildStream, during source fetching. The impact is mitigated where projects use only trusted sources, and tracking a source tarball pins its SHA256.

Sources: NVD

Supply chain

The HashiCorp Registry used as a malware distribution vector for the first time

Aikido disclosed Go-based malware distributed through two Go modules and two Terraform providers, including gocommunity-io/dockerd (222 downloads) and entries under kreuzwenker. This is the first time threat actors have used HashiCorp's centralized registry as a distribution vector; this class of delivery has until now concentrated on npm and PyPI.

Sources: The Hacker News

MemTensor packages compromised on npm and PyPI, delivering the cross-platform Go implant sckit

Two legitimate MemTensor packages were compromised across npm and the Python Package Index to push a Go-based implant dubbed sckit, with builds for Windows, Linux and macOS. Affected entries include several versions of @memtensor/memos-cloud-openclaw-plugin. Aikido, SafeDep, Socket and StepSecurity each published reports.

Sources: The Hacker News

A GitLab issue-by-email address is a credential

The private email address GitLab gives each user for filing issues by email functions as a credential. Anyone who obtains it can email a patch that GitLab commits in that user's name, to any branch they can push to including main, and can start CI/CD jobs that run as them. GitLab exposes the address behind a button labelled "Email work item to this project."

Sources: The Hacker News

Web security research

One Kubernetes YAML file can hand over an entire GCP organization

Varonis analysed a confused-deputy problem in Google Kubernetes Config Connector: a Kubernetes user with limited permissions can exploit the authority granted to Config Connector to turn a single YAML file into a path to organization-wide privilege escalation. The root cause is that Config Connector's privilege boundary and the Kubernetes RBAC boundary do not coincide.

Sources: Bleeping Computer

Burp Suite adds HTTP/3, and Turbo Intruder now exceeds 100,000 requests per second

PortSwigger shipped HTTP/3 support in Turbo Intruder, which comfortably exceeds 100,000 requests per second over Wi-Fi and auto-tunes. The framing is the useful part: how many bugs have been missed because not enough requests were sent? Wordlist size has been constrained by throughput, and that constraint just moved.

Sources: PortSwigger Research

AI security

Open-source agent frameworks used for card skimming at scale: 600,000 records, skimmers on more than 100 sites

A financially motivated threat actor used open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records. The agent framework here is not the target — it is the attacker's automation.

Sources: Bleeping Computer

mcp-toolbox-sdk-python: the token cache is not keyed by audience, so tokens go to the wrong service (CVE-2026-19202, CVSS 9.1)

A caching flaw in the toolbox-core package causes the same Google ID token to be cached and reused across different audiences, because the module-level cache does not key its entries by the requested audience. If an application authenticates to two or more audiences within the same process, a valid, unexpired token minted for a sensitive service can be retrieved from the cache and sent to a secondary one. An attacker who operates, compromises or monitors traffic to that secondary service captures the token.

Sources: NVD

Other

Microsoft: September updates break Always On VPN connections on some Windows 11 systems

This is a further entry on the September known-issue list, distinct from the update side effects already published and closed.

Sources: Bleeping Computer

Microsoft files an Outlook remote code execution flaw it had omitted from the September list (CVE-2026-70125)

The CVE was addressed by updates released in September 2026 but was inadvertently left out of the September Security Updates listing. MSRC describes the entry as an informational change; customers who already installed the September updates need take no further action.

Sources: MSRC

FBI and CISA publish guidance for critical infrastructure operators working with third-party ICS integrators

The fact sheet addresses critical infrastructure entities that outsource control system design, installation, operational data analysis, device support and daily operational control to third-party industrial control system integrators, and sets out how to reduce risk across those arrangements.

Sources: CISA