Rosetta Daily · Sep 26, 2026
Incidents and response
Kiteworks: vendor asks customers worldwide to power servers down for six hours on Saturday
Secure file-sharing vendor Kiteworks notified customers to shut their servers down during a six-hour window on Saturday, citing threat intelligence that an attack on the product may be imminent. The notice carries no CVE and no confirmed intrusion — it takes systems offline ahead of the evidence.
Sources: Bleeping Computer
Bitget: $351.6 million moved out of hot and warm wallets
The exchange says its security systems flagged unauthorized transfers from a limited number of hot wallets at 18:31 UTC on September 24, 2026, totalling $351.6 million; cold wallets and the overwhelming majority of platform assets were unaffected. Bitget attributes the entry point to a backend compromise and the activity to suspected North Korean actors.
Sources: The Hacker News · Bleeping Computer
Actively exploited (KEV)
[Added detail] Oracle PeopleSoft: CVE-2026-35273 back under mass exploitation, WAF rules bypassed with one URL-encoded character
Mandiant and the Google Threat Intelligence Group recorded a new wave of mass exploitation by UNC6240, with targeting expanded from the mostly academic victims of June to multiple sectors and regions. What had been holding the exploit off was a string-matching WAF rule covering the PSEMHUB endpoint; the actor URL-encoded a single character in the request and walked past it. The CVE has been in KEV since June 12.
Sources: Mandiant
[Added detail] Microsoft SharePoint Server: CVE-2026-65660 added to KEV
CISA listed it on September 25 on evidence of active exploitation, under CWE-94 (code injection). The catalogue entry records ransomware_use as Unknown.
Sources: CISA · Bleeping Computer
[Added detail] MikroTik RouterOS: CVE-2026-67279 added to KEV
Listed the same day under CWE-841 (improper enforcement of behavioral workflow). This is the SSH state machine half of the MikroTrick chain; the other link, CVE-2026-86060, has been in the catalogue since September 10. Both ends of the chain are now marked as known-exploited.
Sources: CISA
[Added detail] WordPress Core: CVE-2026-87902 added to KEV
CWE-98 (remote file inclusion), CVSS 9.2. An unauthenticated attacker can steer get_page_template() page-template resolution onto any readable local .php file. Exploitation began within hours of public disclosure.
Sources: CISA · The Hacker News
[Added detail] Roundcube Webmail: the flaw under exploitation is CVE-2026-48842 (CVSS 8.1)
The in-the-wild activity reported by the Canadian Centre for Cyber Security maps to a pre-authentication SQL injection in the virtuser_query plugin, arising from preg_replace() backslash handling, in 1.6.x before 1.6.16 and 1.7.x before 1.7.1. It is not in the KEV catalogue.
Sources: The Hacker News
Critical vulnerabilities
Flarum fof/oauth: an unverified Discord email is trusted as verified, giving unauthenticated account takeover (CVE-2026-92161, CRITICAL)
Discord lets an account use an unverified email address once its phone number is verified, and returns that address in the OAuth response with "verified": false. Affected versions never check the flag and hand the address to Flarum for account matching. Putting a target's address on a Discord account is enough to log into the matching forum account.
Sources: GitHub Advisory
IO::Socket::SSL::SelfCertificate 1.00: the CPAN distribution is itself malware (CVE-2026-97230, CVSS 9.8)
generate_certificate runs a Python script saved as a certificate file; the script retrieves code from a hardcoded, base64-obfuscated http URL and executes the response body directly as the current user. The name trades on the widely used IO::Socket::SSL.
Sources: NVD
Apache Qpid Broker-J through 10.1.0: the session identifier survives authentication (CVE-2026-92609, CVSS 9.8)
Session fixation in the HTTP management interface: the same session id is retained across successful authentication, letting a remote attacker take over an authenticated management session. Fixed in 10.1.1.
Sources: NVD
Lemonldap::NG::Portal: OAuth2 token introspection skips the client secret for public relying parties (CVE-2026-92288, CVSS 9.1)
checkEndPointAuthenticationCredentials() omits the secret comparison for a relying party marked public, while still returning an authentication method deduced from the request — so an unauthenticated caller can introspect tokens. Affects 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4.
Sources: NVD
Automation Web Platform (Notifications and OTP for WooCommerce) through 4.8.6: a public REST route leads straight to privilege escalation (CVE-2026-14281, CVSS 9.8)
POST /wp-json/wawp/v1/signup/<op> enforces no permissions, and finish_registration_logic has no key allowlist, so attacker-supplied fields are copied into the registration flow as given.
Sources: NVD
Customer Reviews for WooCommerce through 5.120.0: unauthenticated visitors can permanently delete Media Library attachments (CVE-2026-89055, CVSS 9.1)
The plugin does not verify that the caller is authorized to perform the action. What can be deleted includes administrator-owned product images and site logos.
Sources: NVD
s2Member through 260814: the first_nameparameter reaches a PHP execution path (CVE-2026-19804, CVSS 8.8)
esc_refs() strips regex backreferences but not PHP tags, and the parameter value is then substituted in, giving remote code execution.
Sources: NVD
Elementor Website Builder through 4.3.1: CSRF creates administrator accounts (CVE-2026-62062, CVSS 8.8)
An unauthenticated attacker who gets a logged-in administrator to load a crafted page can have an administrator account created on the site. Elementor is among the most widely installed WordPress page builders.
Sources: NVD · Bleeping Computer
Catalyst::Seal before 0.03: the dispatch memo is keyed on the request path alone (CVE-2026-85491, CVSS 8.8)
It replaces the Catalyst dispatcher's prepare_action with a version that memoises how a path resolved — which dispatch type matched, at which level, what was left over as arguments. The key is the request path and nothing else. One request can therefore disable a path, or route a later one past an authorization check.
Sources: NVD
Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0: local file inclusion in dashboard widget sequence handling (CVE-2026-97730, CVSS 8.5)
An authenticated attacker who can modify dashboard settings and write files to the firewall (say /tmp/test.widget.php) can submit a crafted widget sequence and have it executed as PHP.
Sources: NVD
Akia keyless entry cloud service: the unlock action trusts a client-supplied room identifier (CVE-2026-97898, CVSS 8.4)
The identifier is never authorized server-side against the authenticated guest's booking, so a guest can unlock other rooms at the property. The consequence here lands on the physical side, not the data side.
Sources: NVD
AI security
Knowns MCP docs and memory tools: path traversal reads, writes and deletes .mdfiles outside the project sandbox (CVE-2026-86439, HIGH)
Get, Create, Update, Rename and Delete in both doc_store.go and memory_store.go concatenate user-controlled paths onto the storage root.
Sources: GitHub Advisory
khoj: the /home/{file_path}endpoint has no authentication and no normalization, and reads arbitrary server files
web_client.py concatenates the user-supplied file_path onto the home_directory constant with no traversal filtering and no authentication required.
Sources: GitHub Advisory
CliInvoke: the shell wrappers and the runner factory each reassemble caller arguments into a command line (CVE-2026-100368, CVE-2026-100369, both HIGH)
The first re-runs a caller-supplied target and arguments inside pwsh -Command / cmd /c; the second joins runner arguments, the caller's target and the caller's arguments into a single ProcessStartInfo.Arguments string and hands it to the OS parser. Both take arguments that were already separated and turn them back into one line of text.
Sources: GitHub Advisory · GitHub Advisory
Vendor advisories
Microsoft published 110 Chromium-derived Edge advisories in a single drop
All posted at 14:00 UTC on September 25, covering type confusion and out-of-bounds writes in V8, buffer overflows in ANGLE and Tint, missing authorization in DevTools and Extensions, and information leaks in Passwords and Mobile, among others. Chrome assigned every CVE; Edge picks up the fixes by ingesting Chromium.
Microsoft retroactively publishes two Office CVEs omitted from the July and August updates (CVE-2026-100208, CVE-2026-100206)
The first is an Outlook remote code execution addressed by the August updates; the second an Office information disclosure addressed in July. Both are informational entries only — customers who installed those updates need take no further action.
Windows: desktop loading failures and black screens from the August preview updates on; WDS deprecated in the next server release
Microsoft confirmed that some users who installed the August 2026 preview updates and subsequent updates hit desktop loading issues, including black screens. Separately, the Windows Deployment Services server role will be deprecated starting with the Windows Server release after 2025.
Sources: Bleeping Computer · Bleeping Computer
Web security research
Trail of Bits: putting MPC inside a TEE can hand threshold-signature security to the untrusted host
Threshold signature schemes are increasingly deployed inside trusted execution environments, on the theory that the two roots of trust compound — MPC distributes trust across parties, the TEE anchors it in the hardware manufacturer and its attestation infrastructure. Trail of Bits argues that running an MPC protocol inside a TEE without accounting for the untrusted host introduces its own problems: a malicious host can roll back the filesystem state after a threshold signer deletes a used pre-signature, making that pre-signature usable again.
Sources: Trail of Bits