Roundcube Webmail has released security updates for its 1.6 LTS and 1.7 branches, fixing 12 vulnerabilities that could expose users and servers to cross-site scripting, email header injection, cross-user data access, remote-content bypasses, and server-side request forgery attacks.

The new releases, Roundcube 1.6.19 and 1.7.4, address flaws in how the open-source webmail platform processes email content, HTML, Cascading Style Sheets, attachment metadata, contact groups, and remote URLs. Administrators running production deployments of Roundcube 1.6.x or 1.7.x are urged to update as soon as possible.

One of the most serious issues fixed is a zero-click stored cross-site scripting vulnerability involving the injection of TNEF MIME tags into attachment URLs.

TNEF, or Transport Neutral Encapsulation Format, is commonly associated with Microsoft Outlook attachments. An attacker could potentially send a specially crafted email that triggers malicious script execution when the victim views the message, without requiring the user to click a link or open an attachment.

The updates also fix another XSS issue in Roundcube’s HTML editor when handling text/enriched email content. Cross-site scripting weaknesses can allow attackers to execute JavaScript in a victim’s webmail session, creating opportunities to steal session tokens, alter mailbox settings, read messages, or perform actions as the logged-in user.

Several fixes address email header injection risks. These bugs affected the subject field, recipient display name, and an identity’s organization field.

Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.

Roundcube also patched a cross-user access issue in SQL-based address books. The flaw involved adding or removing members from contact groups.

It could allow one user to modify another user’s group associations under certain conditions. This type of issue can compromise contact privacy and the integrity of address book data in shared or hosted Roundcube environments.

Remote-content protections received multiple fixes, addressing CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques that could bypass remote-content blocking.

Roundcube Webmail Patches 12 Security Flaws

The updates further fix an is_local_url() validation bypass involving fully qualified domain names with a trailing dot in stylesheet URLs. Attackers could exploit differences in URL parsing to make an external resource appear local and bypass intended restrictions.

A server-side request forgery bypass was also resolved in the Roundcube CSS proxy. The weakness involved hexadecimal IPv6-mapped IPv4 addresses, which could potentially help an attacker bypass address validation and force the server to request internal or restricted network resources.

Roundcube said full technical details are available in the release notes for versions 1.6.19 and 1.7.4. The project strongly recommends that all organizations operating affected Roundcube installations apply the updates promptly.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Roundcube Webmail Patches 12 Security Flaws, Including Zero-Click XSS and SSRF Bypass appeared first on Cyber Security News.

Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, allowing unauthenticated attackers to execute remote code in vulnerable enterprise web applications.

The issue primarily affects Telerik’s RadAsyncUpload component, a widely used file-upload control in ASP.NET WebForms applications.

Progress Software has indicated that the flaw impacts versions from 2010.1.309 to 2026.2.519. The vulnerability was addressed in version 2026.2.708, released as part of the 2026 Q2 SP1 update.

The vulnerability chain includes four distinct flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While these vulnerabilities are serious, their exploitation requires specific conditions and cannot be applied universally to all default Telerik deployments.

At the heart of the issue is CVE-2026-13182, a padding oracle vulnerability within RadAsyncUpload’s handling of encrypted client states. Telerik employs AES-CBC encryption to safeguard configuration data exchanged between the server and the user’s browser.

A padding oracle occurs when the application provides different error responses for invalid encrypted data. In this case, malformed data results in a distinct error compared to valid padding with invalid JSON content.

Telerik Flaw Chain

This discrepancy enables an attacker to submit modified ciphertext repeatedly, gathering information on how the application decrypts it, ultimately allowing them to recover sensitive data and forge modified encrypted values without needing the encryption key.

Even when the ASP.NET customErrors feature is enabled, researchers noted that exploitation remains possible, albeit more challenging and time-consuming through timing analysis.

Exploiting this oracle, researchers manipulated Telerik’s serializedConfiguration data, which governs settings within the upload control. This enabled attackers to alter the AllowedFileExtensions field, permitting DLL files to be uploaded.

The attack utilized a CBC forgery technique, introducing a “sacrificial” encrypted block within a JSON string. This method preserved necessary configuration from legitimate page loads, including session controls, while inserting malicious entries in the configuration.

The second critical vulnerability, CVE-2026-13181, pertains to the management of upload metadata, where Telerik resolves the .NET type name supplied via the AsyncUploadTypeName value without a proper allowlist.

If a server-side FileUploaded handler reads the UploadResult property, Telerik deserializes corrupt data into the designated type. This behavior can be exploited together with the System.Configuration.Install.AssemblyInstaller gadget, enabling the application to load an uploaded mixed-mode DLL from a temporary directory, executing native code via its DllMain entry point.

The proof-of-concept demonstrated execution of a web shell within the IIS worker process, while an in-memory variant could run commands without writing any files to disk.

To successfully exploit this vulnerability chain, attackers must access a page containing a RadAsyncUpload control with an active server-side FileUploaded event handler that reads UploadResult.

Additionally, an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey must be configured for the exploitation path to function, which is recommended as a security measure.

Organizations utilizing Telerik UI for ASP.NET AJAX are urged to upgrade immediately to version 2026.2.708 or later. It is critical for administrators to identify pages using RadAsyncUpload and review their upload event handlers to monitor for potential exploitation.

Vigilance against suspicious IIS activity is also necessary, with particular attention to instances of w3wp.exe unexpectedly spawning cmd.exe, the appearance of DLL files in temporary folders, and unexpected .aspx files in web roots.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Telerik Flaw Chain Lets Unauthenticated Attackers Turn Padding Oracle Into Remote Code Execution appeared first on Cyber Security News.

N-able has released N-central 2026.3 Hotfix 4 to fix CVE-2026-86218. This critical vulnerability could allow an unauthenticated attacker to execute code remotely on an exposed N-central server.

The update, identified as build 2026.3.1.14, was issued for on-premises N-central deployments. N-able urged self-hosted customers to install the hotfix immediately, warning that systems left unpatched remain at risk even though the company has not confirmed exploitation in production environments.

CVE-2026-86218 is a pre-authenticated remote code execution vulnerability. This means an attacker may be able to trigger the flaw without first logging in or providing valid user credentials. If successfully exploited, the issue could allow an attacker to run commands on the N-central server.

N-central is used by managed service providers and IT teams to monitor, manage, automate, and secure customer systems. Because the platform can have broad access across endpoints, networks, credentials, and administrative tools, a compromise of the central management server could create serious downstream risks.

Attackers who gain control of an N-central server could potentially use that access to deploy malicious software, alter monitoring settings, steal stored information, create unauthorized accounts, or move further into managed customer environments.

N-able Released Hotfix

The exact technical details and attack vector for CVE-2026-86218 have not been publicly disclosed. N-able said a third party responsibly reported the flaw through its security disclosure program. The vendor stated that it currently has no confirmation of active exploitation.

However, organizations should not treat the lack of known attacks as a reason to delay patching. Public patch releases can help threat actors identify vulnerable systems and develop exploit attempts.

The new release replaces N-central 2026.3 Hotfix 3, build 2026.3.1.13. Customers running versions 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1, or 2026.3.1 Hotfix 2 can upgrade directly to build 2026.3.1.14. Organizations using older releases should first move to a supported upgrade version and then apply the latest hotfix.

N-able confirmed that hosted N-central customers, also known as NCOD users, do not need to take any action because the patches have already been applied to their environments. The urgent action applies to organizations operating their own self-hosted N-central infrastructure.

The company also said administrators do not need to upgrade N-central agents specifically to address CVE-2026-86218. However, it recommended keeping agents up to date with the latest available version as a general security practice.

Security teams should identify all self-hosted N-central instances, confirm their installed build number, and schedule the update to 2026.3.1.14 as soon as possible.

Administrators should also review server access logs, administrator account activity, remote command execution records, and unusual configuration changes for signs of suspicious behavior before and after patching.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post N-able Released Hotfix for RCE Vulnerability Affecting Platform appeared first on Cyber Security News.

ConnectWise has announced a security issue affecting file transfer functionality in ScreenConnect Remote Access Support and Access sessions. This issue affects both cloud-hosted and on-premises ScreenConnect deployments. In response, the company has issued immediate mitigation guidance. At the same time, it is working on an official patch and securing a CVE identifier. The advisory, released […]

The post ConnectWise ScreenConnect Remote Access Flaw Impacts Guest File Transfer Sessions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical MikroTik RouterOS vulnerability is actively exploited in the wild. Learn how to detect rogue ops accounts and apply the latest firmware updates.

Related Posts:

• CVE-2026-86218 (CVSS 10): N-central Pre-Auth RCE Exploited in the Wild
• MikroTrick PoC: RouterOS Admin Rights Exploited In Wild
• AI Agent Coordination: The Unprecedented OpenAI Breakout

The post MikroTik RouterOS Vulnerability Exploited in the Wild: Patch and Defense Blueprint appeared first on Daily CyberSecurity.

ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every device it manages, without needing a password or any user interaction.

Tracked as CVE-2026-75754, the flaw carries a CVSS 4.0 score of 10.0, the highest possible rating, reflecting how easily it can be exploited over a network and the catastrophic scope of what an attacker can achieve once inside.

ASUS Control Center Vulnerability

The vulnerability actually stems from a chain of three separate weaknesses working together. ASUS Control Center is missing authentication on a critical function, meaning certain sensitive operations can be triggered by anyone who can reach the service over the network.

That gap is compounded by a server-side request forgery flaw, which lets an attacker send a specially crafted HTTP request to trick the system into exposing its own encryption key. Once that key is retrieved, a local service on the host automatically enables an SSH listener on TCP port 2222, effectively opening a hidden backdoor into the machine.

The final piece of the chain is arguably the most damaging: ASUS Control Center contains hard-coded credentials baked into the software itself. Attackers who obtain the encryption key can use these fixed credentials to log directly into the newly opened SSH port and land a full root shell, the highest level of system access available on the machine.

From there, intruders can read, modify, or delete any data stored in ACC, and because the platform is designed to centrally manage fleets of servers, PCs, and workstations, a single compromised ACC instance can hand attackers remote control over an entire corporate IT environment.

The flaw affects all versions of ASUS Control Center Enterprise up to and including 4.0.0.2. ASUS is urging every organization running the software to update immediately to version 3.1.0.9 or later, and confirms further fix details are posted on its official Security Advisory page.

Enterprises unable to patch right away should isolate ACC management interfaces from public networks, block inbound and outbound traffic on port 2222, and audit hosts for unexpected SSH listeners as an interim safeguard.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control of the System appeared first on Cyber Security News.

Attackers are actively exploiting an unauthenticated remote access flaw in MikroTik RouterOS, and network administrators worldwide are being urged to patch their devices immediately before compromise turns into a full network takeover.

MikroTik confirmed on September 3, 2026, that it had discovered a serious security vulnerability affecting RouterOS and had already shipped fixes across every release channel, including 7.25 beta 3, 7.24.2 stable, 7.23.4 long-term, and 6.49.21 long-term.

The vendor deliberately withheld technical specifics in its initial advisory, stating plainly that it was “not currently publishing detailed information” in order to give administrators time to update before attackers could reverse-engineer the flaw from public disclosure.

Despite that caution, exploitation began almost immediately, and forum users and researchers quickly pieced together the attack mechanics on their own.

MikroTik RouterOS Vulnerability

According to detailed discussion on the official MikroTik support forum, the vulnerability lives inside a core library used by multiple RouterOS services, meaning any exposed service built on that codebase can be leveraged as an entry point.

One forum contributor who reverse-engineered the issue confirmed it is tied to SSH and grants any unauthenticated remote attacker direct shell access to the device, regardless of whether the router relies on password authentication or SSH key-based login.

In practical terms, if the SSH service is reachable from the internet or an untrusted network, the router is vulnerable until it receives the patch, with no additional credential theft or user interaction required.

Latvia’s national CERT issued its own alert corroborating a marked increase in attacker activity specifically targeting MikroTik routers, urging organizations and home users alike to update immediately to the patched builds MikroTik released. The agency’s guidance mirrored MikroTik’s own version list, reinforcing that the fix spans both the newer 7.x stable and legacy long-term branches.

Evidence of live exploitation surfaced quickly within the MikroTik user community. One administrator reported on Reddit that around September 2, 2026, at 08:00 UTC, an unauthorized user account named “ops” was created by another rogue account labeled “0,” granted both write and policy permissions, with the intrusion traced back to an SSH connection originating from the IP address 82.192.72.4.

The administrator noted that while the rogue account appeared to be used mainly for logging in and no obvious malicious scripts were visible in the configuration, the team suspected deeper compromise that RouterOS itself could not detect, ultimately requiring a full netinstall to guarantee the devices were clean.

RouterOS now includes a built-in detection mechanism to help flag this exact scenario. After upgrading, the operating system automatically inspects the full configuration at startup and sets a device to “Flagged” status if it finds signs of unauthorized tampering, logging a critical entry in the system log.

Devices in this state face operational restrictions, including a block on enabling new scheduler entries, SOCKS proxy, PPTP, L2TP, IPsec, proxy, and SMB configurations, until an administrator performs a manual audit.

MikroTik’s guidance is straightforward: if a device shows as flagged, assume it has been compromised, audit every configuration line, rotate all passwords, and only then clear the flagged state.

Even routers that never show a flagged status should not be considered safe by default; MikroTik and independent researchers both recommend manually reviewing configurations for unrecognized users, scripts, or scheduled tasks after updating, since some compromise artifacts may not trigger the automated detection.

Restricting SSH and other management interfaces from the public internet, enforcing key-based authentication, and limiting administrative access to trusted management networks remain essential complementary defenses while the patch rolls out fleet-wide.

Given the scale of MikroTik’s install base and the confirmed low barrier to exploitation, security teams should treat this as an urgent, internet-facing remote code execution scenario rather than a routine maintenance update.

Upgrading to 7.24.2, 7.23.4, or 6.49.21 (or later), auditing every device regardless of flagged status, and hardening remote management access should be treated as immediate priorities rather than items for the next maintenance window.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access appeared first on Cyber Security News.

A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available.

Dutch e-commerce security firm Sansec disclosed the flaw, dubbed StyleSmuggler, on September 5, 2026, warning that unauthenticated attackers can achieve remote code execution on vulnerable installations and that live attacks began the previous day .

The company said it was publishing its findings early, before completing its full technical analysis, “because stores are being compromised right now”.

StyleSmuggler affects every current version of Magento and Adobe Commerce, including the latest 2.4.9 release, and requires no authentication whatsoever to exploit.

Sansec reproduced the complete unauthenticated attack chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9, confirming the bug is not tied to any single outdated build.

Disturbingly, the first identified victim was running 2.4.6-p15 with July and August 2026 security patches fully applied, meaning fully patched stores were compromised just as easily as neglected ones.

As of September 6, Adobe has not issued an advisory, assigned a CVE identifier, or released any official fix or workaround, and the company’s most recent Commerce security bulletin still dates to August 11.

The exploit unfolds in two distinct stages that abuse Magento’s own template rendering and email systems rather than a single obvious injection point. In the first stage, attackers plant malicious PHP code inside a file that Magento itself writes during normal operation, such as a payment failure report, by manipulating “styles” properties within a GraphQL request to slip past existing input sanitization.

Magento and Adobe Commerce 0-Day RCE

Independent analysis from Magento hosting firm Disrex Group, which handled two breached stores, found that a crafted directive inside the injected text forces a chain of Magento’s own classes to execute code that was only ever meant to run through the command-line dependency-injection compiler, ultimately including the attacker-poisoned log file.

The second stage triggers execution. Sansec found that StyleSmuggler deliberately causes Magento to send its standard “Payment Transaction Failed Reminder” email, and the poisoned code runs the moment Magento renders that message internally, meaning nobody has to open or even receive the email for the attack to succeed.

Once triggered, a PHP dropper cycles through six different PHP functions until it finds one capable of spawning a process, then downloads and launches a persistent implant. Disrex described the malware as a small, statically linked Rust binary of roughly 1.9 megabytes, compiled for both x86-64 and ARM64 architectures, disguised as a Linux kernel thread named “[kworker/u:8:0]” and restarted every five minutes through a cron entry written directly into the crontab spool file to avoid leaving normal system logs.

Detecting an infection is harder than it sounds because the malware actively evades naive checks. A genuine Linux kernel worker thread is owned by root and consumes no resident memory, so any bracketed “[kworker]” process running under a website’s own user account with real memory usage is a red flag.

Disrex also discovered that the binary running in memory sometimes differs from the file sitting on disk, meaning defenders should hash both the file and the live process to be thorough.

On one compromised store, the implant made no outbound internet connections at all, instead opening 28 simultaneous connections to the site’s own Redis instance to read live Magento session data, which let it operate almost invisibly to network-based monitoring.

Sansec’s own detection guidance searches Magento’s var/report directory for a marker string, but Disrex found both of its breached stores were actually poisoned through var/log/system.log instead, meaning administrators need to check both locations.

With Adobe’s next scheduled security release set for September 8 and no confirmation it will address this flaw, store owners are left relying on stopgap measures. Sansec recommends temporarily disabling GraphQL entirely for stores that don’t rely on headless or progressive web app storefronts, since classic and Hyvä themes generally don’t need it.

Disrex, security researcher ProxiBlue, and vendor Graycore have each independently published unofficial code patches that guard specific Magento classes and email template functions, though all three stress these are hardening measures rather than a genuine fix, and Disrex specifically warns its rules only block the current attack traffic pattern, not the underlying vulnerability.

Server-level protections that don’t depend on understanding the exploit chain at all, such as disabling PHP’s proc_open function and mounting temporary directories with noexec, have also proven effective at stopping the dropper from launching its payload.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability appeared first on Cyber Security News.

A FreeSWITCH vulnerability in api-chat enables remote code execution and is exploited in the wild. Upgrade to 1.11.3 now to stay safe.

Related Posts:

• Linux Kernel Vulnerability CVE-2024-26582: Public PoC Reaches Root Shell
• NTLM Reflection Bypass CVE-2026-24294 Gets Public PoC Exploit
• Public Details Disclosed: MediaTek t7xx WWAN Flaw

The post FreeSWITCH api-chat RCE Exploited in the Wild, Patch Now appeared first on Daily CyberSecurity.

Plex urges an urgent security update to Media Server 1.43.3 and Desktop 1.115.0. NAS and Docker users may need to patch manually.

Related Posts:

• MikroTik RouterOS Vulnerability Exploited in the Wild: Patch and Defense Blueprint
• StyleSmuggler: Magento Zero-Day RCE Exploited in the Wild
• CVE-2026-75754 (CVSS 10): ASUS Control Center Root RCE

The post Plex Issues Urgent Security Update for Media Server and Desktop appeared first on Daily CyberSecurity.

Google has released an emergency Chrome security update that fixes a critical zero-day vulnerability already being exploited in real-world attacks.

The flaw, tracked as CVE-2026-85046, affects the V8 JavaScript and WebAssembly engine used by Chrome to process web content. The company confirmed that it is aware of an exploit for the vulnerability existing in the wild.

While Google did not disclose details about the attacks, affected targets, or the threat actors behind the activity, the active exploitation notice makes immediate patching important for all Chrome desktop users.

The security update moves Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS. Linux users receive version 152.0.7977.82. Google said the update will roll out gradually over the coming days and weeks.

Chrome 0-Day Vulnerability Exploited

CVE-2026-85046 is described as a high-severity type confusion vulnerability in V8. Type confusion bugs occur when software incorrectly treats a piece of data as one type when it is actually another type.

In a browser engine, this kind of memory-handling error can be dangerous. An attacker may be able to create specially crafted JavaScript or web content that causes Chrome to handle memory unexpectedly.

Depending on the exploit chain, this could lead to browser crashes, data exposure, or the execution of attacker-controlled code within the browser process.

A victim may only need to visit a malicious or compromised website for an exploit attempt to begin. Attackers can also deliver exploit links via phishing emails, malicious advertisements, social media messages, or compromised legitimate sites.

The vulnerability was reported by security researcher Salvatore Gulizia, also known as Serotav, on August 4, 2026. Google awarded a $1,000 bug bounty for the report.

The Chrome update contains 12 security fixes in total. Several of the patched issues are rated high severity and affect important browser components, including V8, WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting.

Among the notable fixes are a race condition in V8, an out-of-bounds write vulnerability in WebGL, use-after-free flaws in Compositing, DevTools, and Skia, and a type confusion issue in Compositing.

Google is restricting access to some vulnerability details until most users have installed the update. This approach is intended to reduce the chance that attackers can quickly reverse-engineer the fixes and build additional exploit code before organizations and individuals patch their browsers.

Chrome users should update immediately by opening the browser menu, selecting Help, and then choosing About Google Chrome. Chrome will check for the latest version and download the update when available.

Users should relaunch the browser after installation to ensure the security fixes are applied. Enterprise administrators should verify that managed endpoints are updated to Chrome 152.0.7977.82 or later.

Security teams should also monitor endpoint telemetry and web-filtering logs for suspicious browser activity, especially phishing campaigns that use newly registered domains or deceptive update prompts.

Because CVE-2026-85046 is actively exploited, delaying the update leaves systems exposed to a known browser attack path.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Microsoft is developing a new security feature for Teams messaging that will obscure QR codes sent by external users. This measure aims to help organizations reduce phishing and fraud risks associated with malicious QR code campaigns. Listed under Microsoft 365 Roadmap ID 570439, this feature is currently in development and is scheduled for rollout in […]

The post Microsoft Teams Adds QR Code Protection to Block Phishing and Fraud appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are actively exploiting a critical vulnerability in the Super Forms WordPress plugin, allowing them to upload PHP backdoors and gain remote code execution. This flaw, tracked as CVE-2026-14894, affects Super Forms versions 6.3.313 and earlier. Administrators are urged to upgrade to version 6.3.314 immediately. Super Forms WordPress Flaw Wordfence disclosed this unauthenticated arbitrary […]

The post Critical Super Forms WordPress Flaw Actively Exploited to Achieve Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Plex has urged users to promptly update their Plex Media Server and Plex Desktop software following the release of fixes for several undisclosed security issues in older versions. The recommended versions are Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The company advises that all server owners and desktop users upgrade to the latest release […]

The post Plex Urges Users to Update Media Server as Multiple Security Flaws Are Discovered appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

TP-Link has released security updates for two vulnerabilities found in its Archer AX55 v4 wireless router. These vulnerabilities could allow attackers on the local network to crash a key networking service, potentially execute code, or steal administrator credentials from captured login traffic. The vulnerabilities, identified as CVE-2026-18167 and CVE-2026-18330, impact the router’s EasyMesh component and […]

The post TP-Link Archer AX55 Flaws Enable Remote Code Execution and Admin Password Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone. Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open? All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

Broadcom has issued a critical security advisory warning that two newly disclosed flaws in VMware Workstation and Fusion could let attackers break out of a virtual machine and run malicious code directly on the underlying host system, a scenario that undermines the core security promise of virtualization.

The advisory, tracked as VMSA-2026-0007 and published on September 3, 2026, details two vulnerabilities affecting VMware’s widely used desktop virtualization products. The more severe of the pair, CVE-2026-59346, is an integer-overflow flaw in the VMXNET3 virtual network adapter. Broadcom rates it at a maximum CVSSv3 score of 9.3, placing it firmly in the critical range.

According to the advisory, a malicious actor who already has local administrative privileges on a virtual machine configured with a VMXNET3 adapter could exploit the flaw to execute code on the host machine itself, effectively escaping the sandboxed VM environment.

The second issue, CVE-2026-59347, is a stack-based buffer-overflow vulnerability in the Host-Guest File System, better known as HGFS, which handles shared folders between a VM and its host.

This flaw carries a CVSSv3 score of 8.1 and is classified as important rather than critical. Exploiting it would allow an attacker with administrative access inside a guest VM to execute code as the VMX process running on the host, giving them a foothold in host-level operations without needing to breach the network adapter directly.

Both vulnerabilities were privately reported to Broadcom rather than discovered through public exploitation, and the company credited multiple independent research teams for the findings.

CVE-2026-59346 was reported separately by researcher h4urek of secsys lab and by Y² and Stan S, working through Trend Micro’s Zero Day Initiative. CVE-2026-59347 was reported by Yeonghyeon Choi and Tianchu Chen of Tencent’s Xuanwu Lab.

The vulnerabilities affect VMware Workstation versions 25H2 and 26H1 running on any host operating system, as well as VMware Fusion versions 25H2 and 26H1 running on macOS.

Broadcom has released version 26H1u1 to remediate both flaws across the affected product lines. Notably, the advisory states there are no workarounds available for either vulnerability, meaning organizations and individual users cannot mitigate the risk through configuration changes alone and must apply the patch to be protected.

Given that both flaws require only local administrative privileges inside a guest VM to trigger a host-level compromise, security teams running VMware Workstation or Fusion in lab, testing, or malware-analysis environments should treat this as a priority patch.

Virtualization platforms are frequently used to isolate untrusted code, and a working VM-escape chain like this one could let attackers pivot from a contained sandbox straight into production infrastructure.

Administrators are advised to update to version 26H1u1 as soon as possible and audit which virtual machines use VMXNET3 adapters or shared folder features in the interim.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical VMware Workstation and Fusion Vulnerabilities Allow Attackers to Execute Code on the Host appeared first on Cyber Security News.

A critical vulnerability in Sangoma Switchvox is being actively exploited, affecting the enterprise VoIP platform used to manage business phone systems, voicemail, call forwarding, monitoring, and analytics.

The flaw, tracked as CVE-2026-9586, enables unauthenticated attackers to execute commands remotely on vulnerable systems without needing valid credentials.

Horizon3.ai researchers observed valid exploitation attempts against internet-exposed Switchvox devices on August 30, 2026, with attackers attempting to deploy reverse shells for remote command-line access to compromised VoIP servers.

CVE-2026-9586 is an unauthenticated SQL injection vulnerability affecting Sangoma Switchvox SMB Edition 8.3, build 104997, and earlier releases. The issue has a CVSS severity score of 9.3 and can lead to remote code execution.

The vulnerable component is an unauthenticated HTTP endpoint, /pa, that processes XML messages for supported IP phones. These messages can be used to notify phone systems about events such as incoming and outgoing calls.

Hackers Exploiting Sangoma Switchvox VoIP RCE Flaw

Horizon3 researchers found that Switchvox extracts the PhoneIP value from an XML request and directly adds it to a PostgreSQL database query.

The application does not properly sanitize or parameterize the user-controlled input. This allows a remote attacker to inject malicious SQL commands through a specially crafted request.

Because the database query is executed with elevated PostgreSQL permissions, an attacker could run operating system commands on the Switchvox server.

This could allow them to access database contents, alter user data, create or elevate administrator accounts, steal authentication material, and establish persistent remote access.

Horizon3 and Defused Cyber deployed internet-facing honeypots to monitor for exploitation attempts. On August 30, researchers detected attacks from the IP address 176.65.148.184 across multiple honeypots in quick succession.

The observed activity included an attempt to launch a reverse shell using Netcat. Attackers then used a Base64-encoded command to collect information on active processes running on the vulnerable Switchvox appliance.

The results were prepared for transmission to an attacker-controlled server, suggesting that the attackers were conducting post-exploitation reconnaissance after gaining access.

Horizon3 warned that the speed and scale of the attempts indicate that internet-exposed Switchvox systems are likely being broadly scanned and targeted. Researchers identified approximately 4,000 Switchvox devices exposed online, with most located in the United States.

Horizon3 reported 12 Switchvox vulnerabilities to Sangoma in April 2026. Sangoma released Switchvox version 8.4.0.2 on July 14, 2026, which addresses CVE-2026-9586 and other reported issues.

Organizations should immediately upgrade Switchvox to version 8.4.0.2 or a later supported release. Administrators should also review /var/log/switchvox/db-quirks.log for suspicious SQL statements, investigate connections involving 176.65.148.184, and restrict access to the /pa endpoint to trusted phone networks where possible.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Actively Exploiting Sangoma Switchvox VoIP Platform RCE Flaw in Attacks appeared first on Cyber Security News.

SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.

The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.

The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.

Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.

Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.

Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.

The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.

Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.

A public proof-of-concept (PoC) repository has revealed a local privilege escalation zero-day vulnerability in GenDigital’s Avast Antivirus. This vulnerability allows an attacker to dump the Windows Security Account Manager (SAM) database and launch a shell running as NT AUTHORITY\SYSTEM. The researcher behind the repository, known as MSNightmare, claims that the issue affects fully patched installations […]

The post Avast Antivirus Zero-Day PoC Lets Attackers Dump SAM Database and Gain SYSTEM Shell appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.