JetBrains fixed 29 JetBrains vulnerabilities in Hub and YouTrack. Learn how these critical 9.8 CVSS bugs impact developer servers and how to patch now.
Patch the critical FreeIPA CVE-2026-76578 immediately. This FreeIPA vulnerability allows complete, unauthenticated administrative access to your servers.
Jellyfin has released version 12.0, a significant update to its open-source media server. This version includes a wide range of platform improvements and essential security updates affecting both the server and the web client. The project strongly advises administrators to plan their upgrade carefully because it includes database migrations and compatibility-breaking changes for existing deployments. […]
Dell has released security updates for the Secure Connect Gateway (SCG) Application and Appliance after discovering three critical vulnerabilities. These flaws can expose enterprise deployments to unauthenticated administrative access, remote command execution, and potential host-level compromise. Detailed in Dell Security Advisory DSA-2026-382, these issues affect SCG 5.0 appliance versions earlier than 5.36.00.16 and application versions […]
ASUS has released a security update for the Control Center Express Agent to address CVE-2026-19397, a high-severity vulnerability related to missing authentication. This vulnerability allows an unauthenticated nearby attacker to potentially take control of an affected host through a direct connection to the agent. The issue affects versions before 1.7.24 and was published and updated […]
SAP released 19 new Security Notes addressing four critical vulnerabilities and 15 additional flaws throughout its enterprise portfolio. The vendor also updated one note from August. The most urgent issue is CVE-2026-44756, a memory-corruption vulnerability in Extended Passport (EPP) Processing with a CVSS score of 10.0. This flaw affects numerous SAP Kernel and Web Dispatcher […]
Roundcube Webmail has released security updates for its 1.6 LTS and 1.7 branches, fixing 12 vulnerabilities that could expose users and servers to cross-site scripting, email header injection, cross-user data access, remote-content bypasses, and server-side request forgery attacks.
The new releases, Roundcube 1.6.19 and 1.7.4, address flaws in how the open-source webmail platform processes email content, HTML, Cascading Style Sheets, attachment metadata, contact groups, and remote URLs. Administrators running production deployments of Roundcube 1.6.x or 1.7.x are urged to update as soon as possible.
TNEF, or Transport Neutral Encapsulation Format, is commonly associated with Microsoft Outlook attachments. An attacker could potentially send a specially crafted email that triggers malicious script execution when the victim views the message, without requiring the user to click a link or open an attachment.
The updates also fix another XSS issue in Roundcube’s HTML editor when handling text/enriched email content. Cross-site scripting weaknesses can allow attackers to execute JavaScript in a victim’s webmail session, creating opportunities to steal session tokens, alter mailbox settings, read messages, or perform actions as the logged-in user.
Several fixes address email header injection risks. These bugs affected the subject field, recipient display name, and an identity’s organization field.
Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.
Roundcube also patched a cross-user access issue in SQL-based address books. The flaw involved adding or removing members from contact groups.
It could allow one user to modify another user’s group associations under certain conditions. This type of issue can compromise contact privacy and the integrity of address book data in shared or hosted Roundcube environments.
Remote-content protections received multiple fixes, addressing CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques that could bypass remote-content blocking.
Roundcube Webmail Patches 12 Security Flaws
The updates further fix an is_local_url() validation bypass involving fully qualified domain names with a trailing dot in stylesheet URLs. Attackers could exploit differences in URL parsing to make an external resource appear local and bypass intended restrictions.
A server-side request forgery bypass was also resolved in the Roundcube CSS proxy. The weakness involved hexadecimal IPv6-mapped IPv4 addresses, which could potentially help an attacker bypass address validation and force the server to request internal or restricted network resources.
Roundcube said full technical details are available in the release notes for versions 1.6.19 and 1.7.4. The project strongly recommends that all organizations operating affected Roundcube installations apply the updates promptly.
Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, allowing unauthenticated attackers to execute remote code in vulnerable enterprise web applications.
The issue primarily affects Telerik’s RadAsyncUpload component, a widely used file-upload control in ASP.NET WebForms applications.
Progress Software has indicated that the flaw impacts versions from 2010.1.309 to 2026.2.519. The vulnerability was addressed in version 2026.2.708, released as part of the 2026 Q2 SP1 update.
The vulnerability chain includes four distinct flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While these vulnerabilities are serious, their exploitation requires specific conditions and cannot be applied universally to all default Telerik deployments.
At the heart of the issue is CVE-2026-13182, a padding oracle vulnerability within RadAsyncUpload’s handling of encrypted client states. Telerik employs AES-CBC encryption to safeguard configuration data exchanged between the server and the user’s browser.
A padding oracle occurs when the application provides different error responses for invalid encrypted data. In this case, malformed data results in a distinct error compared to valid padding with invalid JSON content.
Telerik Flaw Chain
This discrepancy enables an attacker to submit modified ciphertext repeatedly, gathering information on how the application decrypts it, ultimately allowing them to recover sensitive data and forge modified encrypted values without needing the encryption key.
Even when the ASP.NET customErrors feature is enabled, researchers noted that exploitation remains possible, albeit more challenging and time-consuming through timing analysis.
Exploiting this oracle, researchers manipulated Telerik’s serializedConfiguration data, which governs settings within the upload control. This enabled attackers to alter the AllowedFileExtensions field, permitting DLL files to be uploaded.
Telerik and its building blocks (Source: TantoSec)
The attack utilized a CBC forgery technique, introducing a “sacrificial” encrypted block within a JSON string. This method preserved necessary configuration from legitimate page loads, including session controls, while inserting malicious entries in the configuration.
The second critical vulnerability, CVE-2026-13181, pertains to the management of upload metadata, where Telerik resolves the .NET type name supplied via the AsyncUploadTypeName value without a proper allowlist.
If a server-side FileUploaded handler reads the UploadResult property, Telerik deserializes corrupt data into the designated type. This behavior can be exploited together with the System.Configuration.Install.AssemblyInstaller gadget, enabling the application to load an uploaded mixed-mode DLL from a temporary directory, executing native code via its DllMain entry point.
The proof-of-concept demonstrated execution of a web shell within the IIS worker process, while an in-memory variant could run commands without writing any files to disk.
To successfully exploit this vulnerability chain, attackers must access a page containing a RadAsyncUpload control with an active server-side FileUploaded event handler that reads UploadResult.
Additionally, an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey must be configured for the exploitation path to function, which is recommended as a security measure.
Organizations utilizing Telerik UI for ASP.NET AJAX are urged to upgrade immediately to version 2026.2.708 or later. It is critical for administrators to identify pages using RadAsyncUpload and review their upload event handlers to monitor for potential exploitation.
Vigilance against suspicious IIS activity is also necessary, with particular attention to instances of w3wp.exe unexpectedly spawning cmd.exe, the appearance of DLL files in temporary folders, and unexpected .aspx files in web roots.
N-able has released N-central 2026.3 Hotfix 4 to fix CVE-2026-86218. This critical vulnerability could allow an unauthenticated attacker to execute code remotely on an exposed N-central server.
The update, identified as build 2026.3.1.14, was issued for on-premises N-central deployments. N-able urged self-hosted customers to install the hotfix immediately, warning that systems left unpatched remain at risk even though the company has not confirmed exploitation in production environments.
CVE-2026-86218 is a pre-authenticated remote code execution vulnerability. This means an attacker may be able to trigger the flaw without first logging in or providing valid user credentials. If successfully exploited, the issue could allow an attacker to run commands on the N-central server.
N-central is used by managed service providers and IT teams to monitor, manage, automate, and secure customer systems. Because the platform can have broad access across endpoints, networks, credentials, and administrative tools, a compromise of the central management server could create serious downstream risks.
Attackers who gain control of an N-central server could potentially use that access to deploy malicious software, alter monitoring settings, steal stored information, create unauthorized accounts, or move further into managed customer environments.
N-able Released Hotfix
The exact technical details and attack vector for CVE-2026-86218 have not been publicly disclosed. N-able said a third party responsibly reported the flaw through its security disclosure program. The vendor stated that it currently has no confirmation of active exploitation.
However, organizations should not treat the lack of known attacks as a reason to delay patching. Public patch releases can help threat actors identify vulnerable systems and develop exploit attempts.
The new release replaces N-central 2026.3 Hotfix 3, build 2026.3.1.13. Customers running versions 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1, or 2026.3.1 Hotfix 2 can upgrade directly to build 2026.3.1.14. Organizations using older releases should first move to a supported upgrade version and then apply the latest hotfix.
N-able confirmed that hosted N-central customers, also known as NCOD users, do not need to take any action because the patches have already been applied to their environments. The urgent action applies to organizations operating their own self-hosted N-central infrastructure.
The company also said administrators do not need to upgrade N-central agents specifically to address CVE-2026-86218. However, it recommended keeping agents up to date with the latest available version as a general security practice.
Security teams should identify all self-hosted N-central instances, confirm their installed build number, and schedule the update to 2026.3.1.14 as soon as possible.
Administrators should also review server access logs, administrator account activity, remote command execution records, and unusual configuration changes for signs of suspicious behavior before and after patching.
ConnectWise has announced a security issue affecting file transfer functionality in ScreenConnect Remote Access Support and Access sessions. This issue affects both cloud-hosted and on-premises ScreenConnect deployments. In response, the company has issued immediate mitigation guidance. At the same time, it is working on an official patch and securing a CVE identifier. The advisory, released […]
A critical MikroTik RouterOS vulnerability is actively exploited in the wild. Learn how to detect rogue ops accounts and apply the latest firmware updates.
ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every device it manages, without needing a password or any user interaction.
Tracked as CVE-2026-75754, the flaw carries a CVSS 4.0 score of 10.0, the highest possible rating, reflecting how easily it can be exploited over a network and the catastrophic scope of what an attacker can achieve once inside.
ASUS Control Center Vulnerability
The vulnerability actually stems from a chain of three separate weaknesses working together. ASUS Control Center is missing authentication on a critical function, meaning certain sensitive operations can be triggered by anyone who can reach the service over the network.
That gap is compounded by a server-side request forgery flaw, which lets an attacker send a specially crafted HTTP request to trick the system into exposing its own encryption key. Once that key is retrieved, a local service on the host automatically enables an SSH listener on TCP port 2222, effectively opening a hidden backdoor into the machine.
The final piece of the chain is arguably the most damaging: ASUS Control Center contains hard-coded credentials baked into the software itself. Attackers who obtain the encryption key can use these fixed credentials to log directly into the newly opened SSH port and land a full root shell, the highest level of system access available on the machine.
From there, intruders can read, modify, or delete any data stored in ACC, and because the platform is designed to centrally manage fleets of servers, PCs, and workstations, a single compromised ACC instance can hand attackers remote control over an entire corporate IT environment.
The flaw affects all versions of ASUS Control Center Enterprise up to and including 4.0.0.2. ASUS is urging every organization running the software to update immediately to version 3.1.0.9 or later, and confirms further fix details are posted on its official Security Advisory page.
Enterprises unable to patch right away should isolate ACC management interfaces from public networks, block inbound and outbound traffic on port 2222, and audit hosts for unexpected SSH listeners as an interim safeguard.
Attackers are actively exploiting an unauthenticated remote access flaw in MikroTik RouterOS, and network administrators worldwide are being urged to patch their devices immediately before compromise turns into a full network takeover.
MikroTik confirmed on September 3, 2026, that it had discovered a serious security vulnerability affecting RouterOS and had already shipped fixes across every release channel, including 7.25 beta 3, 7.24.2 stable, 7.23.4 long-term, and 6.49.21 long-term.
The vendor deliberately withheld technical specifics in its initial advisory, stating plainly that it was “not currently publishing detailed information” in order to give administrators time to update before attackers could reverse-engineer the flaw from public disclosure.
Despite that caution, exploitation began almost immediately, and forum users and researchers quickly pieced together the attack mechanics on their own.
MikroTik RouterOS Vulnerability
According to detailed discussion on the official MikroTik support forum, the vulnerability lives inside a core library used by multiple RouterOS services, meaning any exposed service built on that codebase can be leveraged as an entry point.
One forum contributor who reverse-engineered the issue confirmed it is tied to SSH and grants any unauthenticated remote attacker direct shell access to the device, regardless of whether the router relies on password authentication or SSH key-based login.
In practical terms, if the SSH service is reachable from the internet or an untrusted network, the router is vulnerable until it receives the patch, with no additional credential theft or user interaction required.
Latvia’s national CERT issued its own alert corroborating a marked increase in attacker activity specifically targeting MikroTik routers, urging organizations and home users alike to update immediately to the patched builds MikroTik released. The agency’s guidance mirrored MikroTik’s own version list, reinforcing that the fix spans both the newer 7.x stable and legacy long-term branches.
Evidence of live exploitation surfaced quickly within the MikroTik user community. One administrator reported on Reddit that around September 2, 2026, at 08:00 UTC, an unauthorized user account named “ops” was created by another rogue account labeled “0,” granted both write and policy permissions, with the intrusion traced back to an SSH connection originating from the IP address 82.192.72.4.
The administrator noted that while the rogue account appeared to be used mainly for logging in and no obvious malicious scripts were visible in the configuration, the team suspected deeper compromise that RouterOS itself could not detect, ultimately requiring a full netinstall to guarantee the devices were clean.
RouterOS now includes a built-in detection mechanism to help flag this exact scenario. After upgrading, the operating system automatically inspects the full configuration at startup and sets a device to “Flagged” status if it finds signs of unauthorized tampering, logging a critical entry in the system log.
Devices in this state face operational restrictions, including a block on enabling new scheduler entries, SOCKS proxy, PPTP, L2TP, IPsec, proxy, and SMB configurations, until an administrator performs a manual audit.
MikroTik’s guidance is straightforward: if a device shows as flagged, assume it has been compromised, audit every configuration line, rotate all passwords, and only then clear the flagged state.
Even routers that never show a flagged status should not be considered safe by default; MikroTik and independent researchers both recommend manually reviewing configurations for unrecognized users, scripts, or scheduled tasks after updating, since some compromise artifacts may not trigger the automated detection.
Restricting SSH and other management interfaces from the public internet, enforcing key-based authentication, and limiting administrative access to trusted management networks remain essential complementary defenses while the patch rolls out fleet-wide.
Given the scale of MikroTik’s install base and the confirmed low barrier to exploitation, security teams should treat this as an urgent, internet-facing remote code execution scenario rather than a routine maintenance update.
Upgrading to 7.24.2, 7.23.4, or 6.49.21 (or later), auditing every device regardless of flagged status, and hardening remote management access should be treated as immediate priorities rather than items for the next maintenance window.
A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available.
Dutch e-commerce security firm Sansec disclosed the flaw, dubbed StyleSmuggler, on September 5, 2026, warning that unauthenticated attackers can achieve remote code execution on vulnerable installations and that live attacks began the previous day .
The company said it was publishing its findings early, before completing its full technical analysis, “because stores are being compromised right now”.
StyleSmuggler affects every current version of Magento and Adobe Commerce, including the latest 2.4.9 release, and requires no authentication whatsoever to exploit.
Sansec reproduced the complete unauthenticated attack chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9, confirming the bug is not tied to any single outdated build.
Disturbingly, the first identified victim was running 2.4.6-p15 with July and August 2026 security patches fully applied, meaning fully patched stores were compromised just as easily as neglected ones.
As of September 6, Adobe has not issued an advisory, assigned a CVE identifier, or released any official fix or workaround, and the company’s most recent Commerce security bulletin still dates to August 11.
The exploit unfolds in two distinct stages that abuse Magento’s own template rendering and email systems rather than a single obvious injection point. In the first stage, attackers plant malicious PHP code inside a file that Magento itself writes during normal operation, such as a payment failure report, by manipulating “styles” properties within a GraphQL request to slip past existing input sanitization.
Magento and Adobe Commerce 0-Day RCE
Independent analysis from Magento hosting firm Disrex Group, which handled two breached stores, found that a crafted directive inside the injected text forces a chain of Magento’s own classes to execute code that was only ever meant to run through the command-line dependency-injection compiler, ultimately including the attacker-poisoned log file.
The second stage triggers execution. Sansec found that StyleSmuggler deliberately causes Magento to send its standard “Payment Transaction Failed Reminder” email, and the poisoned code runs the moment Magento renders that message internally, meaning nobody has to open or even receive the email for the attack to succeed.
Attack chain (Source: Disrex)
Once triggered, a PHP dropper cycles through six different PHP functions until it finds one capable of spawning a process, then downloads and launches a persistent implant. Disrex described the malware as a small, statically linked Rust binary of roughly 1.9 megabytes, compiled for both x86-64 and ARM64 architectures, disguised as a Linux kernel thread named “[kworker/u:8:0]” and restarted every five minutes through a cron entry written directly into the crontab spool file to avoid leaving normal system logs.
Detecting an infection is harder than it sounds because the malware actively evades naive checks. A genuine Linux kernel worker thread is owned by root and consumes no resident memory, so any bracketed “[kworker]” process running under a website’s own user account with real memory usage is a red flag.
Disrex also discovered that the binary running in memory sometimes differs from the file sitting on disk, meaning defenders should hash both the file and the live process to be thorough.
On one compromised store, the implant made no outbound internet connections at all, instead opening 28 simultaneous connections to the site’s own Redis instance to read live Magento session data, which let it operate almost invisibly to network-based monitoring.
Sansec’s own detection guidance searches Magento’s var/report directory for a marker string, but Disrex found both of its breached stores were actually poisoned through var/log/system.log instead, meaning administrators need to check both locations.
With Adobe’s next scheduled security release set for September 8 and no confirmation it will address this flaw, store owners are left relying on stopgap measures. Sansec recommends temporarily disabling GraphQL entirely for stores that don’t rely on headless or progressive web app storefronts, since classic and Hyvä themes generally don’t need it.
Disrex, security researcher ProxiBlue, and vendor Graycore have each independently published unofficial code patches that guard specific Magento classes and email template functions, though all three stress these are hardening measures rather than a genuine fix, and Disrex specifically warns its rules only block the current attack traffic pattern, not the underlying vulnerability.
Server-level protections that don’t depend on understanding the exploit chain at all, such as disabling PHP’s proc_open function and mounting temporary directories with noexec, have also proven effective at stopping the dropper from launching its payload.
Google has released an emergency Chrome security update that fixes a critical zero-day vulnerability already being exploited in real-world attacks.
The flaw, tracked as CVE-2026-85046, affects the V8 JavaScript and WebAssembly engine used by Chrome to process web content. The company confirmed that it is aware of an exploit for the vulnerability existing in the wild.
While Google did not disclose details about the attacks, affected targets, or the threat actors behind the activity, the active exploitation notice makes immediate patching important for all Chrome desktop users.
The security update moves Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS. Linux users receive version 152.0.7977.82. Google said the update will roll out gradually over the coming days and weeks.
Chrome 0-Day Vulnerability Exploited
CVE-2026-85046 is described as a high-severity type confusion vulnerability in V8. Type confusion bugs occur when software incorrectly treats a piece of data as one type when it is actually another type.
In a browser engine, this kind of memory-handling error can be dangerous. An attacker may be able to create specially crafted JavaScript or web content that causes Chrome to handle memory unexpectedly.
Depending on the exploit chain, this could lead to browser crashes, data exposure, or the execution of attacker-controlled code within the browser process.
A victim may only need to visit a malicious or compromised website for an exploit attempt to begin. Attackers can also deliver exploit links via phishing emails, malicious advertisements, social media messages, or compromised legitimate sites.
The vulnerability was reported by security researcher Salvatore Gulizia, also known as Serotav, on August 4, 2026. Google awarded a $1,000 bug bounty for the report.
The Chrome update contains 12 security fixes in total. Several of the patched issues are rated high severity and affect important browser components, including V8, WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting.
Among the notable fixes are a race condition in V8, an out-of-bounds write vulnerability in WebGL, use-after-free flaws in Compositing, DevTools, and Skia, and a type confusion issue in Compositing.
Google is restricting access to some vulnerability details until most users have installed the update. This approach is intended to reduce the chance that attackers can quickly reverse-engineer the fixes and build additional exploit code before organizations and individuals patch their browsers.
Chrome users should update immediately by opening the browser menu, selecting Help, and then choosing About Google Chrome. Chrome will check for the latest version and download the update when available.
Users should relaunch the browser after installation to ensure the security fixes are applied. Enterprise administrators should verify that managed endpoints are updated to Chrome 152.0.7977.82 or later.
Security teams should also monitor endpoint telemetry and web-filtering logs for suspicious browser activity, especially phishing campaigns that use newly registered domains or deceptive update prompts.
Because CVE-2026-85046 is actively exploited, delaying the update leaves systems exposed to a known browser attack path.
Entrar
