Entrar
The Cyber Express Weekly Roundup: Claude Session Hijacking, PaperCut Exploits, and Enterprise Cyberattacks
Visualização de leitura
Two Citrix NetScaler Flaws Put Enterprise Edge Devices at Risk
Citrix NetScaler Vulnerabilities Affect ADC and Gateway
The first flaw, CVE-2026-19489, is a memory overflow vulnerability. According to the alert, exploitation of this vulnerability requires SIP ALG, or Session Initiation Protocol Application Layer Gateway, to be enabled on a Large Scale NAT (LSN) group configuration. The second flaw, CVE-2026-19490, is an authentication bypass vulnerability. The vulnerability requires SAML actions to be enabled and/or the affected product to be configured as a VPN gateway. The conditions required for each vulnerability mean that organisations need to assess their specific Citrix configurations to determine whether affected systems are present in their environments.Patches Released for Citrix NetScaler products
Citrix released patches for the affected products on August 19, 2026. ASD's ACSC is urging organisations to review the vendor's mitigation guidance, identify vulnerable versions of Citrix products and update affected systems to the latest versions. The advisory places particular emphasis on timely patching because critical edge devices are frequently targeted by threat actors as an entry point into sensitive environments. However, ASD's ACSC said it has no information indicating that a specific Australian industry or sector is currently being targeted in connection with these vulnerabilities.Organisations Urged to Assess Vulnerable Versions
The mitigation guidance calls on organisations to assess their networks and environments for vulnerable versions of Citrix products and apply patches as soon as practicable. Organisations should also review the mitigation advice provided by Citrix and confirm that affected systems have been updated. Where NetScaler ADC and NetScaler Gateway products are managed by a third party, organisations are advised to contact the relevant managed service provider (MSP) or enterprise IT provider. They should confirm that the products have been patched and are being monitored for suspicious activity. This step is particularly relevant for organisations that do not directly manage their Citrix infrastructure and may rely on external providers for patching and monitoring.Monitoring Remains Important After Patching
Alongside addressing the Citrix NetScaler vulnerabilities, organisations are advised to monitor affected environments for suspicious activity. The alert recommends notifying ASD's ACSC if suspicious activity is detected. The two vulnerabilities affect different configurations, with CVE-2026-19489 requiring SIP ALG to be enabled on an LSN group configuration, while CVE-2026-19490 requires SAML actions to be enabled and/or the product to be configured as a VPN gateway. For Australian organisations using Citrix NetScaler products, the immediate steps outlined by ASD's ACSC are to identify vulnerable versions, apply the available patches, confirm third-party-managed systems have been addressed and maintain monitoring for suspicious activity.
CVE-2026-84115 in Cleo Harmony: JWT Refresh Token Handler Flaw Exposes Remote Attack Risk
CVE-2026-84115 Targets JWT Refresh Token Handler
According to the vulnerability analysis, CVE-2026-84115 involves an unknown function within the JWT Refresh Token Handler component. The affected functionality processes requests sent to /api/connections, where manipulation of the Bearer argument in HTTP authorization headers can lead to improper privilege management. The weakness is classified as CWE-269, which refers to Improper Privilege Management. The flaw can allow an attacker to manipulate authentication-token arguments and potentially bypass intended access controls, gaining privileges beyond those assigned to the account.Remote Exploitation Raises CVE-2026-84115 Risk
The vulnerability is remotely exploitable because the attack can be conducted through network-based HTTP requests without requiring local or physical access to the targeted system. The risk is heightened because a public exploit has reportedly been made available. An attacker exploiting CVE-2026-84115 could potentially obtain unauthorized administrative access, view sensitive information stored within Harmony, or interfere with integration workflows managed through the platform. Such activity could affect the confidentiality, integrity, and availability of systems that depend on Cleo Harmony for file transfer and API connectivity. The VulDB analysis links the exploitation method to authentication bypass through token manipulation. Attackers could potentially intercept legitimate traffic or create forged requests using malformed or replayed bearer tokens to circumvent JWT refresh-token controls. In environments where Cleo Harmony is connected to other systems, successful exploitation could also provide opportunities for further lateral movement.CVE-2026-84115 Remediation Requires an Upgrade
Organizations using affected Cleo Harmony versions should upgrade to version 5.8.1.11 or later. The release contains the necessary correction for the privilege-management problem affecting the JWT Refresh Token Handler. Until patching is possible, organizations can strengthen input validation on API endpoints and monitor for unusual patterns involving bearer tokens. These measures may improve detection and reduce exposure, but they do not replace the recommended software upgrade, particularly given the reported public exploit. VulDB is listed as the responsible organization, with the vulnerability recorded under VDB-397558. Disclosure took place on September 1, 2026, and the entry has an accepted moderation status, with CPE marked as ready. CWE-269 is confirmed for the vulnerability. VulDB assigns CVE-2026-84115 a CVSS score of 8.3 and an EPSS score of 0.00284. The vulnerability record also identifies an exploit as available for download.
SonicWall Warns of Two Actively Exploited SMA1000 Zero-Days, One Rated Maximum Severity
SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.
The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.
The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.
Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.
Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.
Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.
The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.
Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation
Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.
PaperCut Issues Second Emergency Patch as Researchers Break Fix for Exploited Zero-Days
PaperCut released a second emergency patch last Friday, for two vulnerabilities in its NG and MF print management servers that attackers are already exploiting, after security researchers demonstrated that the vendor's first fix could be bypassed.
The two flaws work as a chain. CVE-2026-81578, rated 8.8 on the CVSS scale, is an improper access control weakness in the PaperCut web management interface that lets unauthenticated remote requests reach administrative functions before the server finishes validating access.
CVE-2026-82078, rated 9.4, is an unsafe dynamic class-loading flaw in the product's database utilities. The application loads database driver classes without checking them against an allowlist, so an attacker who can alter configuration parameters can get arbitrary Java bytecode running inside the application server process. Together they produce pre-authentication remote code execution on an internet-facing server.
PaperCut software runs print queues for universities, school districts, hospitals, local government and large enterprises, and the platform has a history of drawing ransomware attention. Three earlier PaperCut NG/MF vulnerabilities already sit in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, two of them weaponized in ransomware campaigns.
Also read: CISA Adds Cisco ISE and PaperCut Vulnerabilities to Known Exploited Vulnerabilities Catalog
Huntress, which first documented the activity, said it observed exploitation in two customer environments on Aug. 26 and Aug. 27. In one case the whole intrusion ran under two minutes. Attackers dropped hex-encoded Java class files that the firm described as a bridge between PaperCut and the underlying operating system, then issued basic reconnaissance commands - enumerating the current user, operating system version and running processes - rather than deploying ransomware or other payloads. That pattern typically indicates access brokering or target triage ahead of a later stage.
The reason for a second patch was straightforward; the first one did not hold. Researchers at watchTowr found multiple ways around the original fix and turned up an additional authentication bypass in the process, while Huntress independently reproduced the full attack chain and found its own workarounds. Both firms worked with PaperCut's engineers on Emergency Patch Release 2.
PaperCut said it was aware of confirmed customer incidents and was treating the matter with the highest priority. Release 2 covers PaperCut NG and MF versions 24, 25 and 26 on Windows, Linux and macOS. Customers running version 23 or earlier are told to upgrade rather than wait for a backported patch - a significant caveat, since Huntress reported that roughly 47% of the approximately 2,500 installations it tracks are on those older builds.
The pair had not been added to CISA's KEV catalog as of the vendor's Aug. 28 update.
Whether CISA adds the two CVEs to KEV, whether the reconnaissance-only activity converts into ransomware deployment, and whether Release 2 survives the scrutiny that broke its predecessor, remains to be seen. But administrators should pull PaperCut servers off the public internet regardless of patch status, and check application logs for unexpected process execution and stray .class files.
AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden JSON Fields
How the CVE-2026-77846 AshSqlite Vulnerability Works
In affected releases, AshSqlite generated JSON paths using $."-style path construction through the expression:path = "$." <> Enum.join(right, ".")The individual path segments were neither escaped nor quoted. Consequently, a key intended to represent the literal name private.secret could instead be interpreted as two JSON levels. Characters such as ., [, ], and $ could similarly alter JSONPath interpretation. The GitHub advisory describes the flaw as “JSONPath injection in AshSqlite.SqlImplementation get_path”, stating that an attacker controlling a get_path/2 segment can traverse nested JSON and disclose private fields. The affected package is ash_sqlite, with versions 0.1.2-rc.0 through before 0.2.18 affected and 0.2.18 listed as the patched release. The flaw remains separate from SQL injection because the generated JSON path is supplied to SQLite's json_extract as a bound expression parameter. The attacker manipulates the JSONPath grammar, rather than injecting SQL commands.
What CVE-2026-77846 Can Expose?
The AshSqlite vulnerability becomes relevant when an application permits untrusted input to reach get_path/2, such as through a public calculation, filter, or API that lets callers select JSON fields. A normal endpoint might permit a caller to request a top-level title field. However, supplying private.secret can cause AshSqlite to generate $.private.secret, allowing traversal into a nested object that the API was never intended to expose. Malformed input, such as an unbalanced bracket or bare $, can also produce SQLite JSON path errors that reveal information about the underlying structure. The published proof of concept used AshSqlite 0.2.17, Bandit, and Req. It created a JSON record containing {"title":"hello","private":{"secret":"s3cr3t-api-key-9f2c"}}. A benign key=title request returned hello, while key=private.secret returned s3cr3t-api-key-9f2c. Captured SQL showed json_extract(p0."data", ?) with the parameter $.private.secret, confirming the traversal. The PoC concluded that a single attacker-controlled path segment could leak a nested value through an endpoint designed to expose only top-level keys.Fixes and Administrator Actions for CVE-2026-77846
The fix replaces the unsafe path joining with encoding that represents keys safely, escapes backslashes and quotes, and handles numeric array indexes separately. Administrators should upgrade to AshSqlite 0.2.18 or later and audit applications that accept network-controlled field-selection input. Until upgrades are completed, applications should restrict dynamic get_path/2 calls to predefined names, reject dangerous path characters such as periods and brackets, and avoid exposing arbitrary JSON paths. After upgrading, dependency locks and deployment images should be checked for older ash_sqlite versions. Logs should also be reviewed for unusual dots, brackets, or JSONPath symbols in field-selection requests. Such requests do not prove exploitation, but can help identify systems requiring investigation. The practical risk of CVE-2026-77846 depends on application architecture. Internal applications without untrusted callers face lower exposure, while public search, filtering, and field-selection APIs require careful validation and access controls.
Ledger Fixes Ethereum App Flaw as Disclosure Timeline Is Disputed
TestMachine, Ledger and the Missing Release Record
Ledger's public Ethereum app repository creates another unresolved question. As of Aug. 24, its newest tagged release was version 1.22.1, dated May 27, 2026. Its only listed change was “Instability in APDU communication handling.” No August 2026 tagged release identifies the clear-signing substitution issue described by TestMachine. That does not establish that Ledger failed to patch the flaw. Ledger can distribute application updates through its device app store without creating a corresponding tagged GitHub release. Still, the public record does not allow users to verify Guillemet's “two weeks ago” timeline or determine which Ethereum app version contains the fix, as CoinLaw reports. Ledger has also not published a detailed technical advisory, affected-version list, or patched release identifier. Its guidance, echoed by Guillemet, is to keep firmware and apps updated.What Users Need to Check for the Ethereum App Vulnerability?
The patched Ethereum app has been described as available through Ledger Live, but updating the desktop or mobile interface alone may not replace an outdated application installed on the hardware wallet. Users therefore need to check the device's own app store and reinstall or update the Ethereum app separately. The incident also highlights why clear signing matters. Verifying transaction details on the hardware device itself, rather than relying solely on the paired software, is intended to protect users from transaction manipulation. The Ledger discussion should not be treated as evidence of confirmed losses from this flaw. At this stage, the facts establish a disputed disclosure timeline, an asserted fix, and a lack of independently verified theft—not confirmation that funds were lost or that the patch was never shipped. For TestMachine, Ledger and users alike, the unresolved issue is documentation. A dated, versioned security advisory identifying the affected versions and patch would allow users to verify their protection without relying on competing public statements.
Microsoft Says CVSS 10.0 Entra ID Code Execution Flaw Was Exploited Before Server-Side Fix
Microsoft disclosed on Thursday that a maximum-severity remote code execution vulnerability in Entra ID, the identity service underpinning Microsoft 365, Azure and Dynamics 365, was exploited in the wild before the company mitigated it on its own infrastructure. The flaw, tracked as CVE-2026-69836 and rated CVSS 10.0, required no authentication and no user interaction.
Entra ID, formerly Azure Active Directory, is the authentication and authorization layer for a large share of the world's enterprise cloud estates. It brokers sign-ins, conditional access decisions and token issuance across tenants, which makes any unauthenticated code execution in the service unusually consequential: an attacker operating inside that trust boundary is positioned upstream of nearly every control that depends on it.
According to Microsoft's advisory, the vulnerability stems from deserialization of untrusted data, a class of bug in which an application reconstructs attacker-controlled input into live objects without adequate validation. The result, per the advisory language, is that an unauthorized attacker can execute code over a network. Microsoft rated impact as high across confidentiality, integrity and availability, and characterized attack complexity as low. Credit for finding and reporting the issue went to a Microsoft principal security engineer.
Also read: Microsoft Entra ID Exposed: Actor Token Flaw Enables Stealthy Global Admin Takeover
Because Entra ID is a managed cloud service rather than software customers install, remediation happened server-side. Microsoft said the vulnerability has been fully mitigated and that there is no action for users of the service to take. Exploit code is not publicly available, the company said. Microsoft addressed several other maximum-severity cloud service issues, including flaws in Azure Arc and Exchange Online, in the same batch of disclosures.
What Microsoft did not say is drawing scrutiny. The advisory confirms exploitation but omits attribution, the window during which attacks occurred, how many tenants were touched, what attackers did after gaining execution, and any indicators defenders could use to check their own logs. Security teams face a structural problem here. With no patch to apply and no IOCs published, there is no independent way to confirm whether a given tenant was affected, and cloud-side telemetry that would answer the question sits with the provider.
The disclosure lands against a compliance backdrop that has grown less forgiving. Microsoft began issuing CVEs for cloud service vulnerabilities that require no customer action as part of transparency commitments made under its Secure Future Initiative, and CVE-2026-69836 is a test of how much that transparency actually delivers.
For U.S. public companies, exploitation of an identity provider raises Item 1.05 materiality questions under the Securities and Exchange Commission's cyber disclosure rule even when the fix is the vendor's determining whether a reportable incident occurred is difficult without provider-side evidence. In the European Union, operators in NIS2 scope carry 24-hour early-warning obligations that presuppose visibility they may not have.
Whether Microsoft publishes exploitation details or indicators, whether CISA issues supplemental guidance for federal tenants, and whether any organization ties confirmed intrusion activity to the flaw, enterprises should review Entra ID sign-in and audit logs for anomalous service principal activity, unexpected token issuance and privilege changes across the past several weeks, and re-examine standing assumptions about the identity layer.
The Cyber Express Weekly Roundup: Tax Data Breach, AI Security Risks, and Critical GitLab Flaw
The Cyber Express Weekly Roundup
French Tax Authority Data Breach Hits 678,000 People
France’s tax authority, DGFiP, confirmed a cyberattack that exposed tax and cadastral information belonging to 678,000 individuals and professionals. The accessed information includes tax income, withholding rates, business details, addresses, and property information. DGFiP said online accounts and passwords were not compromised and is continuing to investigate the incident. Read more...Cyberattack Targets Ukraine Agency Ahead of Major Asset Tender
Ukraine’s Asset Recovery and Management Agency (ARMA) suffered a suspected cyberattack shortly before a major deadline to select a manager for assets linked to sanctioned Russian oligarch Mikhail Fridman. ARMA said the incident, combined with earlier cyber activity and increased information pressure, could indicate a coordinated attempt to disrupt its operations or influence the tender. Read more...Oz Hair and Beauty Data Breach Exposes Customer Information
Oz Hair and Beauty confirmed that an unauthorized party accessed customer information, including names, email addresses, phone numbers, and purchase history. The company said credit card, banking, and home-address information were not compromised. The number of affected customers remains undisclosed, while an investigation into the breach continues. Read more...Enterprise AI Is Expanding the Cybersecurity Risk
Guild Group’s Mohammad Arif warned that the rapid adoption of enterprise AI is creating new cybersecurity challenges as AI systems gain access to sensitive data, applications, and business workflows. Key concerns include shadow AI, data leakage, insecure integrations, AI supply-chain attacks, prompt injection, and AI-powered phishing. Read more...Critical GitLab Flaw Could Let Attackers Delete Public Projects
GitLab patched a critical vulnerability, CVE-2026-19478, that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The flaw carries a CVSS score of 9.4. GitLab also addressed a high-severity GraphQL CSRF vulnerability, CVE-2026-19650. Read more...Weekly Cybersecurity Takeaway
This week’s incidents demonstrate that cybersecurity threats are increasingly crossing organizational and technological boundaries, affecting government systems, customer data, enterprise AI, and software development platforms. Organizations should prioritize strong access controls, rapid vulnerability patching, data protection, AI governance, employee awareness, and continuous monitoring. As attackers continue exploiting both human trust and technical weaknesses, security teams must adapt to a threat landscape that is becoming broader, faster, and increasingly interconnected.
Critical GitLab Flaw Lets Hackers Alter or Delete Public Projects
CVE-2026-19478 Among Critical GitLab Vulnerabilities
Tracked as CVE-2026-19478, the critical code injection flaw has a CVSS score of 9.4. Under certain conditions, an unauthenticated attacker could exploit a GraphQL directive to remotely modify or delete public projects and user data. The vulnerability affects GitLab CE/EE versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. GitLab credited hiimguardian with reporting CVE-2026-19478 through its HackerOne bug bounty program. The company did not state that the vulnerability had been exploited in the wild.CVE-2026-19650 Impacts GraphQL
The second issue, CVE-2026-19650, is a high-severity cross-site request forgery (CSRF) vulnerability affecting GitLab’s GraphQL multiplex query handler. It carries a CVSS score of 7.1. According to GitLab, the flaw could, under certain conditions, allow an unauthenticated user to execute mutations through GET requests because of improper request validation during GraphQL multiplex query handling. The issue affects the same GitLab CE/EE version ranges as CVE-2026-19478. Its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. GitLab credited Kreep with reporting the vulnerability through its HackerOne bug bounty program.GitLab Releases Security Updates
The patched versions address both vulnerabilities across affected deployment types, including Omnibus, source code and Helm chart installations unless otherwise specified. GitLab said the releases introduce no new migrations and should not require downtime for multi-node deployments. However, Omnibus packages normally stop the service, run migrations, and restart it during updates, regardless of the size of the upgrade. Administrators can change this behavior for updates by creating the /etc/gitlab/skip-auto-reconfigure file. GitLab.com and GitLab Dedicated were already running the patched versions, meaning customers using those services did not need to take action.Organizations Urged to Upgrade
GitLab recommended that installations running affected versions be upgraded to the latest patch release as soon as possible. The company also said its security fixes are released through scheduled and ad-hoc patch releases, with scheduled releases issued twice monthly on the second and fourth Wednesdays. GitLab stated that details of vulnerabilities are made public on its issue tracker 90 days after the release in which they are patched. The disclosure of CVE-2026-19478 and CVE-2026-19650 highlights the security risks associated with outdated installations and reinforces the need for timely patching against emerging GitLab vulnerabilities.
Microsoft August 2026 Patch Tuesday Fixes 400 Flaws, Including Three Zero-days
August 2026 Patch Tuesday Zero-days
Microsoft defines a zero-day as a vulnerability that has been publicly disclosed or actively exploited before an official fix is available. The three Zero-days addressed in August 2026 are: CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability: This actively exploited flaw allows a locally authenticated attacker to trigger a race condition through a specially crafted application and obtain SYSTEM privileges without user interaction. Microsoft credited Moshe Marelus and David Driker of Check Point. Check Point reported that North Korean Lazarus threat actors exploited the flaw in Zero-day attacks to deploy a new version of the FudModule kernel-mode rootkit. “During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit,” Check Point said. Microsoft has not disclosed exploitation details. CVE-2026-62832 — Windows User Profile Service Elevation of Privilege Vulnerability: This publicly disclosed flaw can allow an authenticated attacker with credentials for another local account to load another user’s registry hive, potentially access or modify data and gain administrator privileges. Microsoft credited an anonymous researcher. The details match the “LegacyHive” Zero-day disclosed last month by researcher Nightmare Eclipse. CVE-2026-72971 — Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability: This publicly disclosed flaw involves improper link resolution and allows authenticated attackers to perform local tampering. Microsoft attributed its discovery to yhw and txz but did not identify where the vulnerability was disclosed.August 2026 Security Updates
Microsoft’s August 2026 release consists of 421 Microsoft CVEs spanning Azure, Defender, Developer Tools, Exchange Server, Office, Office 2016, Other, SharePoint Server and Windows. Windows accounts for 236 vulnerabilities, Office for 98, SharePoint Server for 30, Developer Tools for 26, Azure for 17, Exchange Server for seven, Other for six, and Defender for one. The release also republishes two non-Microsoft CVEs: CVE-2026-6726 and CVE-2026-6727, both tagged as Windows TPM issues by MITRE. FAQs are available for both, while no workarounds or mitigations are listed. Separate non-security releases include Windows 11 KB5121003 and KB5120240 cumulative updates and the Windows 10 KB5120249 extended security update.
Gunra Ransomware Builds a New Attack Network Through RaaS
Gunra Ransomware Shifts to Affiliate Model
By early 2026, the group had expanded through a formal ransomware-as-a-service affiliate program advertised on dark web forums. The program provides affiliates with a management panel, configurable ransomware builder, cross-platform locker payloads and affiliate documentation. The FBI also observed Gunra operating under new branding aliases, including Golden Community, while recruiting penetration testers and ethical hackers as initial access brokers. Gunra initially focused on Windows environments before introducing a Linux variant and moving toward broader cross-platform targeting. Victims observed on the group’s dedicated leak site include organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Targeted sectors include healthcare and public health, financial services and insurance, critical manufacturing, transportation, government services, utilities, academia, media and communications, retail, and professional and nonprofit services.
VPN Vulnerabilities Used for Initial Access
According to the advisory, Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN gateways. The FBI observed exploitation of CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions. The Republic of Korea’s National Police Agency also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways to obtain unauthorized remote access. After gaining access, attackers used tools including Impacket utilities to move laterally through victim networks using SMB. In one case, actors compromised an SSL-VPN appliance using default credentials where account lockout controls were absent. They later used stolen session information to access internal virtual desktop infrastructure and move through systems including Active Directory servers and IT personnel workstations.Data Theft Precedes Encryption
The double-extortion ransomware operation involves stealing sensitive information before encrypting systems. The FBI observed Gunra actors collecting business-critical documents, databases, personally identifiable information, and internal email communications. In at least one case, the actors used a malicious executable called main.exe to exfiltrate data from Microsoft OneDrive and SharePoint. Compressed archives containing sensitive information were also transferred to the Mega file-sharing service, with the volume of exfiltrated data reaching tens of terabytes. For encryption, Gunra uses ChaCha20 and RSA-4096 algorithms and has been observed using the.ENCRT extension for encrypted files. A documented sample from July 2025 used the .CRYPT extension. The ransomware also uses Windows Management Instrumentation to delete volume shadow copies before encryption, while one victim had backup and archived data deleted from both primary and disaster recovery infrastructure.
Agencies Urge Patching and Network Segmentation
The authoring agencies recommend that organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure. They also advise implementing and testing offline, immutable backups stored in physically separate and segmented locations. Network segmentation is another key recommendation, intended to restrict lateral movement and limit the spread of ransomware between systems. The agencies also recommend reviewing domain controllers, servers, workstations and Active Directory environments for unrecognized accounts, auditing administrative privileges, requiring MFA where possible and testing security controls against the Gunra techniques mapped to the MITRE ATT&CK framework. The joint advisory was published August 10, 2026, as part of the ongoing #StopRansomware initiative.
CVE-2026-20316 Zero-Day Actively Exploited, Cisco Releases Fix
Static credentials expose Cisco Secure FMC systems
Cisco describes CVE-2026-20316 as a static credential vulnerability (CWE-259) caused by the presence of hardcoded credentials for a low-privilege account in the web interface of Cisco Secure FMC. A successful attack enables unauthorized access to sensitive information available to that account. Although the flaw carries a CVSS 3.1 base score of 5.3, Cisco assigned it a High Security Impact Rating because it can be chained with other Cisco Secure FMC vulnerabilities to achieve privilege escalation. According to Cisco's advisory, "If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced." However, the company stressed that no workarounds are available and urged customers to install the released hot fixes. The vulnerability affects Cisco Secure FMC software regardless of device configuration. Cisco confirmed that Cloud-Delivered FMC (cdFMC), Firewall Device Manager (FDM), Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Security Cloud Control (formerly Defense Orchestrator) are not affected.Indicators of compromise and available hot fixes
Cisco provided IoCs to help identify potential exploitation of CVE-2026-20316. Administrators are advised to run cat /var/log/messages | grep license in expert mode. Log entries referencing /var/tmp/license.tmp may indicate compromise. If exploitation is suspected, Cisco recommends contacting its Technical Assistance Center (TAC) and rotating all user credentials, cryptographic keys, and certificates on the affected Cisco Secure FMC device because exploitation has been ongoing. The company released hot fixes for software releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. Cisco emphasized that upgrading to the fixed software is the only complete remediation for CVE-2026-20316.CISA adds CVE-2026-20316 to KEV catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog on July 29, directing federal civilian agencies to remediate the issue by August 1. While Cisco acknowledged ongoing exploitation and published IoCs, it has not disclosed details about the attacks observed in the wild, and no public reports describing the campaigns have emerged. Horizon3.ai has also not released technical details about the vulnerability. Cisco additionally updated its advisory for CVE-2026-20079, a critical Cisco Secure FMC vulnerability originally patched in March. The latest disclosure follows several recent instances in which Cisco identified active exploitation targeting other products, including Catalyst SD-WAN Manager and Unified Communications Manager, highlighting the continued focus on securing enterprise networking infrastructure.
CVE-2026-63077 Exposes TeamCity Servers to Unauthenticated RCE
CVE-2026-63077 Enables Unauthenticated Access Over HTTP(S)
According to the advisory, CVE-2026-63077 allows an attacker with HTTP(S) access to a vulnerable TeamCity On-Premises server to bypass authentication checks and execute arbitrary operating system commands using the privileges assigned to the TeamCity server process. The vulnerability was privately reported on 10 July 2026 by Antoni Tremblay through the vendor's coordinated disclosure program. The issue has since been assigned to the CVE-2026-63077 identifier. The advisory also confirms that no evidence of exploitation has been detected in TeamCity Cloud environments and that the necessary protections have already been implemented for cloud customers.Security Updates and Patch Plugin Available
The vulnerability has been resolved in TeamCity On-Premises 2025.11.7 and 2026.1.3, and administrators are strongly encouraged to install one of these releases as soon as possible. Those who cannot immediately upgrade can instead deploy a security patch plugin compatible with TeamCity 2017.1 and later. For installations running TeamCity 2024.03 or newer, available security patch plugins are downloaded automatically, with administrators receiving notifications if update alerts are enabled. Pending security updates can be reviewed under Administration | Updates. Servers running TeamCity 2017.1 to 2018.1 require a restart after installing the plugin, whereas versions 2018.2 and later can enable it without restarting. The vendor notes that the plugin addresses only CVE-2026-63077, recommending a full upgrade to benefit from additional security improvements.Potential Impact and Recommended Defenses
The advisory states that CVE-2026-63077 affects TeamCity On-Premises servers accessible over HTTP(S). Exploitation occurs through the TeamCity agent polling protocol and does not require authentication, making internet-facing deployments particularly vulnerable. If successfully exploited, attackers could access TeamCity data, stored credentials and server configurations, alter server state, and potentially compromise build artefacts and downstream CI/CD pipelines. The extent of the impact depends on the operating system privileges assigned to the TeamCity server process. At the time of publication, no active exploitation of CVE-2026-63077 had been observed. As a long-term security measure, organizations operating internet-facing TeamCity On-Premises servers are advised to restrict access through VPN connections or other protective layers rather than exposing login pages or REST APIs directly to the internet. Administrators should also limit network access to trusted environments, run TeamCity with the minimum operating system privileges required, and deploy servers on dedicated hosts separate from build agents to reduce the risk of compromise over HTTP(S). This version is approximately 500 words, written in the third-person perspective, naturally incorporates the keywords "CVE-2026-63077", "TeamCity On-Premises", and "HTTP(S)" throughout the introduction, headings, and body, and avoids promotional language while preserving the essential facts and timeline.
Critical wp2shell Vulnerability Hits WordPress Core, Patch Released
wp2shell Vulnerability Exposed Core WordPress Sites
Tracked as CVE-2026-63030, the wp2shell vulnerability is described in the official WordPress release notes as a "REST API batch-route confusion and SQL injection" issue that can result in remote code execution. The flaw originates from the REST API batch endpoint located at /wp-json/batch/v1, or its legacy query-string alias ?rest_route=/batch/v1, allowing exploitation through a single anonymous web request. The vulnerability was discovered by Adam Kues of Assetnote, an attack surface management division of Searchlight Cyber, through the WordPress HackerOne programme. To provide defenders time to update their systems, Searchlight Cyber intentionally withheld technical exploitation details, stating, "Given the egregious nature of the flaw and to ensure defenders have adequate time, we are refraining from disclosing technical specifics at this juncture."Second SQL Injection Flaw Patched
The same security release also fixed CVE-2026-60137, another critical SQL injection vulnerability. WordPress credited researchers TF1T, dtro, and haongo for reporting the issue. Unlike the wp2shell vulnerability, this flaw predates the latest release and was backported to WordPress 6.8.6. The wp2shell vulnerability only affects versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. Severity ratings differ across security advisories. While WordPress classifies CVE-2026-63030 as "high severity," the corresponding GitHub Security Advisory (GHSA-ff9f-jf42-662q) labels it as Critical with a CVSS score of 7.5. Regardless of classification, both vulnerabilities require immediate patching because the wp2shell vulnerability can be exploited without authentication.Immediate Updates Recommended
Powering around 40% of websites, WordPress responded by enabling forced automatic updates for affected versions, including WordPress 7.1 beta2, to secure pre-release installations. As of 17 July, there were no confirmed reports of active exploitation. However, security researchers warned that because WordPress is open source and patch-related code changes became publicly available immediately, proof-of-concept exploits could emerge within hours. Administrators should verify that every internet-facing WordPress installation has successfully received the update, as some hosting environments disable automatic updates or lock websites to specific versions. Site owners can also check exposure using the public tool available at wp2shell.com. If immediate patching is not possible, temporarily blocking both REST API batch endpoints at the Web Application Firewall (WAF) level can reduce risk, although this should not replace installing the official update. Security teams managing multiple WordPress websites should also monitor for spikes in anonymous web request traffic targeting batch endpoints, as the wp2shell vulnerability demonstrates how overlooked core features can introduce severe security risks.
ZTNA Emerges as VPN Security Risks Put Federal Networks on Alert
VPN Security Risks Drive ZTNA Considerations
A traditional VPN creates an encrypted connection between a remote user's device and an organization's internal network. The VPN appliance typically sits at the edge of the network and remains accessible from the public internet, where it authenticates users before granting access. This architecture creates several security concerns. VPN appliances must maintain publicly accessible listening ports, making them discoverable and scannable by attackers. If vulnerabilities remain unpatched, those weaknesses can potentially be exploited remotely. The memorandum also points to risks involving legacy code bases, key-exchange processes, and lateral movement. Attackers who obtain legitimate VPN credentials, exploit a vulnerability, or hijack an active session may gain broad access to the internal network. Unlike application-specific access, traditional VPN access operates at the network layer, potentially allowing an authenticated user to reach multiple permitted subnets. Recent incidents involving vulnerable VPN appliances have further highlighted these concerns. The memorandum cites CISA directives addressing exploitation involving Pulse Connect Secure, VMware, and Ivanti Connect Secure products.How ZTNA Changes Remote Access
ZTNA uses a "never trust, always verify" approach. Instead of treating users inside a network as inherently trusted, the architecture evaluates access requests based on factors such as identity, device health, user role, location, behavior, and risk. The architecture is built around three core components: the Policy Engine, which makes access decisions; the Policy Administrator, which establishes or ends sessions; and the Policy Enforcement Point, which enables, monitors, and terminates connections. Modern ZTNA deployments can also use outbound-only connections, removing the need for publicly accessible inbound listening ports. Rather than placing a user directly onto a corporate network, ZTNA can create an encrypted, application-specific micro-tunnel that limits the user to an authorized resource. Continuous verification is another key difference. Access is not necessarily granted once and maintained for the entire session. Instead, policies can reassess access based on changing security and contextual signals.ZTNA Also Brings New Security Risks
The shift to ZTNA does not eliminate cybersecurity risks. The memorandum identifies the control plane as a significant concern because it is responsible for authentication, device verification, policy enforcement, and connection management. If an attacker compromises a ZTNA provider or components such as the Policy Engine or Policy Administrator, access decisions could potentially be manipulated. This could result in unauthorized access or prevent legitimate users from reaching resources. Additional security controls, including cryptographic signing of device nodes, may help reduce the impact of a compromised ZTNA provider. The memorandum cites Tailscale Tailnet Lock as an example of this approach.Federal Agencies Face a Complex Transition
For federal agencies, moving from VPN to ZTNA involves more than replacing one remote-access technology with another. Agencies must consider federal cybersecurity policies, budgets, legacy infrastructure, authentication requirements, and cryptographic standards. NIST Special Publication 800-207 established foundational principles for Zero Trust Architecture, while Executive Order 14028 directed federal agencies toward zero trust, multifactor authentication, and secure cloud services. OMB Memorandum M-22-09 later established a federal zero-trust strategy centered on identity, devices, networks, applications and workloads, and data. A transition could involve assessing existing VPN deployments, identifying applications and user groups, deploying ZTNA alongside VPN infrastructure, and progressively migrating applications. VPN infrastructure could then be decommissioned after applications and users are migrated and validated. However, agencies must also account for recurring ZTNA subscription costs, legacy systems that may not support modern authentication, post-quantum cryptography requirements, NIST standards, FIPS requirements, and FedRAMP approval for cloud-based services. The transition from VPN to ZTNA therefore represents a broader change in how organizations approach remote access. While ZTNA can reduce exposure associated with publicly accessible network perimeters and broad network-level access, agencies must evaluate the technology's own control-plane risks, compliance requirements, costs, and technical limitations before making the shift.
Two Old Oj Flaws Chained to Trigger GitLab Remote Code Execution
Yuhang Wu Discovers GitLab Vulnerability in Oj Parser
As part of the Open Defense Initiative, Depthfirst researcher Yuhang Wu used an automated analysis system to examine Oj, a high-performance native C-based JSON parser used across Ruby applications, including GitLab. The analysis identified 18 prioritised vulnerabilities, seven of which were memory-safety issues. Two of these flaws had remained undetected for nearly five years before being combined into a working exploit chain. The vulnerabilities included an unchecked nesting-stack write in Oj::Parser.usual.parse and an unsafe 16-bit key-length narrowing issue that leaked a heap pointer. Individually, the bugs appeared limited, offering only a repeated one-byte write primitive and a fixed 29-byte memory disclosure. However, by carefully manipulating heap allocation, the exploit gained control of a callback pointer and bypassed Address Space Layout Randomisation (ASLR), enabling arbitrary code execution as the "git" system user.Jupyter Notebook Processing Creates Attack Path
The GitLab vulnerability stems from the platform's handling of Jupyter Notebook (.ipynb) files. GitLab uses an in-tree gem called ipynbdiff to generate human-readable notebook differences. Before displaying a diff, the gem parses each notebook with Oj to verify that the JSON contains a "cells" field. Because Jupyter Notebook files are JSON documents, any authenticated user with permission to push commits and view commit differences could submit specially crafted notebook files. The exploit chain used two malicious notebook files in a single commit-diff request. The first abused excessive nesting depth to corrupt an internal buffer pointer, eventually allowing a Ruby Array to overlap with a parser callback pointer and overwrite p->start with an attacker-controlled address. The second file leaked a heap pointer through an oversized JSON object key that appeared in the generated HTML diff. This disclosed the memory addresses of libraries such as libc and libruby, defeating ASLR. Since GitLab's Puma application server processes multiple threads using a shared parser instance, both files were handled by the same vulnerable parser, allowing the corrupted callback to invoke system() and execute shell commands. Unlike previous GitLab remote code execution vulnerabilities that depended on server-side request forgery (SSRF) against Redis, this GitLab vulnerability bypassed modern SSRF protections by targeting a native memory-unsafe dependency within Ruby code. Any project member with standard push and diff-view permissions could trigger the attack without administrator privileges, CI/CD access or user interaction. According to Depthfirst, successful exploitation could expose repository source code, Rails secrets, service credentials, and internal services, creating risks of data theft, code tampering, and lateral movement.Affected Versions and Available Fixes
The GitLab vulnerability affects GitLab CE/EE versions 15.2.0-18.10.7, fixed in 18.10.8; 18.11.0-18.11.4, fixed in 18.11.5; and 19.0.0-19.0.1, fixed in 19.0.2. The Oj gem is affected from versions 3.13.0-3.17.1 and fixed in version 3.17.3. GitLab.com had already been patched before disclosure, while GitLab Dedicated customers required no action. Self-managed deployments running affected versions should upgrade immediately. The vulnerable Oj code was introduced in August 2021, with GitLab adopting the affected parser in July 2022 through version 15.2.0. Yuhang Wu reported the Oj flaws on 21 May 2026 after they had remained undiscovered for 1,753 days. Oj merged fixes on 27 May, released version 3.17.3 on 4 June, and the GitLab exploit chain was reported on 5 June, confirmed on 8 June and patched on 10 June 2026 in releases 19.0.2, 18.11.5 and 18.10.8. The same research also uncovered nine additional published CVEs affecting Oj, including stack and heap buffer overflows, use-after-free vulnerabilities, a negative-size memcpy flaw and a large-file integer overflow, highlighting the risks posed by memory-unsafe native extensions in Ruby applications.
2.2 Million Vehicles Exposed to KARR Bluetooth Security Flaw
KARR Security System Vulnerability Affects Dealer-installed Hardware
The KARR Security System is installed by dealerships to secure vehicles on their lots. In many cases, the hardware remains connected even after buyers decline the paid KARR alarm service. Because it is third-party equipment, automakers cannot deliver fixes through their standard software update process. Researchers from the University of California, San Diego found that attackers within Bluetooth range could lock or unlock vehicles, disable alarms, activate horns, flash lights, or prevent parked vehicles from starting. However, they confirmed the flaw cannot remotely start a vehicle or control it while driving.iPhone App Update Fixes KARR Alarm Flaw
Acrisure Protection Group, which sells the KARR Security System, released a firmware update on July 20 after researchers privately disclosed the issue in January 2025. Owners using the KARR Security app on an iPhone should receive an update notification. Others must download the app, connect it to the KARR alarm, then navigate to "Customer Service" and "Firmware Update." The patch was released before presentations scheduled for DEF CON on August 9 in Las Vegas and the USENIX Security Symposium on August 12 in Baltimore.Hidden KARR Security System Complicates Updates
Researchers estimate at least half of affected owners never requested the KARR Security System. Dealerships often left deactivated hardware installed, yet researchers found these units continued broadcasting Bluetooth signals while vehicles were running and for up to 10 minutes after being switched off. Owners can identify the system by checking for a KARR or "SWDS" sticker on the driver's window or a blinking button beneath the dashboard. Most affected vehicles were purchased from Honda, Toyota, Mazda, Ford and Jeep dealerships in Southern California between 2017 and July 21, although impacted vehicles were also identified elsewhere.Shared Bluetooth Key Exposes KARR Alarm Devices
Researchers discovered a universal authentication key embedded in the official smartphone app while reverse engineering Bluetooth communications. Using a proof-of-concept Android app, they unlocked vehicles, disabled KARR alarm functions, and triggered horns and lights. Although the flaw alone cannot steal a vehicle, researchers said it could provide quiet access before a commercially available locksmith tool creates a working key. Acrisure described the attack as "highly complex" and said the real-world risk is low. Neither UC San Diego nor Wired found evidence of criminals exploiting the vulnerability.Privacy Concerns and Recommended Action
Researchers also warned that Bluetooth signals from the KARR Security System could reveal vehicle locations. Using the WiGLE wireless database, they estimated at least 2.2 million Bluetooth-enabled systems had been deployed and detected 97 KARR-equipped vehicles during a 20-minute drive near the UC San Diego campus. Drivers should confirm whether their vehicle contains a KARR Security System, install the latest firmware using the iPhone or Android app, and contact their dealership or KARR support if they cannot complete the update.
Oracle July 2026 Patch Fixes 1,434 CVEs Across 334 Products
July 2026 Critical Patch Update Covers Hundreds of Oracle Products
The latest Oracle security patch spans a wide range of enterprise products and platforms. Among the affected products are Database Server, Oracle APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite. The July 2026 Critical Patch Update also includes security fixes for Enterprise Manager, Financial Services Applications, Food and Beverage Applications, Fusion Middleware, Analytics, HealthCare Applications, Hospitality Applications, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Applications, Siebel CRM, Supply Chain, Systems, Utilities Applications, and Virtualization. By addressing vulnerabilities across such an extensive product lineup, the Oracle security patch aims to reduce the risk posed by security weaknesses that could affect organizations running Oracle technologies in production environments.Hundreds of Vulnerabilities Can Be Exploited Remotely
A notable aspect of the July 2026 Critical Patch Update is the number of flaws that attackers could potentially exploit without requiring authentication. Oracle stated that roughly 600 of the patches fix vulnerabilities that can be exploited remotely by unauthenticated attackers. In addition, hundreds of the addressed security flaws have been assigned critical severity ratings, emphasizing the importance of applying the latest Oracle security patch without delay. Among Oracle's products, the highest number of vulnerabilities were addressed in:- E-Business Suite: 410 vulnerabilities
- Fusion Middleware: 355 vulnerabilities
- Communications: 168 vulnerabilities
- PeopleSoft: 84 vulnerabilities
AI-Driven Vulnerability Discovery Appears to Have Played a Major Role
One of the most notable aspects of the July 2026 Critical Patch Update is Oracle's growing use of artificial intelligence for security research. Only a few dozen of the vulnerabilities included in the release were credited to external security researchers. This indicates that the overwhelming majority of the discovered flaws were identified internally, likely with the assistance of AI-driven vulnerability analysis. Earlier this year, Oracle disclosed that it has access to leading artificial intelligence systems, including Anthropic's Claude Mythos and OpenAI's most capable models. According to the company, these AI technologies are being used to accelerate vulnerability discovery and improve the speed and accuracy of security patch development. Oracle also said it is applying this AI-driven vulnerability approach across its own software and cloud services, Oracle Health offerings, and the open source components that it both develops and depends on.Organizations Urged to Apply the Oracle Security Patch Promptly
The release of the July 2026 Critical Patch Update comes amid continued efforts by threat actors to exploit vulnerabilities in enterprise software before organizations can deploy security updates. Oracle product vulnerabilities have previously been targeted in real-world attacks. The company cited examples that include the exploitation of a PeopleSoft zero-day vulnerability as well as a recently patched Oracle E-Business Suite (EBS) vulnerability. Given the number of remotely exploitable and high-severity issues resolved in the Oracle security patch, organizations using affected Oracle products are advised to install the updates as soon as possible. Prompt deployment can help reduce exposure to attacks that take advantage of publicly known vulnerabilities before systems are secured. With 1,449 security patches addressing 1,434 unique CVEs across 334 products, the July 2026 Critical Patch Update represents one of Oracle's most extensive quarterly security releases.
Apple Faces Lawsuit Over Hide My Email Privacy Vulnerability
