Some of the world's leading democracies are pushing governments and companies to start preparing for post-quantum cryptography before quantum computers become powerful enough to break the encryption systems that protect global digital infrastructure today.

In a joint advisory released Thursday, the G7 Cybersecurity Working Group and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said organizations should begin their transition to post-quantum cryptography now, rather than waiting until cryptographically relevant quantum computers (CRQCs) are available to threat actors.

Why the Post-Quantum Cryptography Shift Cannot Wait

The publication, titled "Preparing for the Post-Quantum Era: A Call to Action," warns that the quantum computing threat is no longer a distant concern. While the exact timeline for CRQC development remains uncertain, the working group said recent technological advances suggest such machines could emerge sooner than expected, putting widely used public-key cryptography mechanisms at risk.

One of the most immediate dangers is a tactic known as "harvest now, decrypt later," where malicious actors intercept and store encrypted data today with the intention of decrypting it once a CRQC becomes available. This poses a serious risk to governmental records, sensitive personal data, and trade or business secrets that require long-term confidentiality.

The advisory also cautions that CRQCs could eventually be used to target authentication mechanisms, allowing bad actors to impersonate trusted entities, forge data, or compromise equipment. Because supply chain vulnerabilities can cascade, a single organization's delay in adopting post-quantum cryptography could expose entire sectors to compromise.

According to the report, organizations that fail to act may also face business consequences beyond security risk, including exclusion from public procurement contracts and loss of competitive advantage.

Five Priorities for the PQC Transition

The G7 Cybersecurity Working Group outlined five priority areas to guide the global shift toward post-quantum cryptography:

1. Raising awareness — Many organizations still view the quantum threat as a distant or purely technical issue. The group called for awareness campaigns, technical guidance, and workforce upskilling to reframe it as an economic and business risk.
2. Developing national strategies — Countries are encouraged to build strategies that ensure an adequate supply of quantum-safe hardware and software while encouraging adoption, integrating the effort into broader digital privacy and security policies.
3. Advancing research and development — Governments should fund research programs and support pilot projects and testbeds to help organizations test and refine their transition to post-quantum cryptography.
4. Building public-private partnerships — Collaboration between government, industry, and academia is seen as key to developing domestic expertise, lowering transition costs, and sharing playbooks and case studies across sectors.
5. Integrating PQC into cybersecurity requirements — The group recommends treating post-quantum cryptography adoption as a natural evolution of cryptographic best practice, and embedding requirements into public procurement to push both vendors and organizations toward quantum-safe systems.

The advisory emphasizes that the shift to post-quantum cryptography cannot be solved by individual organizations in isolation. Instead, it calls for early engagement, coordinated planning, and informed decision-making across public and private sectors worldwide.

Tackling the risks that the impending quantum computing era poses to current cryptographic systems... requires a coordinated global effort to transition to PQC," the report states, adding that public and private organizations must act now to safeguard confidential data, supply chains, and critical systems.

The document was jointly published by cybersecurity authorities from Canada, Germany, Italy, Japan, the United Kingdom, the United States, and France's ANSSI, with participation from the European Commission and support from the EU Agency for Cybersecurity (ENISA).

CISA added CVE-2023-49105 to its exploited-flaws catalog after researchers tied the old ownCloud bug to reported Philippine nuclear data theft.

The post CISA Flags Old ownCloud Flaw After Reported Philippine Nuclear Data Theft appeared first on TechRepublic.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Google Chromium V8 flaw, tracked as CVE-2026-85046 (CVSS score of 8,8), to its Known Exploited Vulnerabilities (KEV) catalog.

This week, Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046, an actively exploited V8 type confusion flaw.

The bug affects Chrome’s JavaScript and WebAssembly engine and could let a remote attacker execute arbitrary code inside the browser sandbox by using a specially crafted HTML page.

“CVE-2026-85046: Type confusion in V8.” reads the advisory. “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”

As usual, Google did not disclose technical details about the attacks exploiting this vulnerability or attribute them to any specific threat actor.

Security researcher Salvatore Gulizia, known as Serotav, reported the flaw on August 4, 2026, and received a $1,000 bug bounty.

“a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arb r/w on the js heap.” wrote Serotav. “The bug was present in both maglev and turbofan.”

CVE-2026-85046 is the sixth actively exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild:

• February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS.
• March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine.
• April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing.
• June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine

Google has updated Chrome Stable to version 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, with the rollout happening over the coming days and weeks.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by September 18, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-81578 (CVSS score of 8.8) PaperCut NG/MF Missing Authentication for Critical Function Vulnerability 
• CVE-2026-82078 (CVSS score of 9.4) PaperCut NG/MF Unsafe Reflection Vulnerability 

PaperCut, the print management software running in schools, hospitals, and offices worldwide, recently confirmed that a pre-authentication remote code execution flaw, tracked as CVE-2026-81578, is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install.

“Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress.

“Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.”

The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page.

PaperCut checks the permissions for the page it displays instead of the action it actually performs. The flaw CVE-2026-81578 can let an attacker change the server’s configuration without logging in.

That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server.

The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic.

The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse.

The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise.

“After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb”

PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published.

The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available.

Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.

The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 14.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Critical Ebyte NA111-M vulnerabilities like CVE-2026-73125 could allow attackers to fully compromise the device. Review CISA guidance and mitigations.

Related Posts:

• Critical MongoDB Security Vulnerabilities Require Immediate Patching
• D-Link DIR-X1860Z Flaw Lets Attackers Change the Admin Password Without Login
• CVE-2026-19313 (CVSS 9.3): WatchGuard Fireware Pre-Authentication Remote Code Execution Flaws Patched

The post CVE-2026-73125: Ebyte NA111-M Flaws Let Attackers Fully Compromise the Device appeared first on Daily CyberSecurity.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2023-49105 ownCloud Improper Authentication Vulnerability
• CVE-2026-53362 Linux Kernel Unspecified Vulnerability
• CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability 

CVE-2023-49105 (CVSS score of 9.8) is an improper-authentication flaw in ownCloud Server’s WebDAV functionality. An unauthenticated attacker who knows a victim’s username can read, alter, or delete that user’s files when no signing key is configured, because the application can accept pre-signed URLs without properly validating that condition. The issue affects ownCloud core versions 10.6.0 through 10.13.0, before version 10.13.1.

Organisations running affected ownCloud instances should treat remediation as urgent, review exposed WebDAV services, and investigate unusual file access, deletion, modification, or downloads.

CVE-2026-53362 (CVSS score of 7.8) is an out-of-bounds memory-write vulnerability in the Linux kernel’s IPv6 networking subsystem. A local attacker who can create UDP sockets could exploit an incorrect parameter-length calculation during fragmented IPv6 packet handling to overwrite kernel memory, potentially causing a system crash, corrupting data, or escalating privileges.access.

Shortly after the Hugging Face incident became public, OpenAI said its models had identified and exploited a zero-day vulnerability in JFrog’s Artifactory package registry manager.

The report also describes a separate incident on July 19. In that case, some AI agents exploited the Linux kernel vulnerability, CVE-2026-53362, to gain higher privileges inside an OpenAI environment.

The agents detected that the Linux kernel on their machine was vulnerable, found a public exploit, modified it to work in their environment, and used it to gain root access to the underlying worker node. This allowed them to escape the Artifactory container and move laterally to other parts of the connected environment.

CVE-2026-66384 (CVSS score of 5.3) is a path-traversal vulnerability in JFrog Artifactory’s Docker cache handling. Under specific remote-repository conditions, an authenticated user can manipulate a file path and write data outside the intended cache directory, potentially affecting other locations on the Artifactory host.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw CVE-2026-66384 by September 10, while the remaining must be addressed by August, 30, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

CISA warns that Xiiaozet LK100W vulnerabilities, including CVE-2026-78239, allow attackers to take full control of affected devices. Update now.

Related Posts:

• Critical MongoDB Security Vulnerabilities Require Immediate Patching
• CVE-2026-73125: Ebyte NA111-M Flaws Let Attackers Fully Compromise the Device
• D-Link DIR-X1860Z Flaw Lets Attackers Change the Admin Password Without Login

The post CISA Issues Advisory on Xiiaozet LK100W Vulnerabilities appeared first on Daily CyberSecurity.

The CISA Vulnerability Review finds known exploited vulnerabilities and decades-old software flaws drive most compromises across FY2024 and FY2025.

Related Posts:

• Critical MongoDB Security Vulnerabilities Require Immediate Patching
• CVE-2026-73125: Ebyte NA111-M Flaws Let Attackers Fully Compromise the Device
• D-Link DIR-X1860Z Flaw Lets Attackers Change the Admin Password Without Login

The post CISA Vulnerability Review: Old Flaws Fuel Most Attacks appeared first on Daily CyberSecurity.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability
• CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
• CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
• CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability
• CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2015-3246 is a race condition in Red Hat libuser that could let an authenticated local user corrupt /etc/passwd to cause denial of service or escalate privileges.

CVE-2015-5287 is a privilege escalation bug in Red Hat Automatic Bug Reporting Tool that could allow local users with certain permissions to gain higher privileges via a symlink attack on a predictable file.

CVE-2019-1068 is a remote code execution flaw in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.

CVE-2021-23758 (CVSS score not specified in the KEV notice) is a deserialization of untrusted data vulnerability in Ajax.NET Professional that could allow for remote code execution via arbitrary .NET classes.

CVE-2022-0995 (CVSS score not specified in the KEV notice) is an out-of-bounds memory write vulnerability in Linux Kernel that could allow a local user to gain privileged access or cause a denial of service on the system.

CVE-2026-8452 (CVSS score not specified in the KEV notice) is an improper restriction of operations within the bounds of a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway that could lead to denial-of-service and has been observed under active exploitation in the wild.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, while the remaining must be addressed by September 9, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

CISA urges water utilities to find and secure internet-exposed PLCs after July attacks showed how easily exposed industrial systems can be compromised.

Over 100 internet-exposed systems in the US water and wastewater sector got hit by cyberattacks in July 2026, and CISA’s response wasn’t just an incident report, it was a how-to guide for making sure it doesn’t happen to you next. The agency’s exposure reduction guidance, published August 21, walks through exactly how organizations can find their own internet-facing weak points before an attacker does.

The pattern behind the July attacks was surprisingly simple. Most of the affected systems were programmable logic controllers (PLCs), small industrial computers that control pumps and valves. Many connected directly to cellular modems and had no firewall or gateway between them and the internet. CISA warns that this type of setup can expose PLCs to serious security risks.

“Directly connecting PLCs to the internet through cellular modems can create significant security risks. However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary.” states CISA.

Hackers remotely accessed exposed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating what CISA called unsafe conditions without notifying the operators running the actual equipment. Iran is the suspected actor behind much of this activity, likely tied to the ongoing war involving the US and Israel, though officials have stopped short of a formal attribution.

CISA presents reconnaissance as an ongoing process. Organizations need to know which systems they expose to the internet and can use tools such as Shodan, Censys, or CISA’s Cyber Hygiene Vulnerability Scanning service to check their own IP ranges from the outside.

The review should also cover ports used by industrial systems. Besides SSH, RDP, and HTTP, CISA highlights protocols such as Modbus, EtherNet/IP, DNP3, BACnet, and OPC UA. Finding one of these ports open does not automatically mean the system has been compromised, but it does indicate an exposure that needs to be investigated and addressed quickly.

Where remote access is genuinely necessary, CISA’s advice is to route everything through a secure, centrally managed gateway rather than connecting straight to a PLC, HMI, or remote terminal unit. Pair that with phishing-resistant multi-factor authentication, unique credentials instead of shared defaults, and active monitoring of traffic in and out, and you’ve closed most of the gap that let this particular wave of attacks succeed in the first place. None of this is exotic security engineering; it’s the same basic hygiene that’s been recommended for years, just finally getting attention because attackers are actually using the gap.

This isn’t an isolated incident CISA is responding to reactively, either. The water sector attacks sit inside a much larger pattern of nation-state interest in US and allied critical infrastructure, from China’s Volt Typhoon reportedly pre-positioning malware inside American infrastructure as a potential wartime disruption tool, to Russian-linked campaigns testing water and energy systems across Europe as part of broader pressure on NATO. If a foreign government is willing to spend years quietly waiting inside a power grid, an exposed PLC with a factory-default password isn’t a minor oversight, it’s an open invitation.

“CISA urges all critical infrastructure organizations to route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, rather than connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU).” concludes CISA. “The July 2026 malicious cyber activity targeting WWS Sector entities demonstrates the consequences of directly exposing PLCs to the internet. Threat actors remotely accessed internet-exposed PLCs, changed device IP addresses and passwords, and caused loss of monitoring and control functionality and, in some cases, operational disruptions.”

If you run anything with the letters PLC, SCADA, ICS, or HMI in its job description, this guidance isn’t optional reading for next quarter. Go run the scan today, because the alternative is finding out the hard way that someone else already ran it for you.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Water Utilities)

CISA red teams fully compromised two critical infrastructure orgs. One SOC isolated hosts in minutes; the other never detected the breach.

CISA published an advisory (AA26-237A) documenting two simultaneous red team assessments at critical infrastructure organizations. Both organizations lost full domain control and had their cloud environments compromised. One of them didn’t know until CISA told them afterward.

“The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources.” states CISA. “Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model.”

Organization A is a Government Services and Facilities Sector entity. Organization B operates in the Water and Wastewater Systems Sector. The red team used comparable techniques against both. The difference in outcome was entirely about detection and response, not the sophistication of the attack.

At Organization A, the red team found a web application that still used default credentials. They used it to send phishing emails from a trusted internal address and gained access to four workstations. From there, they exploited a misconfigured Active Directory Certificate Services template with the ESC1 flaw. This allowed a low-privileged user to request certificates for other users, including administrators. They then reached all the targeted sensitive business systems without anyone noticing. After moving into the cloud, they even read SOC staff emails to see if the attack had been detected. It hadn’t.

“Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm defenders, obscuring real threats.” CISA continues. “Organizations that tune alerts to highlight anomalies and filter out normal business activity enable defenders to focus on genuine incidents and respond rapidly.”

Organization A’s SOC was receiving thousands of false positive alerts, many at higher severity than the actual intrusion alerts the red team was generating. Staff eventually reviewed SCCM-related alerts from real red team activity, couldn’t identify the system’s owner or function, and marked it a false positive.

The red team confirmed the miss by reading SOC email. Then they used keyloggers and screenshot capture on SOC workstations to make sure nothing was coming. Nothing was. The organization had multiple separate SOCs with different EDR solutions and no cross-team visibility, which meant that even if one team noticed something, there was no mechanism to act on it across the relevant systems.

“Detection tools are only as effective as the people, processes, and procedures supporting them. SOC staff should not operate in silos and should have clear authority unhindered by bureaucracy to effectively contain and resolve incidents.” add CISA.

At Organization A, SOC analysts were managing systems they didn’t fully understand and had no written escalation procedures, so their default response to ambiguity was to wait. At Organization B, staff triaged, investigated, coordinated with engineering, and reimaged machines before handing them back to users.

At Organization B, the red team still found important security gaps. They discovered a password stored in plain text inside an XML file on an SCCM distribution point. They used the related service account to gain powerful rights over a domain controller and then performed a DCSync attack, obtaining the krbtgt hash. This allowed them to create Golden Tickets and impersonate users across the domain.

They also found a path into the OT network through RDP files pointing to a bastion host. Using FTP credentials found on a jump server, they connected to the bastion through SSH. The bastion had no outbound internet access, so their payload could not run, and the SOC quarantined the host. Still, the access path was there.

Both organizations also had the same cloud security problem: neither had enabled Conditional Access for workload identities. This Microsoft feature applies access controls to applications and service accounts, not just human users. Without it, applications with broad Microsoft Graph permissions can bypass normal Conditional Access rules. CISA’s red team used this gap in both organizations to access emails across the companies.

In Organization A, the team also found AWS IAM credentials stored in users’ home directories with no expiration date. Those credentials could remain valid indefinitely, creating another long-term risk.

In Organization B’s cloud environment, the red team abused Seamless SSO by using Kerberos tickets obtained via DCSync to authenticate to Azure without needing any user’s cleartext password. They found a disabled AD-synced account that owned an application with permission to read, write, and send emails for every user in the tenant. They re-enabled the account, DCSynced its credentials, added a client secret to the application, and could then access the full mailbox of every employee from the public internet. Organization B’s detections flagged the AzureHound tool by user agent and caught anomalous Microsoft Graph API request volumes, but those controls arrived after the initial cloud access was already established.

CISA recommends several practical steps to improve security. These include hardening ADCS by disabling CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT on templates and limiting who can enroll, setting the Machine Account Quota to zero when there is no operational need, and removing cleartext credentials from workstations and network shares.

Organizations should also enable Conditional Access for workload identities, create procedures to revoke tokens, and treat SCCM and similar endpoint management platforms as Tier 0 assets, giving them the same level of protection as domain controllers.

The full advisory also maps each red team technique to its MITRE ATT&CK identifier and compares how well the two organizations detected the different stages of the attacks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gitea flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-60004 (CVSS score of 9,8), to its Known Exploited Vulnerabilities (KEV) catalog.

Gitea is an open-source platform for hosting and managing Git repositories. Think of it as a self-hosted alternative to GitHub or GitLab.

CVE-2026-60004 is a critical remote code execution flaw that allows an attacker with write access to a repository to execute arbitrary shell commands as the Gitea service user.

The flaw affects Gitea versions from 1.17 and was fixed in 1.27.1. The vulnerable diffpatch API can be abused to plant and execute a malicious Git hook. Because Gitea enables open registration by default, an unauthenticated attacker can create an account, create a repository, and exploit the flaw without existing credentials. A reported attack used the vulnerability to deploy a cryptocurrency-miner-like payload after an exposed Gitea instance allowed open registration and anonymous access to its web interface.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by August 28, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-21962 (CVSS score of 10,0), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-21962 is a critical, unauthenticated vulnerability affecting the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS.

An attacker does not need an account or valid credentials. With network access, they can exploit the flaw remotely through HTTP and potentially compromise the affected server. Successful exploitation could allow the attacker to access, modify or delete critical data, potentially gaining broad access to information available through the affected components.

“Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in accessible data,” CISA reports.

The vulnerability also has a scope-change impact, meaning an attacker who exploits it could potentially affect other systems or applications connected to the vulnerable Oracle components.

The flaw affects versions: 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0.

In practical terms, this is dangerous because an internet-accessible Oracle WebLogic proxy component could provide an attacker with a path into critical backend systems without requiring authentication.

In March 2026, CloudSEK researchers detected attacks targeting several known flaws in Oracle WebLogic against its honeypot network. Attackers also targeted CVE-2026-21962 along with older WebLogic RCE vulnerabilities, including CVE-2020-14882/14883, CVE-2020-2551 and CVE-2017-10271.

“This report analyzes attack data collected from a high-interaction honeypot simulating a vulnerable Oracle WebLogic Server (v14.1.1.0.0) over a 12-day period (Jan 22 – Feb 3, 2026). The primary focus is the immediate and widespread exploitation of the newly disclosed, critical unauthenticated Remote Code Execution (RCE) vulnerability, CVE-2026-21962 (CVSS: 10.0).” ” reads the report published CloudSEK.

“In addition to CVE-2026-21962, the honeypot captured attacks targeting other persistent, critical WebLogic RCE flaws, including CVE-2020-14882/14883 (Console RCE), CVE-2020-2551 (IIOP RCE), and CVE-2017-10271 (WLS-WSAT RCE). This confirms that threat actors continue to rely on a small set of highly-effective, simple-to-exploit vulnerabilities to compromise WebLogic environments.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by August 27, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Zimbra Collaboration Suite (ZCS) flaw CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog.

CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting the critical vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated remote code execution and was patched less than a month ago.

“The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.” reads the advisory published by CERT Polska. “The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the  snmp_notify parameter  and the swatchdog service running (enabled by default).”

The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component.

Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough.

The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations.

Below are recommendations by CERT Polska:

“Due to the ongoing campaign exploiting this vulnerability, we recommend:

• verifying Zimbra logs /var/log/zimbra.log for the following entries:

Service status change: <szkodliwy ładunek> changed from stopped to running
Service status change: <szkodliwy ładunek> changed from running to stopped

• verification of files created by user zimbra in the last 30 days in the following directories:

/opt/zimbra/jetty/webapps/
/opt/zimbra/jetty_base/webapps/
/tmp/

If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by August 24, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-72529 (CVSS score of 9.3) TrueConf Server Missing Authentication for Critical Function Vulnerability  
• CVE-2026-72530 (CVSS score of 9.5) TrueConf Server Code Injection Vulnerability

TrueConf Server is an on-premises video conferencing and unified communications platform developed by TrueConf. Organizations can deploy it on their own infrastructure to provide secure video meetings, voice calls, messaging and collaboration without relying entirely on a cloud service.

It is typically used by businesses, government organizations and other institutions that want to keep communications and related data under their own control.

CVE-2026-72529 is a remote code execution vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to execute arbitrary scripts by calling an undocumented function.

The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. An attacker who can reach the vulnerable service could potentially compromise the server and use it as an entry point into the affected network.

CVE-2026-72530 is a sandbox escape vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to break out of an isolated environment and execute arbitrary code on the underlying host.

The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. By sending a specially crafted script, an attacker could escape the restricted environment and gain code execution on the host system, potentially leading to a full server compromise.

In the context of CVE-2026-72529 and CVE-2026-72530, the concern is that vulnerable TrueConf Server installations exposed on TCP port 4307 could provide attackers with a path to execute code on the server.

Vyacheslav Kopeytsev from Kaspersky ICS CERT discovered both vulnerabilities.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2nd.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

CISA and the NSA warn of an active Siemens PLC cyber threat using AI-generated exploit scripts disguised as monitoring tools. Protect your OT now.

Related Posts:

• Jewelbug APT Group Operations Combine Espionage and Fraud
• Cisco Talos Discovers JWR Phishing Framework
• PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign

The post US Agencies Warn of AI-Generated Exploits Targeting Siemens S7 PLCs appeared first on Daily CyberSecurity.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an MLflow vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2026-64849 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-64849 is a critical server-side request forgery (SSRF) vulnerability in MLflow, a platform for managing machine-learning workflows. The issue affects MLflow versions before 3.15.0 and a remote attacker can exploit the issue without authentication. The vulnerability allows attackers to make requests from an exposed MLflow server to internal services, including cloud metadata endpoints, potentially exposing temporary cloud credentials.

Attackers are actively exploiting CVE-2026-64849 to access cloud metadata services and steal credentials and secrets. Cybersecurity firm watchTowr also observed widespread scanning for exposed MLflow instances just hours after the CVE was assigned on August 17, 2026.

“watchTowr Intel is observing in-the-wild exploitation of a critical unauthenticated Server-Side Request Forgery vulnerability in MLflow (CVE-2026-64849), the open-source platform for managing the machine learning and AI development lifecycle, with over 60 million monthly downloads.” watchTowr said in a post on LinkedIn. “Attackers are exploiting the vulnerability to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets. Within hours of the CVE being assigned, Attacker Eye, our global honeypot network, detected attackers indiscriminately scanning for exposed MLflow systems online, capturing attempts against cloud-hosted instances.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-33824 (CVSS score: 9.8) – Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
• CVE-2026-55040 (CVSS score: 9.1) Microsoft SharePoint Weak Authentication Vulnerability
• CVE-2026-59310 (CVSS score: 9.8)  Broadcom VMware vCenter Path Traversal Vulnerability  
• CVE-2026-65400 Apple macOS Improper Authentication Vulnerability

CVE-2026-33824 is a Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability. This critical flaw in Windows IKE service extensions could allow remote attackers to execute code on affected systems. Systems with IKE enabled are at risk, though blocking UDP ports 500 and 4500 can reduce exposure from external threats. However, internal attackers may still exploit it for lateral movement, so rapid patching is strongly recommended.

CVE-2026-55040 is a critical SharePoint authentication bypass. An unauthenticated attacker can exploit weaknesses in JWT validation to forge tokens and impersonate any SharePoint user, including administrators.

“A critical authentication bypass vulnerability exists in SharePoint Server Subscription Edition’s JWT token validation pipeline. The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user.” wrote Rapid7.

The exploit chain works by sending a JWT with “alg: none” in the outer header so no signature is required, using SharePoint’s own STS certificate thumbprint to resolve a signing key without verification, and then passing a non-empty but never-verified signature like “AAAA.” The result is a fully forged token that SharePoint accepts as legitimate.

Defused researchers observed attackers using the Rapid7 POC for CVE-2026-55040 against our SharePoint their honeypots.

CVE-2026-59310 flaw is a Path Traversal Vulnerability that allows an attacker with network access to execute arbitrary code. 

“VMware vCenter contains a directory traversal vulnerability in the Syslog server. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.”states the advisory.”A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.”

CVE-2026-65400 is an Improper Authentication Vulnerability that sits in macOS’s built-in Screen Sharing feature, the remote desktop tool baked into every Mac.On August 15, 2026, the Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, less than two weeks after Apple shipped the fix.

Apple’s fix improved how the system manages authentication state, closing a gap that let attackers on the network authenticate to Screen Sharing without valid credentials at all.

Apple patched this issue with the release of  macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, crediting researcher Alfredo Pesoli (@__rev) at Bynario Atlas (bynar.io) for the discovery.

“An attacker on the network may be able to authenticate to Screen Sharing without valid credentials” reads the advisory.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by August 21, 2026

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Ray-Project Ray vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2025-62593 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2025-62593 is a critical remote code execution (RCE) vulnerability in Ray, an AI compute engine. Versions before 2.52.0 insufficiently protected the Ray dashboard/API against browser-based attacks. Its defense relied on checking whether the HTTP User-Agent header started with “Mozilla”, but browsers can modify this header.

By combining this weakness with DNS rebinding, an attacker could potentially execute arbitrary code on a developer’s machine simply by getting them to visit a malicious website or view a malicious advertisement while running Ray. The vulnerability affects Firefox and Safari. Ray 2.52.0 fixes the issue.

“This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string “Mozilla” as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified.” reads the advisory. “Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising).”

“An attacker exploited a code injection vulnerability in Ray AI Compute Engine via a DNS rebinding attack, leading to remote code execution. This allowed the attacker to escalate privileges within the system, move laterally across the network, establish command and control channels, exfiltrate sensitive data, and ultimately disrupt operations.” reads the analysis published by Aviatrix.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on August 20, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

CISA and five agencies warn that Gunra ransomware is hitting critical infrastructure with double extortion. A Linux flaw may let victims recover free.

Related Posts:

• Apple Sends Mercenary Spyware Alerts to Users in 110+ Countries
• ChainDrop npm Worm Hits 400+ Packages via Blockchain C2
• Fake Zoom Installer Drops Overlord RAT on macOS

The post Gunra Ransomware Hits Critical Infrastructure, CISA Warns appeared first on Daily CyberSecurity.