These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
CISA added Kestra OSS’s CVE-2026-49869 to its Known Exploited Vulnerabilities catalog on September 2, giving US federal agencies until September 5 to patch a CVSS 10.0 flaw that lets an unauthenticated attacker run arbitrary code as root inside the workflow engine. The bug is a one-line authentication mistake, and any organisation running Kestra to orchestrate CI/CD or data pipelines needs to treat the same deadline as urgent, regardless of who set it.
An unauthenticated SQL injection flaw in Sangoma Switchvox, CVE-2026-9586, is being actively exploited to deploy reverse shells and cryptomining malware on internet-exposed VoIP servers. CISA added it to the Known Exploited Vulnerabilities catalog on September 2, and a patch has existed since July 14, meaning every unpatched instance still online has had close to two months to be found.
Proxmox published advisory PSA-2026-00043-1 on September 1, warning that CVE-2023-54391, a critical authentication bypass in Proxmox VE 7.x, is being actively exploited with public proof-of-concept code. The catch: the fix only ever shipped in 8.0.4, and Proxmox VE 7.x has been end of life since July 2024, so any instance still on that branch has no patch to install, only an upgrade.
Elementor patched CVE-2026-32475 on August 19, a critical unauthenticated file upload flaw in Elementor Pro’s File Upload form field that lets an attacker plant and run PHP code on any of the roughly 6 million sites running the plugin. Wordfence has already blocked over 190,000 exploitation attempts, and any site still on 4.2.1 or earlier with a published form using that field is exposed.
VulnCheck watched attackers chain reconnaissance, credential probing and command-and-control setup against Langflow (CVE-2026-0768, root RCE) and Ruby on Rails (CVE-2026-66066, the KindaRails2Shell file-read-to-RCE flaw) over the same weekend, hitting UK honeypots dozens of times as they hunted for AWS keys, OpenAI keys and Rails secrets.
JFrog patched CVE-2026-82329, a 9.8-severity authentication bypass in default Artifactory configurations, on August 28. Days later watchTowr confirmed active exploitation: attackers minting themselves administrator tokens with no credentials at all, on self-hosted instances that sit at the centre of the software supply chain.
Manchester Airports Group confirmed on August 27 that extortion group FulcrumSec accessed customer data across Manchester, London Stansted and East Midlands airports by lifting Iterable API credentials that were sitting in plain sight inside client-side JavaScript. FulcrumSec claims 86GB of exfiltrated data covering roughly 8.7 million customers, making it the largest known breach of a British airport operator, and the entry point required no exploit at all, just a browser’s developer tools.
PaperCut shipped a second emergency patch on August 28, one day after its first fix, when watchTowr researchers found multiple ways to bypass it. The underlying chain, CVE-2026-81578 (8.8) and CVE-2026-82078 (9.4), lets an unauthenticated attacker reach PaperCut NG/MF’s web management interface and achieve remote code execution, and Huntress had already spotted active exploitation starting August 26, before any patch existed.
CISA’s August 26 batch of six additions to its Known Exploited Vulnerabilities catalogue includes two Red Hat flaws from 2015, a SQL Server bug from 2019, and an Ajax.NET Professional deserialization issue from 2021, alongside the freshly disclosed Citrix NetScaler CVE-2026-8452. Federal agencies had until August 29 to patch the SQL Server and NetScaler bugs, and until September 9 for the rest. The batch is a reminder that attackers don’t need a zero-day when a decade-old unpatched system is still sitting on the network.
Questel SAS, a French intellectual property management firm that handles patent and trademark portfolios for corporations and law firms, confirmed on August 13 that ShinyHunters accessed part of its Microsoft 365 environment through a single voice phishing call. The attacker talked their way into a Sales SharePoint site, not a technical exploit, and the extortion group has since added two more companies, Alcon and Lumenis, to the same leak site with the same tactic.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
