Threat Library

A high-severity denial-of-service vulnerability affects multiple Rockwell Automation Logix Platform controllers due to improper input length validation during CIP message processing. Successful exploitation causes a major nonrecoverable fault (MNRF), requiring a physical power cycle to restore operations. No public exploitation has been observed at this time.

CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog based on confirmed active exploitation, spanning products including Sangoma Switchvox, Starlette, Kestra, BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances. These flaws include SQL injection, OS command injection, SSRF, authentication bypass, and HTTP request smuggling, posing significant risk to organizations with these products exposed to the internet. Federal agencies must remediate per BOD 26-04, and CISA urges all organizations to prioritize patching.

A HTTP request/response smuggling flaw in the Starlette ASGI framework allows attackers to inject paths into the host portion of a request, causing URL reconstruction that can bypass authentication logic dependent on the reconstructed path. CISA has added this to the KEV catalog, and it may be chained with CVE-2026-42271 to escalate impact. Organizations running Starlette-based web services, including those exposing agent APIs, should prioritize patching before the September 16, 2026 due date.

A newly launched dark web identity theft service is selling digital scans of over 153 million U.S. and Canadian drivers licenses, apparently sourced from a breach or insider leak at a Louisiana-based identity verification company. The FBI's New Orleans field office has opened a formal inquiry into the origin of the leaked images. This represents a massive PII exposure event impacting identity verification supply chains widely used for KYC and onboarding processes.

Researchers discovered 13 malicious Composer theme packages on Packagist designed to inject JavaScript into Vietnamese movie and comic streaming sites. The injected code performs mobile ad-fraud and gambling-redirect operations and deploys spyware targeting unpatched iOS devices visiting the compromised sites.

Breeze Comet is a financially motivated threat actor targeting Brazilian financial services, retail, and e-commerce organizations since 2024, specializing in manipulating payment systems and banking software to execute fraudulent transfers. Google Threat Intelligence Group and Mandiant have tracked hundreds of fraudulent transactions attributed to this group, indicating a mature and persistent operation against Brazil's financial ecosystem.

Aesto LLC, operating as Aesto Health, disclosed a data breach impacting more than 9.5 million individuals. The specific attack vector, threat actor, and full scope of compromised data have not been detailed in the initial disclosure. This incident represents a significant healthcare data exposure event given the scale of affected patients.

Threat actors are abusing the legitimate Faronics Deploy endpoint-management platform, likely delivered via phishing, to gain remote administrative control over victim machines. Once access is obtained, attackers use the platform's legitimate deployment capabilities to install ScreenConnect, a remote support tool commonly repurposed by attackers for persistence and lateral movement.

A high-severity denial of service vulnerability affects multiple Rockwell Automation Logix controller families, including ControlLogix, CompactLogix, GuardLogix, and their variants. Exploitation via corrupt crafted data can trigger a major nonrecoverable fault (MNRF), requiring physical recovery actions such as program downloads or stage 2 resets. No public exploitation has been reported to date, and vendor firmware fixes are available.

CISA disclosed two vulnerabilities affecting Rockwell Automation Historian ME (FactoryTalk Historian Machine Edition) Series B 5.202 and Series C 7.101. The more severe flaw (CVE-2025-12768, CVSS 8.0) allows a low-privileged authenticated attacker to achieve remote code execution via an out-of-bounds write, while the second (CVE-2026-12661, CVSS 4.5) enables a network-adjacent authenticated attacker to crash the device through a stack-based buffer overflow. No public exploitation has been reported at this time.

Rockwell Automation RSLinx Classic versions up to 4.50 contain four vulnerabilities (integer overflow/underflow and buffer overflow conditions) exploitable via crafted CIP packets, allowing remote unauthenticated attackers to crash the RSLinx Classic service. Successful exploitation causes a denial-of-service condition requiring service restart, potentially disrupting industrial communications in critical manufacturing environments. No public exploitation has been reported at this time.

Researchers propose ECLIPSE, a framework that combines direct and indirect prompt injection to hijack long-horizon LLM agents (e.g., Codex, Claude Code) into executing multi-step malicious tool chains while evading detection. This is academic red-teaming research with a benchmark (LASE-Bench), not an observed in-the-wild exploit, but it demonstrates high attack success rates (up to 96.7%, 69.2% under defenses) against realistic multi-tool agent workflows.

The Silver Fox threat actor is distributing the ValleyRAT backdoor concealed within a digitally signed Chinese desktop-wallpaper application called QN Wallpaper. By running under a trusted, signed process that users commonly whitelist in antivirus exclusions, the malware evades detection and establishes persistent remote access on infected hosts.

Microsoft has identified a new ClickFix variant called TerminalFix that uses fake Cloudflare CAPTCHA verification prompts on compromised websites to trick users into copy-pasting and executing malicious PowerShell commands in Windows Terminal. The attack establishes reverse tunnels for persistent remote access, enabling attackers to bypass network perimeter defenses.

An attacker exploited a price-manipulation vulnerability in the Tectonic cryptocurrency lending platform on the Cronos blockchain, enabling fraudulent borrowing of approximately $74 million. The exploit forced validators to halt and restart the Cronos network to contain the incident, disrupting trading activity network-wide.

CISA has added two actively exploited PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities catalog, one involving missing authentication for a critical function and another involving unsafe reflection. These flaws pose significant risk to organizations running PaperCut print management software, with federal agencies required to remediate under BOD 26-04.

MCPHub, a multi-tenant hub for orchestrating MCP servers, failed to enforce ownership checks on its tool-execution API even though it correctly scoped list and config views. Any authenticated non-admin user could invoke tools on MCP servers owned by other tenants, leading to cross-tenant compromise including arbitrary host file reads and SSRF using another user's connected credentials. The issue is fixed in version 1.0.30.

MCPHub, a centralized management hub for MCP servers, has an incomplete SSRF guard that fails to block IPv6 transition addresses like NAT64, 6to4, and Teredo. An attacker who can supply a URL for an MCP server connection can embed a private IPv4 address inside one of these IPv6 formats to bypass the filter and reach internal infrastructure. This is a classic SSRF filter evasion issue, patched in version 1.0.32.

MCPHub, a management hub for MCP servers, allows any authenticated non-admin user to register a malicious MCP server pointing at arbitrary internal or external URLs, causing the hub to make server-side requests without egress filtering. This enables both reflected SSRF (attacker sees response data via the OpenAPI proxy) and blind SSRF (via SSE/streamable-http transport), potentially exposing internal services, cloud metadata endpoints, and loopback/RFC1918 resources.

MCPHub, a management hub for multiple MCP servers, contains a flawed authorization check that lets a bearer key scoped to one specific MCP server gain access to every other server in the same group. Any credential holder with narrow, single-server authorization can silently pivot to unauthorized MCP servers, effectively breaking the tool/server isolation model the hub is meant to enforce. This was fixed in version 1.0.31.