Threat Library

A critical authentication bypass exists in Omnivore's API where the Apple sign-in JWT verification logic trusts the attacker-controlled 'alg' header field, enabling a classic RS256-to-HS256 algorithm confusion attack. An attacker can forge valid authentication tokens for any Apple-linked account by signing them with Apple's public RSA key treated as an HMAC secret, resulting in full account takeover without valid credentials.

rust-iot-platform contains a critical authentication bypass vulnerability in which most REST API endpoints lack authentication checks in their handler code. Unauthenticated attackers can fully manage user accounts—creating, listing, retrieving, updating, and deleting them—leading to complete account and access control compromise.

Shinobi, an open-source video surveillance/NVR platform, ships with a hardcoded connection key in its child node service that allows unauthenticated attackers to authenticate via WebSocket handshake and execute arbitrary SQL queries. This grants full read/write access to user records and camera configuration, enabling account takeover and surveillance system compromise.

The Sigma Forms Pro WordPress plugin (versions up to 1.4.5) contains a critical vulnerability that allows unauthenticated attackers to achieve remote code execution by exploiting improper capability handling and MIME type validation during form submissions. Several default plugin templates ship with unrestricted file upload fields, making exploitation immediately feasible on default installs without any attacker reconnaissance or configuration changes.

IBM Concert versions 1.0.0 through 2.3.1 contain a critical SQL injection vulnerability that allows a remote, unauthenticated attacker to manipulate backend database queries. Exploitation could result in unauthorized viewing, modification, or deletion of sensitive application data. With a CVSS score of 9.1, this vulnerability poses significant risk to organizations running unpatched instances.

Attackers are actively chaining two vulnerabilities in PaperCut NG and MF print management software to achieve unauthenticated remote code execution. PaperCut has released an emergency patch with additional hardening after confirming exploitation in the wild. Organizations running unpatched PaperCut servers face full server compromise with no authentication required.

A critical, unpatched balance-handling flaw in the shared Cosmos EVM module was actively exploited between August 20-25, 2026, to drain funds from at least six blockchains built on the Cosmos ecosystem. Cosmos Labs was reportedly aware that all chains running the vulnerable module were exposed prior to exploitation, raising concerns about disclosure timing and coordinated patching failures.

Berlin's state administrative network was compromised in August 2026, with attackers exfiltrating data and subsequently demanding an extortion payment. The Berlin government has publicly refused to pay, and forensic investigation has revealed additional data outflows from the Senate Department for Mobility, Transport, Climate Protection and Environment, suggesting a broader compromise than initially disclosed.

A maximum-severity vulnerability in the GiveWP WordPress donation plugin allows unauthenticated attackers to execute arbitrary commands on the hosting server. Given GiveWP's widespread use on nonprofit and fundraising websites, this flaw exposes a large number of internet-facing servers to full compromise without requiring any credentials.

PaperCut has issued a second emergency patch after security researchers found multiple ways to bypass the initial fixes for two actively exploited vulnerabilities in PaperCut NG and MF print management software. Attackers exploiting these flaws can potentially achieve unauthorized access or remote code execution, prompting urgent re-patching for organizations still running vulnerable versions.

McKesson, a major healthcare and pharmaceutical distribution company, disclosed a breach involving unauthorized access to third-party applications, with the ShinyHunters extortion group claiming theft of 284 million patient records. The incident highlights ongoing risks from third-party application compromise and large-scale extortion campaigns targeting healthcare data supply chains.

All-Line Equipment Company's Fuel-Boss fuel management systems (Standard, Portal, Master/Slave, and Backflush variants) running PHP 7.1.5 or earlier are vulnerable to two high-severity flaws: an argument injection vulnerability in the PHP imap_open() function and a buffer overflow in PHP-FPM's FastCGI handling. Successful exploitation could allow remote attackers to execute arbitrary OS commands or code on affected systems, posing risk to critical manufacturing, defense, emergency services, and transportation sector operators using this equipment.

The Ebyte NA111-M cellular/MQTT gateway (firmware 9013-2-17) contains 13 vulnerabilities, several rated critical (CVSS 9.8), including missing authentication, client-side authentication bypass, weak cryptographic hashing, and cleartext transmission/storage of credentials including MQTT traffic. Combined, these flaws allow unauthenticated remote attackers to fully compromise the device, gaining administrative control, intercepting or replaying credentials, and disrupting availability. Ebyte has not delivered a patch despite CISA coordination attempts, leaving deployed units permanently exposed absent compensating network controls.

Multiple Mitsubishi Electric FA products, including CC-Link IE TSN modules and MELSEC iQ-R/iQ-F series Ethernet and CPU modules, contain a denial-of-service vulnerability (CVE-2025-3511) in their Ethernet function. A remote attacker can send a specially crafted UDP packet to cause a DoS condition, communication delay, or timeout error, requiring a system reset for recovery in most cases.

A critical unauthenticated privilege escalation vulnerability exists in IBM Administration Runtime Expert (ARE) for i, allowing remote attackers to execute actions under another authenticated user's session. This flaw, rated 9.9 CVSS, poses severe risk to IBM i systems used for enterprise administration and automation, potentially enabling full system compromise without prior credentials.

Argo Rollouts dashboard versions through 1.10.0 bind to all network interfaces and expose privileged, mutating rollout operations without any authentication, authorization, or CSRF protection. An attacker with network access to the dashboard port can hijack deployment lifecycle controls across all namespaces the operator's kubeconfig can reach, enabling denial of service, unauthorized rollbacks, or malicious image promotion.

Redpanda versions through 26.2.2 bind the Admin API to all network interfaces (0.0.0.0:9644) with authentication disabled by default, allowing any network-reachable attacker to be treated as a superuser. This enables unauthenticated creation and deletion of broker accounts, cluster configuration tampering, and disruption of partition replication, posing a critical risk to any exposed deployment.

The mcp-http-server package used by UI-TARS-desktop's MCP servers defaulted to binding on all network interfaces ('::') with no mandatory authentication middleware, exposing the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem tools to unauthenticated network access. Any remote client able to reach the exposed port could invoke the run_command tool to execute arbitrary OS commands, or read/write arbitrary files, as the user running the MCP server. The flaw was fixed by changing the default bind address to 127.0.0.1, but the package version number was not incremented, making patch detection reliant on commit history rather than semantic versioning.

Australian Federal Police arrested two suspects believed to be members of TeamPCP, a cybercrime group linked to what is described as the longest-running spree of software supply chain attacks via malicious open-source packages. The group allegedly compromised thousands of global businesses by distributing trojanized open-source software components. While this report covers the law enforcement action, the underlying threat—malicious open-source packages—remains a systemic risk to any organization consuming public package repositories.

This is a weekly digest from The Hacker News summarizing over 30 distinct security stories, including a 296,000-device IoT botnet, targeting of 100+ water utility systems, and a SharePoint remote code execution exploit chain. The roundup lacks technical depth on any single incident but signals a broad wave of activity spanning critical infrastructure targeting, malicious tooling with delayed payload activation, and abuse of public infrastructure for command-and-control traffic.