Threat Library

Surfshark disclosed that attackers accessed one of its internal testing/proxy servers after a configuration error left it exposed to the public internet. The incident highlights ongoing risks from misconfigured internal infrastructure at network service providers, though the scope of user data exposure has not been fully detailed.

Microsoft's September 2026 security updates for Windows Server 2019, 2022, and 2025 are causing Remote Desktop Services (RDS) failures, blocking user connections and in some cases requiring a hard reset to restore service. This is a patch quality/regression issue rather than an exploited vulnerability, but it poses an operational availability risk for organizations relying on RDS for remote access.

Mantax Otax is a newly identified Android malware strain that blends ransomware and spyware functionality, encrypting victim files while simultaneously exfiltrating sensitive personal data. The malware also spams and harasses victims, likely leveraging stolen contact lists or device permissions, indicating a hybrid extortion and intimidation model beyond typical file-encryption ransomware.

AVEVA Pipeline Integrity Monitor (PIMBoards) versions up to 2025_SP1_P1_build_7.1.9580.8513 contain four vulnerabilities including a hard-coded cryptographic key, weak password hashing, missing authorization, and a stored/reflected XSS flaw. Exploitation could allow attackers with file access to decrypt sensitive project data, brute-force user credentials to gain administrative access, perform unauthenticated information disclosure, or execute arbitrary JavaScript in a victim's browser session via social engineering. No public exploitation has been reported, but the highest-severity issue (CVE-2026-81821/81822) rates CVSS 8.4.

Orthanc DICOM Server versions prior to 1.13.0 contain an integer overflow vulnerability in pitch/buffer-size computation that leads to a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can exploit this to crash the Orthanc process, causing a denial-of-service condition affecting medical imaging availability.

CISA has added two actively exploited MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities Catalog: a missing authentication flaw for a critical function and a command argument injection issue. Federal agencies must remediate under BOD 26-04, and CISA urges all organizations to prioritize patching given confirmed in-the-wild exploitation.

A missing authorization vulnerability in WebView on Google Chrome for Android prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via crafted network traffic combined with social engineering. Google/Chromium rates this as Medium severity, indicating exploitation requires user interaction and does not grant full system compromise on its own.

A critical OS Command Injection vulnerability in Adobe Campaign Classic (ACC) allows arbitrary code execution in the context of the current user without any user interaction, and has a maximum CVSS score of 10.0 with a changed scope. This flaw poses severe risk to organizations running ACC for marketing automation, as unauthenticated or minimally-privileged attackers could gain full control of affected servers.

CVE-2026-69854 is a critical improper authentication vulnerability in Spring Cloud Azure that allows an unauthorized network attacker to escalate privileges without valid credentials. Given a CVSS score of 9.0, successful exploitation could grant attackers elevated access to Azure-integrated services and downstream resources managed by affected applications.

CVE-2026-69431 is a critical heap-based buffer overflow vulnerability in the Telnet Client that allows an unauthorized remote attacker to execute arbitrary code over the network without authentication. With a CVSS score of 9.8, this vulnerability poses severe risk to any system with the vulnerable Telnet client installed or enabled. Organizations should treat this as a high-priority patching target given the low complexity of exploitation and lack of required privileges.

Netis NX10 routers running firmware V4.0.1.5808 or V3.0.0.4142 expose the administrator password to unauthenticated attackers via the sysinfo action in the web management interface. Attackers can retrieve this credential without a valid session and replay it against the login handler to gain full administrative control of the device, effectively enabling complete device takeover with a CVSS score of 9.8.

CVE-2026-67277 is a missing authentication vulnerability in MikroTik RouterOS's btest (bandwidth test) service, allowing unauthenticated attackers to trigger kernel memory disclosure and denial of service. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a short remediation window (added 2026-09-10, due 2026-09-13).

CVE-2026-86060 is an actively exploited vulnerability in MikroTik RouterOS involving improper neutralization of argument delimiters in command processing, allowing attackers to manipulate the trusted RouterOS policy mask and escalate privileges. CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog with a short remediation window, indicating confirmed in-the-wild exploitation.

Threat actors are using commodity infostealer malware (Lumma Stealer, Vidar, and similar families) to harvest session tokens, credentials, and API keys from systems accessing AI platforms like Google and Anthropic. These stolen, replayable tokens allow attackers to bypass MFA entirely and gain persistent illicit access to AI accounts and their connected tooling without needing to re-authenticate.

A previously undocumented exploit kit dubbed BlueMoon, which chains multiple Windows and Chrome vulnerabilities, has been observed in use by at least four distinct espionage-motivated threat clusters within a single week, including China-aligned APT31. The rapid, near-simultaneous deployment across separate groups suggests shared tooling infrastructure, a leaked/sold exploit chain, or a common third-party broker supplying nation-state actors.

The U.S. Department of Justice disrupted Xinbi Guarantee, an online marketplace facilitating scam services for Chinese organized crime groups, seizing associated Telegram channels and freezing $52.8 million in cryptocurrency. The action also included physical disruption of 13 scam compounds in Madagascar linked to romance and investment scam operations (commonly known as 'pig butchering' schemes).

CERT/CC has disclosed that Skullcandy Dime 3 wireless earbuds will accept Bluetooth pairing requests from any nearby device without requiring user confirmation. This flaw could allow an attacker within Bluetooth range to eavesdrop on audio or hijack the connection without the victim's knowledge or consent.

Healthcare company AdaptHealth confirmed that a July cyberattack attributed to the ShinyHunters threat group exposed personal data of 4.1 million individuals. The incident highlights ongoing targeting of healthcare organizations for large-scale data theft and extortion rather than encryption-based ransomware.

Cisco has confirmed active exploitation of CVE-2026-20079, a maximum-severity authentication bypass vulnerability in Secure Firewall Management Center (FMC) software. Attackers exploiting this flaw could gain unauthorized administrative access to centralized firewall management infrastructure, potentially compromising network-wide security controls. Organizations running affected FMC versions should treat this as an urgent patching priority.

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting Fortinet products, Citrix NetScaler, Google Chromium V8, and Cisco Firewall Management Center. These vulnerabilities include authentication bypass and memory corruption flaws that grant attackers significant post-exploitation control, and federal agencies are required under BOD 26-04 to remediate them on an accelerated timeline.