A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. The flaw is in LMCache's multiprocess mode, where the cache runs as a standalone server that LLM workers reach over the ZeroMQ messaging library. A single network
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. The company's OSS VRP incentivizes security researchers to responsibly disclose security flaws across open-source projects maintained by Google, including Golang, Angular, Bazel, Protocol Buffers, Fuchsia, and critical third-party dependencies, as well as repository settings like GitHub actions, application configurations, and access control rules. Google launched the OSS VRP in August 2022 with rewards ranging from $100 to $31,337, and noted that the program would focus on security flaws with the most significant impact on the software supply chain. "We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports," the company said. "Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiMail flaw, tracked as CVE-2026-104286 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a path traversal vulnerability that can be triggered through specially crafted HTTP or HTTPS requests. An unauthenticated attacker can exploit the issue to bypass restrictions on file paths and write arbitrary files to the underlying system. The vulnerability also involves improper handling of NULL characters, which can help the attacker bypass security checks. The flaw is reportedly being exploited in the wild, so affected customers are urged to apply the recommended workaround. “An Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.” reads the advisory. “This has been reported to be exploited in the wild” The company did not disclose how many customers were affected, when the attacks started, who was behind them, or technical details of the attacks. Below are the affected versions and the released updates: VersionAffectedSolutionFortiMail 8.08.0.0 through 8.0.1Upgrade to upcoming 8.0.2 or aboveFortiMail 7.67.6.0 through 7.6.6Upgrade to upcoming 7.6.7 or aboveFortiMail 7.47.4.0 through 7.4.8Upgrade to upcoming 7.4.9 or aboveFortiMail 7.27.2.0 through 7.2.9Upgrade to branch 7.4 or above As a temporary workaround, customers should disable the IBE (Identity-Based Encryption) feature using the recommended CLI command. Alternatively, access to the FortiMail management interface should be blocked from the internet or limited to trusted private networks. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 3rd, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Catalyst SD-WAN Manager flaw, tracked as CVE-2026-76504 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability resides in Cisco Catalyst SD-WAN Manager’s session authentication and could allow a remote attacker with no credentials to access the system with administrator-level privileges. “This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system.” reads the advisory. “A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.” Cisco said its Product Security Incident Response Team learned that attackers were actively exploiting the flaw in September 2026. “In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” continues the advisory. Cisco’s Technical Assistance Center (TAC) discovered the issue while investigating a customer support case. The company did not disclose how many customers were affected, when the attacks started, who was behind them, or what attackers did after gaining access. Cisco says there is no workaround for the vulnerability. For on-premises deployments, customers should restrict internet access and place SD-WAN control components behind a firewall, allowing traffic only from trusted hosts. The mitigation is already in place for cloud-hosted environments, but customers should assess its impact before deploying it. Below are the impacted versions: Cisco Catalyst SD-WAN Software ReleaseFirst Fixed ReleaseEarlier than 20.9Migrate to a fixed release.20.920.9.10.120.1220.12.8.220.1520.15.6.120.1820.18.4.126.126.1.2.126.226.2.1 “Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” Internet-exposed Catalyst SD-WAN Manager systems should be checked for signs of compromise, while comparing any findings with normal network activity to avoid false positives. Customers should review the serviceproxy-access.log file at /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check requests coming from unknown or unauthorized IP addresses. They should also check /var/log/nms/vmanage-server.log for j_security_check requests involving usernames that start with viptela-reserved-. The networking giant notes that the %6a string shown in its example represents the letter j, but any single URL-encoded character could be used in an attack. If a compromise is suspected, customers can contact Cisco TAC by opening a Severity 3 case with CVE-2026-76504 in the title. Cisco also recommends running the request admin-tech command on the SD-WAN Manager (vManage) and providing the resulting admin-tech file to TAC for analysis. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 3rd, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
DIVD was breached through two Zammad zero-days that let an AI agent reach root in seconds, steal data and pivot to other services before being stopped. The Dutch Institute for Vulnerability Disclosure, a nonprofit organization of volunteer security researchers whose whole job is finding and responsibly disclosing vulnerabilities in other people’s software, just disclosed that it got breached through two zero-days in its own ticketing system. The attackers got in through Zammad, an open-source helpdesk platform that DIVD used internally. Working with Merlon Security, DIVD identified two previously unknown vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490. Each vulnerability was serious on its own, but chaining them made the attack much more dangerous. The attackers could hijack sessions, run code remotely and move from a regular Zammad account to root access within seconds. DIVD said the speed was linked to the use of an AI agent during the attack. “When hackers get hacked, we deal with it in hacker style. While trying to figure out how the attackers got into our own systems, 𝘄𝗲 𝗳𝗼𝘂𝗻𝗱 𝘁𝘄𝗼 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗭𝗮𝗺𝗺𝗮𝗱.” the organization wrote on LinkedIn. “Used together, they allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack. From there they were able to access other services and read and exfiltrate data. We urge everyone using any version of Zammad to update to version 7 or take it offline as soon as possible.” The attacker went from the initial access to root privileges in just seconds. The AI agent was able to make decisions and carry out the next steps without waiting for a human operator. After gaining root access through Zammad, the attacker reached other services, accessed data and stole some of it. Network segmentation and a quick response from DIVD’s IT and incident response teams prevented the attacker from moving further. However, DIVD said that some damage had already occurred before the attack was stopped. The investigation is still ongoing, with the next public update expected on October 1. Zammad has over 2,000 customers and 55,000 users. DIVD is actively notifying owners of vulnerable instances and has published a script to check logs for signs of abuse. The fix is version 7, which Zammad considers safe. If you can’t update immediately, the guidance is simple: “We’re still in full investigation mode, and our next public statement will be on October 1st. For more information about the CVEs and a script to check your logs for abuse, check our case file. Link in comments.” the organization states. “If you run any version of Zammad, update to version 7 or take it offline as soon as possible.” The advice from Zammad is clear: update to version 7 or take the system offline. The reason is simple: the attack can move from unauthenticated access to root privileges within seconds, with the AI agent automatically carrying out each step. The incident also shows that AI-driven attacks are no longer just a theoretical risk. In this case, the agent was able to analyze the environment, chain the two vulnerabilities, gain higher privileges and move to other services without a human directing every action. DIVD detected the attack partly because it was relatively noisy. The agent left visible traces of its activity, which helped investigators understand what happened. A more careful attacker using the same approach could be harder to detect. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Zammad)
On Thursday, cryptocurrency wallet provider MetaMask has disclosed an ongoing infrastructure security incident affecting some of its infrastructure. The company is working to address the issue internally, with help from external partners and security advisors, and says there is "no immediate threat to MetaMask wallets." "As a precautionary measure, we are proactively exiting affected validators within our non-custodial staking operations, in coordination with clients and partners," MetaMask noted. "As a reminder, our staking operations are non-custodial in nature and we do not manage withdrawal keys for stake on behalf of our clients." Validators are nodes on the Ethereum network that run software responsible for proposing blocks, verifying crypto transactions, and maintaining the security of the Ethereum blockchain.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with
WatchGuard fixes 15 Fireware OS flaws, including a critical RCE bug that could give attackers root access to vulnerable Firebox appliances. WatchGuard has released security updates for Fireware OS that address 15 vulnerabilities, including a critical code injection flaw, tracked as CVE-2026-86131 (CVSS score of 9.2), that could allow an attacker to execute commands with root privileges on a vulnerable Firebox. “A code injection vulnerability in WatchGuard Fireware OS’s BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.” reads the advisory. The flaw affects the way Fireware OS handles configurations for BOVPN over TLS clients, a feature used to create VPN tunnels between WatchGuard Firebox appliances. The attack requires the threat actor to control the remote VPN server to which the vulnerable Firebox connects. If successfully exploited, the attacker can execute arbitrary commands as root on the connecting appliance. The vulnerability does not require user interaction or prior privileges. BOVPN over TLS uses a client-server model and can send VPN traffic over TCP port 443, a port commonly allowed through network firewalls. This makes the feature useful in environments where traditional IPsec traffic cannot easily pass through the network. WatchGuard addressed CVE-2026-86131 in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21. The affected branches include Fireware versions below those releases, depending on the platform. The vendor also addresses 13 high-severity vulnerabilities affecting different Fireware OS components. The flaws include vulnerabilities that could lead to remote code execution, authorization bypass, denial-of-service conditions, unauthorized SSLVPN access and arbitrary file reads. One example is CVE-2026-86101 (CVSS score of 7.2), a high-severity authorization flaw in the SAML login process. A remote authenticated SAML user with access to the Access Portal could abuse a specially crafted request to obtain unauthorized Mobile VPN with SSL access. “An improper authorization vulnerability in WatchGuard Fireware OS’s SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.” states the advisory. WatchGuard fixed the issue in the same Fireware OS releases. Another patched issue allows an attacker with adjacent network access to send specially crafted DHCP traffic that can trigger a stack-based buffer overflow in the fingerd process. The flaw, tracked as CVE-2026-81433 (CVSS score of 8.7), can lead to arbitrary code execution or a crash. “A stack-based buffer overflow vulnerability in WatchGuard Fireware OS’s DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.” the company states. The update also includes a medium-severity authorization issue that could allow unauthorized access to web applications. The vendor pointed out it is not aware of exploitation of these Fireware OS vulnerabilities in the wild. The company has published the fixes and recommends customers update affected Firebox appliances to the appropriate patched release. Organizations using Firebox appliances should therefore review their Fireware OS versions and prioritize the September 29 security updates, particularly where BOVPN over TLS is enabled. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Fireware OS)
Confirm this action.
Leaving now will discard your changes.