View Ridge Security
Back to Cyber Hose

Mathspace data breach affects over 1 million users in Australia, NZ

A CVSS 10.0 Metabase flaw enabled a breach of over 1 million Mathspace users, plus a 389 Directory Server heap overflow and a ScreenConnect flaw.

🕵️ RESEARCH & DEEP DIVES

  • CVE-2026-18355: Heap overflow in 389 Directory Server SASL layer enables RCE risk
    A heap buffer overflow flaw in the SASL I/O layer of 389 Directory Server (CVE-2026-18355) can be exploited by authenticated attackers for denial of service or potentially remote code execution.

    • Affects 389-ds-base / Red Hat Directory Server 11 deployments that negotiate a SASL security layer (integrity protection, SSF > 0) after bind.
    • In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound; a length of 0, 1, or 2 causes an unsigned integer underflow in sasl_io_read_packet().
    • The underflow makes PR_Recv request approximately 4 GiB into a 1024-byte heap buffer, yielding a heap buffer overflow with attacker-controlled content.
    • Exploitation requires a remote authenticated attacker who has completed a SASL bind with integrity protection; impact includes denial of service and potentially remote code execution.
    • Distinct from CVE-2026-11774, whose fix only guarded upper-bound overflow; Red Hat rates the flaw Important (CVSS 7.5). Reported by Ada Logics and Anthropic; tracked as RHBZ#2509186.
    Sources 📄 Source: access.redhat.com · 📎 Coverage: radar.offseq.com · 👁 via CVE ThreatInt

  • Mathspace data breach hits 1,079,819 students, parents and staff in Australia and New Zealand
    Mathspace has confirmed a data breach affecting 1,079,819 students, parents, guardians, and school staff across Australia and New Zealand via an unpatched Metabase vulnerability.

    • Mathspace users in Australia and New Zealand only are affected: students, parents or guardians, teachers, and Mathspace staff — 1,079,819 people in total.
    • Exposed data includes user ID, username, names, email addresses, country, time zone, user type, email-verification status, last-active and last-login dates; passwords, SSO tokens, API credentials, and academic records were not taken.
    • Attackers exploited CVE-2026-72898, a CVSS 10.0 unauthenticated SQL injection in Metabase's password-reset API, to gain administrator access to the self-hosted reporting system without credentials.
    • Unauthorized access began 10 August 2026, data was exfiltrated 27 August, and Mathspace only patched on 29 August after missing Metabase's 6 August advisory; the breach was confirmed 3 September.
    • Mathspace says it has no evidence the data has been published or misused, and the attacker's identity remains unknown.
    Sources 📄 Source: blog.mathspace.co · 📎 Coverage: tech-insider.org · 👁 via Cyber Security News, cryptika.com (discovered)

  • ConnectWise Warns of New ScreenConnect File Transfer Flaw, Issues Mitigation Steps
    ConnectWise has warned customers of a newly identified security issue affecting file transfer behavior in ScreenConnect sessions.

    • Applies to ScreenConnect Remote Access Support and Access users, both cloud-hosted and on-premises deployments.
    • The flaw affects file transfer behavior in ScreenConnect sessions; no CVE assigned yet.
    • ConnectWise published interim mitigation guidance on September 3, 2026 while developing a permanent fix.
    Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • 7th September – Threat Intelligence Report (5) — <https://research.checkpoint.com/2026/7th-september-threat-intelligence-report/|Check Point Research>

  • java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fro... (5) — <https://cve.threatint.com/CVE/CVE-2026-86318?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Code Injection in Next4Biz's CSM (Customer Service Management)Deserialization... (5) — <https://cve.threatint.com/CVE/CVE-2026-7861?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Path Traversal in Next4Biz's CSM (Customer Service Management)Improper Limita... (5) — <https://cve.threatint.com/CVE/CVE-2026-6377?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertionA vuln... (5) — <https://cve.threatint.com/CVE/CVE-2026-86317?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit ... (5) — <https://cve.threatint.com/CVE/CVE-2026-19843?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalati... (5) — <https://cve.threatint.com/CVE/CVE-2026-18922?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via pag... (5) — <https://cve.threatint.com/CVE/CVE-2026-18453?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers (5) — <https://cybersecuritynews.com/linux-rootkit/|Cyber Security News>

  • Switzerland Moves Away From Microsoft 365 to Open-Source Alternatives (5) — <https://cybersecuritynews.com/switzerland-moves-away-from-microsoft-365/|Cyber Security News>

  • Hackers Abuse Trusted Google Services to Hide Credential-Stealing Phishing Attacks (5) — <https://cybersecuritynews.com/trusted-google-services/|Cyber Security News>

  • Natural Resources Wales Exposes Sensitive Employee Data in Spreadsheet Breach (5) — <https://cybersecuritynews.com/natural-resources-wales-expose/|Cyber Security News>

  • Microsoft to Retire Manifest V2 Extensions and Switch to V3 for Improved Security and Performance (5) — <https://cybersecuritynews.com/microsoft-to-retire-manifest-v2-extensions/|Cyber Security News>

  • New Linux Bot Hides as Kernel Process and Launches DDoS Attacks (5) — <https://cybersecuritynews.com/new-linux-bot/|Cyber Security News>

  • OpenAI Commits $1 Billion to Give Critical Infrastructure Defenders Frontier AI Cyber Tools (5) — <https://cybersecuritynews.com/openai-commits-1-billion/|Cyber Security News>

  • LG Smart TVs Caught Scanning Networks and Logging Audio in Standby (5) — <https://cybersecuritynews.com/lg-smart-tvs-caught-scanning-networks/|Cyber Security News>

  • New BYOTC Attack Hijacks Trusted Windows Apps to Abuse Privileged Kernel Drivers (5) — <https://cybersecuritynews.com/new-byotc-attack-hijacks/|Cyber Security News>

  • Linksys RE7000 Critical Command Injection (5) — <https://www.thehackerwire.com/linksys-re7000-critical-command-injection/|thehackerwire.com (discovered)>

  • How to Build a Shared AI Engineering Framework Without Killing Developer Autonomy (5) — <https://securityboulevard.com/2026/09/how-to-build-a-shared-ai-engineering-framework-without-killing-developer-autonomy/|securityboulevard.com (discovered)>

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check