🕵️ RESEARCH & DEEP DIVES
SSRF in Eclipse Che dashboard resolver endpoint (CVE-2026-86590) fixed in 7.122.0
Eclipse Che 7.79.0 through 7.121.0 contains a server-side request forgery vulnerability in the dashboard backend's resolver endpoint.- Affects Eclipse Che (eclipse-che/che-dashboard) versions 7.79.0 through 7.121.0; fixed in 7.122.0
- POST /dashboard/api/data/resolver passes a caller-supplied URL directly to an outbound HTTP GET with no host filtering (CWE-918, CVSS 6.3 medium)
- An authenticated user can read responses from internal addresses including cloud metadata service 169.254.169.254, loopback, RFC-1918 ranges, and in-cluster Kubernetes services
- The operator-configured allowlist (operator.devEnvironments.allowedSources.urls) is not consulted
- Version 7.122.0 adds private-address blocking, IPv4-mapped IPv6 bypass prevention, allowlist enforcement, and disables HTTP redirects; no known exploits in the wild
Siemens Reyrolle 7SR5 relay: nine vulnerabilities affect all versions below V2.70
Multiple vulnerabilities affecting all versions of the Reyrolle 7SR5 protection relay below V2.70 have been disclosed.- Applies to Siemens Reyrolle 7SR5 protection relays, all versions below firmware V2.70.
- Nine separate issues are affected, including weak session ID generation with insufficient randomness and web interface information exposure that allows calculating current and past session IDs.
- The web-based management interface fails to properly enforce server-side authorization checks, enabling role-based access control bypass.
- A special maintenance mode can be activated via a physical key sequence during device boot, exposing a proprietary protocol with insufficient input validation; firmware also retains debugging symbols.
- The web server additionally suffers from improper resource handling under high volumes of concurrent HTTP requests and unvalidated URL component length in pre-authenticated messages.
- No CVE identifiers have been assigned to the vulnerabilities.
- No exploitation activity is mentioned in the disclosed material.
Vulnerability identified in Siemens Teamcenter affecting multiple versions
A vulnerability has been identified in Siemens Teamcenter across several product versions.- Affects Siemens Teamcenter users on V2412, V2506, V2512, and V2606 releases.
- Vulnerable versions include V2412 before V2412.0013, V2506 before V2506.0010, V2512 before V2512.2607, and V2606 (affected threshold truncated in source).
ClearFake WebDAV infection chain delivers Amatera, ZigCryptoStealer, NetSupport Manager
Cisco Talos is tracking a ClearFake infection chain via WebDAV that delivers the Amatera stealer, ZigCryptoStealer, and NetSupport Manager in a broad credential- and cryptocurrency-stealing campaign.- Applies broadly to internet users; Talos assesses with moderate confidence the attacks are opportunistic, not targeted at any particular organization.
- Infection chain uses ClearFake fake browser-update pages and WebDAV to deliver malware.
- Primary payload is the Amatera stealer, alongside ZigCryptoStealer and NetSupport Manager remote access.
- Campaign goal is theft of credentials and cryptocurrency.
ClickFix campaign uses Google Visualization API-hosted C2 to steal cryptocurrency via browser injection
Cisco Talos is tracking a cryptocurrency-stealing ClickFix campaign that uses Google Sheets via the Google Visualization API as command and control.- Affects users targeted by ClickFix-style social engineering attacks, with cryptocurrency theft as the goal
- C2 is hosted on Google infrastructure: obfuscated JavaScript is fetched from a publicly published Google Sheets document via the Google Visualization API
- The retrieved JavaScript is injected into the victim's browser session to carry out the theft
Panzer Ransomware Hits Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS
The Panzer ransomware-as-a-service operation has expanded into Italy, targeting manufacturers and telecom firms.- Panzer ransomware surfaced on August 5 and listed a kitchen manufacturer in Treviso and a telecommunications engineering firm in Catanzaro among its alleged victims.
- The RaaS operation targets Italian manufacturers and telecommunications firms.
- Panzer advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi systems, enabling attacks on virtualization infrastructure.
🕵️ RESEARCH & DEEP DIVES (one-liners)
Essential AI agent security questions — Cybersecurity Dive
Stealing AI Reasoning Traces — Schneier on Security
MikroTik Patches Critical Flaws Chained to Hack Routers — SecurityWeek
N-able Patches Critical Zero-Day in N-central — SecurityWeek
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell — The Hacker News
BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams — The Hacker News
In most cities, nobody owns the whole network — CyberScoop
EDD Product Catalog Feed by PixelYourSite through 1.0.2 - Authenticated (Subscribe... — CVE ThreatInt
TYPO3 CMS - Information Disclosure via Backend Localization WizardIt has been... — CVE ThreatInt
TYPO3 CMS - Missing Authorization in lowlevel commandsBackend administrators ... — CVE ThreatInt
Gnome-tweaks: path traversal in theme installerThe shell theme installer in g... — CVE ThreatInt
Sensitive information written to logs by Snowflake driversInsertion of sensit... — CVE ThreatInt
Command Argument Injection Vulnerability in Cosminexus Component ContainerCom... — CVE ThreatInt
UXSS vulnerability in ZTE browser productsNuBrowser lacks protocol whitelist ... — CVE ThreatInt
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions... — CVE ThreatInt
A vulnerability has been identified in Siveillance Control Pro V3.0 (All vers... — CVE ThreatInt
Calif developed a zero-click worm that spread through WeChat calls across iOS and Android https://... — @campuscodi@mastodon.social
RE: https:// mastodon.social/@campuscodi/11 7226649141457962 This has now been patched in an out-of-band update on... — @campuscodi@mastodon.social
Adform quietly put out an updated statement and regulatory filing saying the attack only worked over sites served with... — @GossiTheDog@cyberplace.social
Boston Scientific has filed an updated 8-K with the SEC saying their ransomware incident is likely to have a material... — @GossiTheDog@cyberplace.social
SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport — Cyber Security News
U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks — Cyber Security News
Cosminexus Component Container Critical Deserialization (CVE-2026-71374) — thehackerwire.com (discovered)
Reducing PCI DSS scope effectively: practical steps for UK SMEs — securityboulevard.com (discovered)
Don't miss today's Metacurity for the most important infosec developments you might have missed over the weekend... — @metacurity@infosec.exchange
• 2 weeks into my first security role at an MSP and feeling pretty overwhelmed, is this normal? (5