Cisco warns customers of actively exploited zero-day in email gateways

🕵️ RESEARCH & DEEP DIVES

• AI emerges as the leading driver of new cybersecurity spending
  AI investment has become the leading driver of new cybersecurity spending.

  • AI is now the top factor driving new cybersecurity spending, ahead of other investment drivers.
  • Security teams are expected to use AI investments to automate security operations.
  • AI investments are also expected to enhance identity and access management.
  Sources 📎 Coverage: cybersecuritydive.com · 👁 via Cybersecurity Dive

• Signal K Server SSRF via remote connection endpoints fixed in 2.28.0 (CVE-2026-55591)
  Signal K Server versions prior to 2.28.0 contain an unauthenticated SSRF vulnerability in remote connection endpoints, fixed in 2.28.0.

  • Affects Signal K Server, a boat hub server application, all versions prior to 2.28.0 (CVE-2026-55591, CVSS 5.8, CWE-918).
  • makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination.
  • With no security configured, the testSignalKConnection, requestAccess, and checkAccessRequest endpoints were accessible without authentication.
  • The flaw allowed forced requests to loopback, private, cloud metadata, or external destinations, internal port scanning, data exfiltration via response bodies, and path traversal via requestId.
  • selfsignedcert could disable certificate verification for outbound HTTPS requests.
  • Fixed in Signal K Server version 2.28.0.
  Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Surfio IRAP parser flaw CVE-2026-55211 enables out-of-bounds reads, fixed in 0.0.19
  CVE-2026-55211, a critical out-of-bounds read in the Surfio library's IRAP file parsing, was fixed in version 0.0.19.

  • Applies to users of Surfio, the Equinor library for reading and writing surface files, in versions prior to 0.0.19.
  • The library fails to validate size fields in IRAP files, causing out-of-bounds reads (CWE-125) when untrusted files are parsed.
  • Severity assumes Surfio is used to parse untrusted files in a networking context such as a web service; CVSS 9.8 critical.
  • Fixes landed via GitHub pull request #86 and are available in the 0.0.19 release.
  Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws — SecurityWeek

• Exein Secures $270M at $1.7B Valuation for Physical AI Security — SecurityWeek

• Charges Against Man Who Destroyed 3D-Printed ‘Decoy’ Flock Camera Drastically Reduced After State Admits It Was Not Very Valuable — 404 Media

• Cisco warns customers of actively exploited zero-day in email gateways — CyberScoop

• CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse — CISA News

• ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48),... — CVE ThreatInt

• webhookd: Unrestricted HTTP Header to Shell Variable Injectionwebhookd is a m... — CVE ThreatInt

• MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gatewa... — CVE ThreatInt

• OpenBao: LDAPi ldaputil (wrong escape func)OpenBao is an open source identity... — CVE ThreatInt

• OpenBao: Transit secrets engine crashes on key creation with derived: true ... — CVE ThreatInt

• OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{r... — CVE ThreatInt

• OpenBao's System Backend allows Unauthorized Management of the containing Nam... — CVE ThreatInt

• fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and D... — CVE ThreatInt

• SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hostsSe... — CVE ThreatInt

• safeurl validated address is not bound to the request, allowing DNS rebinding... — CVE ThreatInt

• GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD ToolGeoNetwork... — CVE ThreatInt

• Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & Tes... — CVE ThreatInt

• Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmati... — CVE ThreatInt

• WuzhiCMS Avatar Upload index.php setAvatar unrestricted uploadA security flaw... — CVE ThreatInt

• Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namesp... — CVE ThreatInt

• Election question titles allow stored script executionDecidim is a participat... — CVE ThreatInt

• HTML injection allows open redirection in WordPress theme design-scuole-wordp... — CVE ThreatInt

• GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Pytho... — CVE ThreatInt

• Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline — AWS Security Blog

• CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory — Cyber Security News

• Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices — Cyber Security News

• Multiple Vulnerabilities in Frappe LMS Leading to Remote Code Execution — r/netsec

• How to Keep Malware’s Rotating Infrastructure From Becoming a Detection Gap — cryptika.com (discovered)

• Dell SmartFabric OS10 Session Fixation (CVE-2026-63695) — thehackerwire.com (discovered)