Pixel Modem Zero-Day Exploited in Targeted Attacks

🕵️ RESEARCH & DEEP DIVES

• AIUC Raises $40 Million Series A to Certify Enterprise AI Agents Against Security Risks
  AIUC has raised $40 million in Series A funding to expand its AIUC-1 certification standard for enterprise AI agents.

  • Applies to enterprises deploying AI agents: the AIUC-1 standard already certifies Cursor, ElevenLabs, Fin, Harvey, KPMG, Lovable, and UiPath.
  • AIUC-1 is an evaluation and risk standard that tests AI agents against jailbreaks, prompt injections, hallucinations, anomalous behavior, and data leaks.
  • The framework subjects AI models to roughly 5,000 adversarial risk scenarios, backed by quarterly audits to address emerging threat vectors.
  • The round was led by Ribbit Capital with support from First Harmonic, bringing total funding to $55 million for the San Francisco startup founded in 2024.
  • The new capital will expand AIUC's audits, standards, and insurance to frontier models, addressing security reviews that stall enterprise AI agent rollouts.
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• Nozomi Labs finds OS command injection flaws in Advantech EKI-1242 series firmware V1.06.01
  Nozomi Networks Labs disclosed multiple OS command injection vulnerabilities in Advantech EKI-1242 series devices running firmware V1.06.01.

  • Affects Advantech EKI-1242IEIMS and EKI-1242EIMS devices running firmware V1.06.01
  • CVE-2026-73164/73165/73167/73176 (CVSS 8.6): command injection in the EKI-1242IEIMS web management interface, exploitable by remote authenticated attackers to run arbitrary commands as root via crafted request parameters
  • CVE-2026-73172 (CVSS 9.3): command injection in the EKI-1242EIMS edgserver management service, exploitable by remote unauthenticated attackers via crafted requests to TCP port 5058 for root command execution
  • All vulnerabilities were discovered by Simone Bossi at Nozomi Networks Labs; advisories published 2026-09-16
  Sources 📄 Source: nozominetworks.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt (+5)

• CVE-2026-73171: Arbitrary file overwrite flaw in Advantech EKI-1242EIMS firmware V1.06.01
  Nozomi Networks Labs identified a vulnerability in Advantech EKI-1242EIMS that lets authenticated attackers overwrite arbitrary files on the device.

  • Affects Advantech EKI-1242EIMS devices running firmware version V1.06.01.
  • Tracked as CVE-2026-73171, a CWE-73 External Control of File Name or Path flaw, rated HIGH with a CVSS 4.0 score of 8.6.
  • The flaw resides in the backup-restore workflow and allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem.
  • The attack works by uploading a crafted backup archive through the web management interface.
  • The vulnerability was found by Simone Bossi at Nozomi Networks and disclosed with a vendor advisory from Advantech.
  Sources 📄 Source: advcloudfiles.advantech.com · 📎 Coverage: nozominetworks.com · 👁 via CVE ThreatInt

• Microsoft says Copilot buttons still missing in classic Outlook (5) — <https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-workaround-for-missing-outlook-copilot-buttons/|BleepingComputer>

• Pixel Modem Zero-Day Exploited in Targeted Attacks (5) — <https://www.securityweek.com/pixel-modem-zero-day-exploited-in-targeted-attacks/|SecurityWeek>

• US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware (5) — <https://www.securityweek.com/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/|SecurityWeek>

• Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption ... (5) — <https://cve.threatint.com/CVE/CVE-2026-73175?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• ag-ui-protocol ag-ui SSE Client client.go resource consumptionA security vuln... (5) — <https://cve.threatint.com/CVE/CVE-2026-92361?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitiv... (5) — <https://cve.threatint.com/CVE/CVE-2026-73174?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critica... (5) — <https://cve.threatint.com/CVE/CVE-2026-73173?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of C... (5) — <https://cve.threatint.com/CVE/CVE-2026-73170?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input Du... (5) — <https://cve.threatint.com/CVE/CVE-2026-73169?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) ... (5) — <https://cve.threatint.com/CVE/CVE-2026-19535?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput or... (5) — <https://cve.threatint.com/CVE/CVE-2026-92360?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Privilege escalation via legacy access group creation endpointAn authenticate... (5) — <https://cve.threatint.com/CVE/CVE-2026-88817?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain ... (5) — <https://cve.threatint.com/CVE/CVE-2026-92359?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• WordPress WP Mega Menu plugin through 1.4.2 - SQL Injection vulnerabilityImproper ... (5) — <https://cve.threatint.com/CVE/CVE-2026-92465?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Authorized remote code execution via password change functionality in T-Mobil... (5) — <https://cve.threatint.com/CVE/CVE-2026-58147?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs (5) — <https://cybersecuritynews.com/smishing-hackers/|Cyber Security News>

• TP-Link Cameras 0-Day Vulnerabilities Allow Attackers to Spy on Users (5) — <https://cybersecuritynews.com/tp-link-cameras-0-day-vulnerabilities/|Cyber Security News>

• Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls (5) — <https://cybersecuritynews.com/apache-syncope-vulnerabilities/|Cyber Security News>

• Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise (5) — <https://cybersecuritynews.com/critical-hpe-vulnerabilities/|Cyber Security News>

• Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild (5) — <https://cybersecuritynews.com/issabel-pbx-command-execution-vulnerability/|Cyber Security News>

• Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families (5) — <https://cybersecuritynews.com/oracle-security-update-673-vulnerabilities/|Cyber Security News>

• PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks (5) — <https://cybersecuritynews.com/papermill-hackers/|Cyber Security News>

• KEV: CVE-2026-58704 — Google Pixel — Google Pixel Improper Authorization Vulnerability (5) — <https://nvd.nist.gov/vuln/detail/CVE-2026-58704|CISA KEV>

• Heading to # LABScon2026 ? Join # ESETresearch ’s Anton Cherepanov and Peter Strýček on Sept. (5) — <https://infosec.exchange/@ESETresearch/117280601794826360|@ESETresearch@infosec.exchange>

• Bypassing Referer-Based CSRF with strict-origin-when-cross-origin (5) — <https://www.reddit.com/r/netsec/comments/1whxuyv/bypassing_refererbased_csrf_with/|r/netsec>

• CISOs to Watch in Austin: From the County Courthouse to the Cloud (5) — <https://securityboulevard.com/2026/09/cisos-to-watch-in-austin-from-the-county-courthouse-to-the-cloud/|securityboulevard.com (discovered)>

• FBI Warns About OAuth Consent Phishing Risks for K12 Schools (5) — <https://securityboulevard.com/2026/09/fbi-warns-about-oauth-consent-phishing-risks-for-k12-schools/|securityboulevard.com (discovered)>

• CVE-2026-20349: Analysis and WAAP Implications (5) — <https://securityboulevard.com/2026/09/cve-2026-20349-analysis-and-waap-implications/|securityboulevard.com (discovered)>

• Houston’s Security Leaders to Watch: From the Refinery Floor to the Boardroom (5) — <https://securityboulevard.com/2026/09/houstons-security-leaders-to-watch-from-the-refinery-floor-to-the-boardroom/|securityboulevard.com (discovered)>

• Boston’s CISOs to Watch: Securing Hospitals, Campuses, and Code (5) — <https://securityboulevard.com/2026/09/bostons-cisos-to-watch-securing-hospitals-campuses-and-code/|securityboulevard.com (discovered)>