Cisco warns of max severity ISE zero-day exploited in attacks

🕵️ RESEARCH & DEEP DIVES

• Flatpak-builder flaw lets malicious Git hooks execute code on host (CVE-2026-86320)
  Flatpak-builder fails to disable Git hooks when applying patch sources with use-git-am, enabling host code execution.

  • Affects flatpak-builder users building software from attacker-supplied sources.
  • Git hooks are not disabled when applying patch sources with use-git-am: true.
  • A malicious post-applypatch hook in the source executes on the host during the build with the privileges of the user running flatpak-builder.
  • Tracked as CVE-2026-86320, CVSS 7.8, reported to Red Hat on 2026-05-11 and made public 2026-08-13; credited to AISLE Research.
  Sources 📎 Coverage: github.com · 👁 via CVE ThreatInt

• RatHat Android malware steals banking credentials and reinstalls itself after deletion
  Zimperium's zLabs researchers identified a new Android banking malware called RatHat that steals credentials and survives uninstallation by reinstalling itself.

  • Targets Android banking, cryptocurrency and payment app users, with operators linked to actors apparently operating in China.
  • Steals PINs, passwords, unlock patterns, SMS one-time codes and installed-app data via fake overlay screens and on-screen monitoring.
  • Delivered through deceptive download pages promoted via SMS phishing, malicious ads and third-party forums, then tricking users into granting Accessibility permissions.
  • Uses automated taps to enable Developer Options and Wireless Debugging, pairs with the device's ADB service for shell-level access, and deploys disguised components liblocal-service.so and libmedia_codec.so.
  • Sends a live map of the phone interface to a generative AI assistant for adaptive automation, and can reinstall itself from /data/local/tmp/app.apk even after apparent removal.
  Sources 📄 Source: zimperium.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Chinese hackers use SparroWocky malware in govt espionage attacks — BleepingComputer

• Microsoft shares workaround for Windows domain login issues — BleepingComputer

• Cisco warns of max severity ISE zero-day exploited in attacks — BleepingComputer

• CISA Releases Guidance on Deploying Cyber Decoys — SecurityWeek

• AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals — SecurityWeek

• Improper Access control Vulnerability in NitroSense and PredatorSense Softwar... — CVE ThreatInt

• Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSe... — CVE ThreatInt

• Password Authentication Bypass Vulnerability in GX Works3 and Motion Control ... — CVE ThreatInt

• Authentication Vulnerability in NitroSense and PredatorSense SoftwareA vulner... — CVE ThreatInt

• WebSocket Exposure Vulnerability in NitroSense and PredatorSense SoftwareA vu... — CVE ThreatInt

• Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSe... — CVE ThreatInt

• Checkout Field Manager before 7.9.7 - Subscriber+ Arbitrary Attachment Deletion vi... — CVE ThreatInt

• Privilege Escalation Vulnerability in NitroSense and PredatorSense SoftwareA ... — CVE ThreatInt

• Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username ParameterThe Yo W... — CVE ThreatInt

• To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and De... — CVE ThreatInt

• @fastify/static vulnerable to route guard bypass via path case-folding@fastif... — CVE ThreatInt

• Service token exposure and potential privilege escalation in SUSE Observabili... — CVE ThreatInt

• NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies — Cyber Security News

• # ESETresearch discovered SparroWocky, a new backdoor of the # FamousSparrow APT group. — @ESETresearch@infosec.exchange

• I need Help!! — r/netsec