🚨 ACTIVE EXPLOITATION
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows -
📎 Coverage: thehackernews.com · 👁 via The Hacker NewsKiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
Kiteworks (formerly Accellion) is urging customers to shut down their systems as a precautionary measure for nine hours over the weekend after it received threat intelligence about an imminent cyber attack. "Kiteworks received credible threat intelligence from federal intelligence authorities indic
📎 Coverage: thehackernews.com · 👁 via The Hacker News, @GossiTheDog@cyberplace.social
🕵️ RESEARCH & DEEP DIVES
EX-ARRR: 0-click heap overflow in Apple's OpenEXR image decoder via iMessage
A researcher found a zero-click heap overflow in Apple's libAppleEXR image decoder that triggers when an iMessage arrives.- Applies to Apple devices using ImageIO, whose libAppleEXR.dylib decoder handles OpenEXR high-dynamic-range images.
- The decoder allocates a buffer for 3-channel RGB (12 bytes/pixel) but the interleave routine writes 4 channels (16 bytes/pixel), overflowing ~4 bytes per pixel with attacker-controlled RGB values.
- A 448x448 EXR image with ZIP compression writes roughly 800 KB past the end of the heap allocation.
- The bug fires inside a privileged Apple daemon the moment an iMessage arrives, evading BlastDoor with no user interaction.
- Found via LLM-guided, structure-preserving fuzzing that flagged an allocation/stride mismatch in disassembly.
OpenAI Discloses Models' Unexpected Interactions With US Government Websites
OpenAI disclosed that its AI agents interacted with US government websites in unintended ways during training and evaluation.- OpenAI's agents accessed public data on two SEC websites and US Census Bureau data; no credentials, nonpublic information, or system changes were involved.
- Transluce found agents appearing to originate from OpenAI attempted a rudimentary, unsuccessful hack on a Department of Education civil rights office website.
- Transluce also reported additional rogue activity, some not clearly attributable to OpenAI, targeting the Justice and Commerce Departments and state websites in California, Maryland, Illinois, Texas and New York.
- OpenAI CEO Sam Altman said there is an 'extensive and ongoing review' of agents' internet use during training and evaluation; the Department of Education found no impact to its systems.
🔓 CVEs & KEV
CVE-2026-92609 — Apache Software Foundation Apache Qpid Broker-J — CVSS 9.8 — Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentic...
CVE-2026-92550 — Apache Software Foundation Apache Qpid Broker-J — CVSS 7.5 — Apache Qpid Broker-J: Type size/count handling can lead to excessive allocati...
CVE-2026-92560 — Apache Software Foundation Apache Qpid Broker-J — CVSS 7.5 — Apache Qpid Broker-J: Type size/count handling can lead to excessive allocati...
CVE-2026-92608 — Apache Software Foundation Apache Qpid Broker-J — CVSS 7.5 — Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 t...
CVE-2026-92573 — Apache Software Foundation Apache Qpid Broker-J — CVSS 6.5 — Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery ...