🕵️ RESEARCH & DEEP DIVES
South Africa's Air Traffic Control Provider ATNS Hit by Ransomware-Linked Malware in OT Network
South African air traffic control company ATNS discovered ransomware-linked malware in an operational technology network and is seeking forensic help to investigate.- Air Traffic and Navigation Services (ATNS), which manages air traffic and weather services for ~10% of the world's airspace, found malware tied to early-stage ransomware in OT systems supporting weather services.
- The OT incident occurred at Port Elizabeth Airport (FAPE), with East London Airport (FAEL) possibly also affected; a possible insider data theft occurred at Maputo International Airport, Mozambique (FAMM).
- Investigators found indications of data exfiltration to external IP addresses located in China.
- ATNS issued a request for quotes on Sept. 18 seeking cyber-forensics firms to determine root cause and extent of compromise; internal teams have applied containment and malware removal.
- Ransomware attacks on aviation surged sixfold in 2025 per Thales, with 27 major attacks reported in the 16 months to April 2025.
Pgpool-II auth flaw (CVE-2026-92873) lets attackers promote rogue watchdog leader node
Pgpool-II contains an incorrect implementation of an authentication algorithm that may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.- Applies to Pgpool-II users; affected versions include 3.5.x and 4.3.0 through 4.6.0, with 4.7.0 unaffected.
- The flaw (CVE-2026-92873, CWE-303) is an incorrect implementation of an authentication algorithm in the watchdog feature.
- An unauthenticated remote attacker can promote an arbitrary watchdog node to the leader node; CVSS 3.0 score is 7.3 (High).
Pgpool-II CVE-2026-92872: sensitive info written to log files exposes cluster data
Pgpool-II logs sensitive information that may let an authenticated attacker obtain cluster information.- Affects Pgpool-II versions 3.5.x through 4.7.0 (CVE-2026-92872, assigned by JPCERT, CVSS 4.3/5.3 medium).
- Sensitive information inserted into log files may allow an authenticated attacker to obtain cluster information.
- Low-privileged network access suffices; confidentiality impact is low with no integrity or availability impact.
Pgpool-II NULL pointer dereference flaw lets unauthenticated attackers crash watchdog (CVE-2026-92871)
A NULL pointer dereference vulnerability in Pgpool-II allows an unauthenticated attacker to crash the watchdog process.- Affects Pgpool-II versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, and 3.5.x
- NULL pointer dereference (CWE-476) allowing abnormal termination of the watchdog process
- Remotely exploitable by unauthenticated attackers over the network; CVSS 3.0 score 7.5, CVSS 4.0 score 8.7 (availability impact only)
- Tracked as CVE-2026-92871, assigned by JPCERT
Apache PLC4X OPC UA driver flaws allow server impersonation and traffic tampering (CVE-2026-102508)
Apache PLC4X's OPC UA driver has critical signature and certificate validation flaws letting network attackers impersonate servers and read or forge secure-channel traffic.- Affects Apache PLC4X (PLC4J) OPC UA driver versions 0.9.0 through before 1.0.0; CVSS 9.2 critical.
- Flaws include improper signature verification (CWE-347), improper certificate validation (CWE-295), and algorithm downgrade (CWE-757).
- In 0.9.0–0.11.0 failed signature checks are only logged, and the server certificate is taken from the unauthenticated GetEndpoints response and used to encrypt user passwords.
- In 0.12.0–0.13.1 the signature check is inverted and server certificates are accepted without a trust anchor by default; all versions default to security policy None.
- A man-in-the-middle attacker can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials.
- Fixed in Apache PLC4X 1.0.0, which enforces signature checks, requires certificate verification, and defaults to Basic256Sha256 with SignAndEncrypt.
Motors WordPress plugin through 1.4.109 vulnerable to unauthenticated blind SQL injection (CVE-2026-6806)
The Motors Car Dealership & Classified Listings WordPress plugin has a time-based blind SQL injection flaw fixed in version 1.4.110.- Affects WordPress sites running the Motors – Car Dealership & Classified Listings plugin, all versions up to and including 1.4.109.
- Time-based blind SQL injection via the 'stm_lat'/'stm_lng' parameters, caused by insufficient escaping and lack of prepared statements (CWE-89).
- Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.
- CVSS 3.1 score 7.5 (High); discovered 2026-03-14, disclosed 2026-09-29; credited to Leonid Semenenko.
HT Mega Addons for Elementor through 3.1.1 - Authenticated (Contributor+) Stored C... (5) — <https://cve.threatint.com/CVE/CVE-2026-11895?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>
Stored Cross-Site Scripting via custom content descriptions vulnerability exi... (5) — <https://cve.threatint.com/CVE/CVE-2026-93464?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>
Stored Cross-site scripting via appended strings in email form fields vulnera... (5) — <https://cve.threatint.com/CVE/CVE-2026-93460?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>
Cross-Site Scripting via Script Validation Bypass exists in baserCMS. If this... (5) — <https://cve.threatint.com/CVE/CVE-2026-93463?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may al... (5) — <https://cve.threatint.com/CVE/CVE-2026-92870?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an ... (5) — <https://cve.threatint.com/CVE/CVE-2026-92869?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>
An improper certificate validation vulnerability exists in Pgpool-II, which m... (5) — <https://cve.threatint.com/CVE/CVE-2026-92868?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>
AI Agent Finds Linux Kernel Bug That Turns a Tiny Memory Write Into Root Access (5) — <https://cybersecuritynews.com/ai-agent-finds-linux-kernel-bug/|Cyber Security News>
New OperTraitors Tool Reveals Dangerous Privilege Escalation Paths in Kubernetes Operators (5) — <https://cybersecuritynews.com/opertraitors-tool/|Cyber Security News>
Unsloth Studio RCE Flaw Lets Malicious Hugging Face Models Execute Code (5) — <https://cybersecuritynews.com/unsloth-studio-rce-flaw/|Cyber Security News>
Fortinet Uncovers SectopRAT Variant Hidden Inside Tampered Legitimate Windows Software (5) — <https://cybersecuritynews.com/fortinet-uncovers-sectoprat/|Cyber Security News>
📋 ADVISORIES
📄 Source for baserCMS missing authentication flaw (CVE-2026-93462) may expose sensitive information — jvn.jp
📄 Source for Bold Page Builder <= 5.7.2: Five Stored XSS Flaws Affecting Contributor+ Users (CVSS 6.4) — wordfence.com
📄 Source for WP Directory Kit plugin for WordPress vulnerable to SQL injection in versions up to 1.5.4 — wordfence.com
📄 Source for Smart Slider 3 WordPress plugin <= 3.5.1.38 vulnerable to stored XSS (CVE-2026-14876) — wordfence.com