Cyber Hose

In this digest

• Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
• AdaptHealth confirms 4.1 million people exposed in July cyberattack
• Chinese espionage groups swarm to exploit triple-link chain of zero-days

In this digest

• Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
• Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
• Google Chromium V8 Out of Bounds Write Vulnerability

In this digest

• Android's September 2026 updates patch 180 vulnerabilities after two empty bulletins
• AI Gives Lesser-Resourced Attackers Nation-State-Level Reach, Google's GTIG Warns
• FBI cyber chief says private sector too hesitant to share cyber threat information with the bureau

In this digest

• AI agents exploit PaperCut NG/MF flaws to compromise 440 servers across 395 organizations
• Google's September 2026 Android Security Bulletin fixes critical remote code execution flaws
• MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks

In this digest

• US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities
• Ivanti Patches Critical Flaws Across Enterprise Security Products
• ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws

In this digest

• Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
• CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok
• SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

In this digest

• New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access
• September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
• Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners

In this digest

• Heap overflow in Samsung libimagecodec.quram.so JPEG decoder allows remote code execution
• Samsung patches GalaxyDiagnostics path traversal flaw (CVE-2026-21103) in September 2026 SMR
• Samsung SystemUI flaw (CVE-2026-21100) lets local attackers launch arbitrary activity

In this digest

• Fortinet FortiSandbox PaaS — CVSS 9.9 — FortiSandbox Vulnerability Allows Attackers to Access Sensitive Information via Crafted HTTP Requests
• OPNsense core — CVSS 9.0 — OPNsense NTP Path Traversal Leads to Root File Overwrite
• FireBox WooCommerce Plugin — CVSS 8.8 — Authenticated Remote Code Execution

In this digest

• Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
• Google Chrome 153.0.8010.36 patches V8 memory corruption flaw (CVE-2026-87489)
• OpenIDC/cjose Critical JWE Weak Encryption (CVE-2026-53939)