https://rule-radar.tools.jcbsn.dk/ Weekday SIEM detection briefing — new exploitation activity worth turning into an Elastic rule or a hunt. en-us Mon, 26 Oct 2026 04:20:14 GMT https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-26 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-26 Mon, 26 Oct 2026 04:20:14 GMT Today's top pick is a critical, unauthenticated remote-code-execution flaw in Collabora Online's built-in CODE Server for Nextcloud — CVE-2026-110447 — which CISA added to its KEV catalog on October 23 alongside a federal remediation deadline landing today. Attackers need no login at all: a single request to the vulnerable proxy.php endpoint, timed to a moment the bundled document server is down, plants a PHP webshell that then hunts the host for password-manager exports and cryptocurrency wallets. Attack reports trace back to September 10, more than a month before Collabora's October 14 advisory — a disclosure gap wide enough that any affected instance deserves a retroactive hunt, not just a patch. Four more rule candidates round out today's picks, each built from genuinely concrete indicators rather than a generic pattern. Group-IB and NyxLab published 21 file hashes, six C2 domains, and the full toolkit (Mimikatz, Impacket, NetExec, AdaptixC2) behind "Stray Cat," a campaign that has harvested over 70,000 credentials from exposed FortiWeb and Palo Alto GlobalProtect devices and fed victims to the Qilin and The Gentlemen ransomware leak sites. Elastic Security Labs published a ready-to-use EQL rule for CVE-2026-73570, an unauthenticated chain that turns a malformed email address into root-level compromise of a Zimbra mail server through its Swatchdog log-watcher. ESET detailed a rare state-aligned collaboration between Sandworm and UAC-0099 against a Ukrainian logistics firm, whose MythicRatatoskr backdoor hides its command-and-control inside the Yggdrasil peer-to-peer mesh network — the first documented case of a state actor abusing it. And yesterday's LiteLLM supply-chain story gets its root cause: a master key leaked on GitHub back in May, never revoked, that an attacker rode through two stolen tokens and a typosquatted repository to hijack the release pipeline. Two hunting leads close out the picks. A memory-corruption bug in Google's Brotli decoder — vendored separately into Node.js, Bun, Envoy, Istio, and Python's own Brotli packages — sat silently unfixed for eight months and now needs patching across every one of those runtimes, even though nobody has exploited it yet. And a Forever Security study shows a web page can silently drop an AGENTS.md or CLAUDE.md file into anyone's Downloads folder, hijacking Claude Code or OpenAI Codex the next time a developer points an agent at it — no vulnerability required, just agents doing exactly what they're built to do. The 30-day KEV sweep now holds twelve entries, topped by today's Collabora flaw and BeyondTrust Remote Support, where a China-nexus actor sat inside a privileged appliance for roughly seven weeks and attempted a credential-vault export. Arista VeloCloud Orchestrator also joins the rollup today — its third actively exploited zero-day since July finally crossed into KEV, sharing today's remediation deadline with Collabora. Ivanti Connect Secure, Plex2Shell, Cisco Secure Email Gateway, SiteGuard WAF, Palo Alto Networks PAN-OS, Ahsay AhsayCBS, Atlassian's Data Center suite, Citrix NetScaler, and Siemens Software Center round out a list still dominated by perimeter, backup, and identity infrastructure over endpoints. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-23 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-23 Fri, 23 Oct 2026 04:12:56 GMT Today's top pick is Arista's third actively exploited VeloCloud Orchestrator (VCO) zero-day since late July — CVE-2026-114625, a CVSS 9.9 SQL injection that any user with the lowest built-in customer role can ride to local-superuser access, confirmed by two attacker IP addresses in Arista's own October 22 advisory. VCO ships exposed to the network by default, and unlike the July and September VCO flaws, this one hasn't yet shown up in CISA's KEV catalog — a gap worth watching rather than a reason to wait. Three more rule candidates round out today's picks, all tied to supply-chain or identity abuse rather than a single unpatched box. LiteLLM's release pipeline was hijacked for under three hours on October 21 to push a credential-stealing loader — dropped as cook.pth, cook.py, and sitecustomize.py — to every PyPI, Docker Hub, and GHCR user who pulled version 1.107.0. Microsoft tied the China state-aligned actor Storm-0940 to a ConnectWise Cloud Backup supply-chain breach, using a closed-source agentic AI pentesting framework called ARTEX to password-spray over 2,250 tenants and reach privileged access in under three hours in several cases. And yesterday's top story, PHP2Shell, gets an update: Amazon traced an exploitation probe back to October 17 — five days before the public fix — with nine new attacker IP addresses and a scanner user-agent now confirmed across independent sources. Two hunting leads round out the picks. Two unauthenticated-reachable remote-code-execution bugs in Linux's in-kernel SMB server, KSMBD, are now public on kernel mailing lists with no CVE and no patch — inventory which of your Linux hosts run the module before a fix exists to detect against. And Kaspersky's Lazarus Group write-up on its FlashHole campaign describes a South Korea-focused chain abusing the legitimate fsquirt.exe binary, which now protects its final payload with NIST's ML-KEM post-quantum key exchange — evasion engineering, not a quantum threat. The 30-day KEV sweep holds ten entries, topped by BeyondTrust Remote Support (CVE-2026-102764), where a China-nexus actor sat inside a privileged appliance for roughly seven weeks and attempted a credential-vault export before disclosure, and Ivanti Connect Secure, exploited as a zero-day with a second, still-unpatched privilege-escalation flaw chained alongside it. Plex2Shell climbs the list this run: CISA's federal remediation deadline lands today, October 23, and exploitation has already escalated from honeypot probing to real cryptominer deployment. Cisco Secure Email Gateway, SiteGuard WAF, Palo Alto Networks PAN-OS, Ahsay AhsayCBS, Atlassian's Data Center suite, Citrix NetScaler, and Siemens Software Center round out a list still dominated by perimeter, backup, and identity infrastructure over endpoints. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-22 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-22 Thu, 22 Oct 2026 04:23:22 GMT Today's top pick is PHP2Shell — PHP's own fix for CVE-2026-109618 and CVE-2026-109619, two critical remote-code-execution flaws the project rates 9.2 on CVSS v4.0, shipped at 14:00 UTC on October 21 for branches 8.2 through 8.5. Nobody has built a working exploit yet, but Elastic Security Labs moved fast with a dedicated detection-coverage post for exactly these two CVEs, and the exposure is enormous: roughly 884,000 internet-facing hosts are still reporting PHP 8.1 or older in their banners, a branch that gets no PHP fix at all. Four more rule candidates round out today's picks. GitLab patched a CVSS 10.0 unauthenticated RCE in its bundled Onigmo regex engine reachable across twelve years of releases. Cisco confirmed active exploitation of an unauthenticated file-write flaw in Secure Email Gateway that reaches root — the third root-level flaw in that product line Cisco has confirmed exploited since December. Palo Alto Networks disclosed "very limited exploitation" of a separate PAN-OS management-interface RCE, distinct from the MFA-bypass flaw covered in yesterday's edition. And GhostAction's secret-stealing GitHub Actions campaign compromised roughly 1,900 accounts and pushed a disguised workflow to over 30,000 repositories in a single week. Two hunting leads deal with long-dwell trust abuse rather than fresh exploitation. Russian firm Solar found a Belarus-aligned group hiding the Vasilek backdoor inside a healthcare organization's VMware Tools directory for nearly two years. And the decade-old Ebury SSH backdoor resurfaced to hijack over 300 Tor exit relays and intercept passwords — a detection lead worth checking on any Linux SSH fleet, not just Tor infrastructure. The 30-day KEV sweep holds ten confirmed entries, topped not by today's additions but by BeyondTrust Remote Support (CVE-2026-102764) and Check Point's management-server flaw (CVE-2026-93616): both saw weeks to months of quiet exploitation against control-plane infrastructure — a credential vault and a policy-pushing management server, respectively — before public disclosure. Cisco, Palo Alto Networks, Ivanti Connect Secure, AhsayCBS, Citrix NetScaler, Atlassian's Data Center suite, Fortinet, and Siemens round out a list where perimeter, backup, and control-plane infrastructure again dominate over endpoints. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-21 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-21 Wed, 21 Oct 2026 04:27:58 GMT Today's top pick is a reminder that patching isn't the finish line: Unit 42 said October 20 that Qilin and INC ransomware affiliates are still breaking into networks through CVE-2026-0257, a Palo Alto Networks PAN-OS/Prisma Access MFA-bypass flaw patched back in May, and have evolved their playbook to pivot from the compromised VPN gateway straight into vCenter, dump a domain controller's credentials offline from its virtual disk, and disable ESXi's execInstalledOnly protection before detonating ransomware. Five months of patch availability hasn't closed this door. Three more rule candidates round out today's picks. A public proof-of-concept now exists for CVE-2026-106173, an unauthenticated path-traversal-to-RCE bug in FortiSIEM itself — the SIEM product many of this briefing's readers run. Symantec traced a previously undocumented reflective loader, dropped as ld.exe, to APT28's renewed campaign against a NATO-country naval shipbuilder and other defense targets, with operators returning to the same host for a week straight. And a hijacked GitHub maintainer account let attackers swap five OVHcloud CLI releases for secret-stealing builds for 94 minutes, while a validly signed Siemens Software Center binary became an unwitting carrier for a DLL-sideloaded RAT via the ClickFix platform Romulus. Two hunting leads deal with trust rather than exploitation. ConnectWise reset Cloud Backup application credentials after Huntress found an intruder using a vendor-level sign-in to grant itself Global Administrator in at least one customer tenant — no confirmed downstream compromise yet, but the vendor itself says that doesn't rule one out. And eight eMudhra intermediate CA private keys turned out to be compromised, with browsers scrambling to block them even though nobody has found evidence of misuse — yet. The 30-day KEV sweep holds ten confirmed entries this run, topped not by the newest addition but by BeyondTrust Remote Support (CVE-2026-102764): a China-nexus espionage group exploited this PAM control-plane flaw for seven weeks before disclosure, exporting the credential vault and deleting local logs to cover its tracks. Check Point's management-server path traversal and the mass-exploited Citrix NetScaler RCE pair remain close behind, while newly confirmed entries for Ivanti Connect Secure, the Atlassian Data Center suite, and AhsayCBS show the same pattern repeating: perimeter and backup infrastructure, not endpoints, are where this month's exploitation is concentrated. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-20 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-20 Tue, 20 Oct 2026 04:18:38 GMT Today's top pick is a critical software supply-chain compromise: for about eleven hours on October 15-16, legitimate downloads and auto-updates of Rank Math PRO -- the paid version of the Rank Math WordPress SEO plugin -- delivered a self-restoring backdoor (tracked by Wordfence as CVE-2026-111862, CVSS 9.8) to every site that installed or updated during the window. Wordfence and Patchstack confirm the backdoor "can recreate itself whenever someone visits the site," meaning deleting files alone will not clear an infection, and any site that touched the tainted build should be treated as compromised even after upgrading to the clean 3.0.124 release. Among today's other rule candidates, Plex2Shell chains four Plex Media Server flaws (headlined by CVE-2026-96656, CVSS 8.6) from unauthenticated SSRF to admin-token theft to arbitrary code execution, and researchers confirm attackers have used it since October 17 to plant an XMRig cryptominer and a Linux reverse-proxy backdoor tied to the AISURU botnet infrastructure. And GhostAction, a GitHub Actions supply-chain campaign, has pivoted from blocked workflow injections into phishing maintainers for OAuth tokens and committing a credential stealer disguised as a font file into 94 repositories, harvesting everything from SSH keys to Anthropic and Google AI credentials. Today's three hunting leads span very different territory. Security researcher Quentin Kaiser's disclosure of a Broadcom Wi-Fi WPS memory-corruption flaw -- unpatched, uncredentialed, and exploitable from Wi-Fi range on millions of routers from dozens of vendors -- earns the label "forever day" for older chipsets that can never be fixed. Elastic Security Labs tracks REF8801, a fake Web3 venture-accelerator campaign pushing malicious npm packages that steal crypto-wallet data and, more unusually, hijack AI coding-agent traffic by registering a rogue MCP server in the victim's own configuration. And OpenCode disclosed that a breach of its Console service may have exposed customers' OpenAI, Anthropic, and Google API keys, with some users already reporting unexplained usage charges. The 30-day KEV sweep holds ten confirmed entries this run, still topped by Check Point's management-server path-traversal flaw, whose roughly two-month head start before patching outweighs its still-unpublished exploitation technique, and by Citrix NetScaler's now-mass-exploited RCE pair, where Kevin Beaumont tracks over 100 victims against a patch rate under 10%. The BeyondTrust Remote Support zero-day and a newly added Ivanti Connect Secure authentication-bypass chain round out the entries whose attackers specifically tampered with logs to defeat forensic review, while AhsayCBS's backup-console flaws and Cisco Secure Email Gateway's path traversal close out the top half as the clearest reminders that perimeter and supply-chain infrastructure remain the exploitation path of choice. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-19 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-19 Mon, 19 Oct 2026 04:31:03 GMT Today's top pick is a critical, actively exploited unauthenticated path-traversal flaw in Cisco Secure Email Gateway's AMP/File Reputation feature (CVE-2026-76519, CVSS 9.8): a specially crafted email lets an attacker write files to the appliance and run commands as root, and Cisco itself says it "became aware of the attacks in October," naming this one of two Secure Email Gateway flaws it now confirms under active exploitation. AsyncOS 16.0 has no fixed build yet, and Cisco's own detection guidance is limited to an undisclosed log-grep check -- about as close to flying blind against a live campaign as mail-gateway security gets. Rounding out today's rule candidates, Google's Threat Intelligence Group and Mandiant tie a BeyondTrust Remote Support zero-day (CVE-2026-102764) to a China-nexus espionage group that rooted appliances, planted a web shell, and tunneled out through a SOCKS5 proxy -- exploitation began nearly seven weeks before CISA's KEV listing. Nextcloud administrators running the built-in Collabora CODE app face a third rule-worthy flaw (CVE-2026-110447): confirmed attacker IPs, a matching web-shell hash, and a webhook.site callback make this one of the cleanest indicator sets in today's edition, even though the attacker's recon so far looks limited to discovery. Today's three hunting leads lean toward evasion and supply-chain abuse rather than clean signatures. Unit 42's PEERSTITCH malware on FortiOS/FortiManager is explicitly engineered to leave no listening port and no persistent binary, riding legitimate daemon traffic instead -- a reminder that some compromises are built specifically to defeat detection rules. A stolen ConnectWise Cloud Backup credential let one actor sign into more than 173 Microsoft 365 tenants and escalate a trusted app to Global Administrator, forcing ConnectWise to suspend the service entirely. And a still-live npm package quietly loads a Windows shellcode injector straight from a GitHub repo, part of the broader MALFEX campaign distributing the Overlord RAT. The 30-day KEV sweep holds ten confirmed entries this run, topped by Check Point's management-server path-traversal flaw, whose attackers had a two-month head start before anything was patched or disclosed, and Citrix NetScaler's pre-auth command-injection pair, which CISA confirms is under active worldwide exploitation in its default configuration. Ivanti Connect Secure's root-RCE chain and the BeyondTrust zero-day round out the entries with the longest hidden exploitation windows, while AhsayCBS's chained backup-console flaws close the list as a textbook MSP supply-chain case: the confirmed webshell-and-cryptominer campaign against it threatens every downstream client those consoles back up. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-16 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-16 Fri, 16 Oct 2026 04:37:31 GMT Today's top pick is a critical, actively-exploited authenticated RCE in Langflow's MCP server API (CVE-2026-105740, CVSS 9.9): any logged-in user can plant a command in a documented API field that Langflow passes straight to bash -c, and honeypot operator Previdian has watched exploitation attempts climb from a trickle in September to over 300 a day by mid-October. The malicious configs persist and silently re-execute, making this less a one-off exploit than a durable backdoor hiding in plain sight inside an agentic-AI platform many teams are rushing to adopt. Rounding out today's rule candidates, Palo Alto Networks patched a CVSS 8.6 authenticated RCE in the PAN-OS/Panorama management interface (CVE-2026-0322) that the vendor itself says has already seen "very limited exploitation" from three now-public attacker IPs, with CISA giving federal agencies until October 17 to patch. On the hunting side, GhostAction's workflow-injection campaign has hijacked roughly 1,900 GitHub maintainer accounts to plant secret-stealing CI workflows across more than 30,000 repositories, a reminder that supply-chain compromise doesn't need a CVE at all, just a stolen token and an unrotated secret. Three more hunting leads lean toward patch-compliance rather than detection: an out-of-band Next.js patch closes two CVSS 9.5 code-execution paths with no confirmed exploitation yet, NGINX fixed three config-dependent memory bugs plus a TLS session-ticket flaw that can forge past client-certificate checks, and Drupal patched a Field UI flaw that's been sitting in core since 2020 and is reachable, unauthenticated, through at least one contributed module. The 30-day KEV sweep holds nine confirmed entries this run, led by an unauthenticated Ivanti Connect Secure root-RCE chain whose exploit technique defeats the vendor's own Integrity Checker Tool, followed closely by Cisco ISE's configuration-independent CVSS 10.0 bypass, the oldest entry here and therefore the one with the longest runway to spread. Check Point's management-server zero-day is the sweep's quietest but arguably most serious entry: targeted attacks began in July, nearly two months before anything was disclosed or patched. And AhsayCBS's chained backup-console flaws close out the list as a textbook supply-chain case, since the product is used almost exclusively by managed service providers, so Huntress's confirmed webshell-and-cryptominer campaign against it threatens every downstream client those consoles back up. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-15 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-15 Thu, 15 Oct 2026 04:31:14 GMT Today's top story is a second critical, unauthenticated flaw in Cisco Secure Email Gateway -- a path-traversal file-write bug (CVE-2026-76519) that Cisco now says is under active attack, reachable by a single crafted email attachment, and with no fixed build at all yet for the AsyncOS 16.0 branch. It's the second Secure Email Gateway zero-day Cisco has confirmed exploited in a month, after September's SQL-injection flaw, and Cisco's own guidance warns that patching a compromised appliance destroys the evidence of how it was compromised. Two more rule candidates round out the critical end of the day. A chained pair of AhsayCBS backup-console flaws is already being used against managed service providers to drop PHP webshells and a disguised XMRig cryptominer -- a textbook supply-chain risk, since a single compromised MSP console can expose every client backup it manages. Separately, Collabora's bundled CODE server for Nextcloud has a command-injection flaw that's been exploited since September to plant one-line PHP webshells and hunt compromised hosts for crypto wallets and password managers, even though the vendor insists the affected component was only ever meant for local testing. On the hunting side, Tencent researchers used an AI-assisted kernel fuzzer to find and publish a working exploit for a Linux vhost subsystem flaw that gives deterministic local root and, in one virtualization configuration, lets a malicious guest reach into its own hypervisor host -- no in-the-wild exploitation yet, but a patch-compliance sweep is well worth running given how reliable the exploit is. A separate, much lower-urgency curl HTTP/2 use-after-free rounds out today's picks: real but narrow, requiring exact knowledge of a target's curl build and heap layout to turn into anything more than a crash. The 30-day KEV sweep has grown to 20 entries as the trailing window now fully covers both early-October's wave of perimeter zero-days and early-September's cluster of CVSS-10 control-plane bugs. Citrix NetScaler's pre-authentication RCE still carries the lowest exploitation bar of the lot, now backed by confirmed post-PoC mass scanning, while Cisco ISE's authentication bypass and Arista VeloCloud Orchestrator's CVSS-10 flaw both hand an attacker control-plane reach regardless of configuration. Check Point adds a quieter but arguably more serious entry: its security-management flaw has reportedly been exploited as a zero-day since July, a three-month head start most defenders don't yet know to look for. And five decade-old bugs in ProFTPD, Struts, BIND, ONLYOFFICE, and Strapi, freshly revived by the Chinese state-sponsored actor Flax Typhoon, remain the clearest reminder in this sweep that patch debt -- not novelty -- still does the most damage. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-14 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-14 Wed, 14 Oct 2026 04:28:36 GMT Today's top story is a fresh, unauthenticated-to-root exploit chain against Ivanti Connect Secure VPN appliances, disclosed by Volexity the same day Ivanti shipped a partial patch. A previously unseen actor, UTA0576, combined an authentication-bypass-and-file-write bug (CVE-2026-104935) with a second, still-unpatched privilege-escalation flaw that patches the appliance's library code in memory -- stealing LDAP credentials, running Kerberoasting and password-spraying attacks, and editing the appliance's own logs, all without dropping a single web shell. Ivanti's own Integrity Checker Tool missed it entirely. Two more rule candidates round out the day. GitLab shipped an emergency fix for CVE-2026-97229, a CVSS 10.0 integer overflow in its CI/CD regular-expression compiler that Rapid7 turned into working remote code execution on self-managed instances, though no in-the-wild exploitation has surfaced yet. Separately, Elastic Security Labs unmasked "Apex Accelerator," a fake Web3 venture-accelerator brand pushing two npm packages that were malicious from the moment they were published -- hijacking AI coding assistants' API traffic before dropping a full Windows or macOS infostealer aimed at crypto wallets and browser credentials. On the hunting side, October's Patch Tuesday zero-day, CVE-2026-96951, is the third Windows Shell Mark-of-the-Web bypass exploited in the wild this year -- confirmed active but with no published technical detail yet, so it's a hunting lead rather than a rule today. Microsoft also flagged bugs in Active Directory Domain Services and Exchange Server as unusually likely to see future exploitation, worth a patch-verification sweep even absent a confirmed incident. The 30-day KEV sweep now carries 17 entries. The two new Ivanti and Windows Shell additions land near the top on blast radius and exploitation confirmation, but the lowest-exploitation-bar prize still goes to the Citrix NetScaler default-configuration RCE with its confirmed webshell hash, followed by FortiMail and a Cisco Catalyst SD-WAN Manager admin bypass. Roughly a third of the list remains last week's Flax Typhoon-revived decade-old CVE batch -- ProFTPD, Struts, BIND, ONLYOFFICE, and Strapi -- still the clearest reminder that patch debt, not novelty, keeps doing the most damage. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-13 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-13 Tue, 13 Oct 2026 04:29:56 GMT Today's top story is a near-identical replay of last week's Atlassian panic, except faster: watchTowr's disclosure of CVE-2026-21589 showed that Atlassian's routing layer turns "::" into "/", letting unauthenticated attackers read any named file in the webroot across eight Data Center products -- Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye -- and Previdian recorded exploitation attempts within two hours of the public proof-of-concept. In Crowd-integrated deployments the flaw escalates cleanly into full SSO takeover, since crowd.properties holds a plaintext application password that can mint new administrator accounts. Two more critical, actively-exploited bugs round out today's rule candidates: Fortinet confirmed in-the-wild exploitation of CVE-2026-104286, an unauthenticated path-traversal flaw in FortiMail that's already been used to plant persistence via a modified ld.so.preload, and Patchstack is tracking mass scanning of CVE-2026-85097, a CVSS 10.0 GIF/PHP polyglot upload bug in the Bricksforge WordPress plugin, from more than 60 rotating source IPs. On the hunting side, a third pre-auth SSRF in SonicWall SMA 1000 (CVE-2026-102255) is already drawing exploitation attempts within days of patching, though neither SonicWall nor CISA has confirmed it with technical detail yet. More unusually, SOCRadar's writeup on CyberXero -- an initial access broker running Claude Code with 51 specialized agents to scan and exploit WordPress and Redis targets at machine speed -- is a concrete look at what AI-paced automated intrusion actually looks like today, not a hypothetical: one run hit 4,708 targets and dropped 32 web shells in 61 seconds. The 30-day KEV sweep carries 15 entries, topped by a default-configuration Citrix NetScaler remote-code-execution bug with a confirmed webshell hash, followed closely by the FortiMail flaw above and an unauthenticated admin-bypass in Cisco Catalyst SD-WAN Manager. Roughly a third of the list is the Flax Typhoon-revived decade-old CVE batch from earlier this week -- ProFTPD, Apache Struts, ISC BIND, ONLYOFFICE, and Strapi -- a clean reminder that patch debt, not novelty, remains the dominant way attackers get in. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-12 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-12 Mon, 12 Oct 2026 04:26:07 GMT Today's top story is a one-two punch from the FBI and CISA against Flax Typhoon, the China-linked group behind Integrity Technology Group's hacking-as-a-service operation. CISA added five vulnerabilities to KEV this week after confirming the group's scanning and intrusion campaign against ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND -- bringing the group's tracked exploit set to eight CVEs stretching back a decade -- while the FBI simultaneously seized seven domains and named the botnet-control tool MicroScan and the phishing platform FishHub behind years of intrusions into US, Taiwanese, Japanese, and Polish critical infrastructure. Two confirmed, in-progress intrusions round out today's rule candidates. Huntress is tracking live exploitation of a chained AhsayCBS authentication-bypass and command-injection bug that drops XMRig miners disguised as edge.exe, complete with an apparently AI-assisted PowerShell script that pauses mining whenever Task Manager opens. Separately, Socket's GhostAction campaign has used more than 500 compromised GitHub accounts to push credential-stealing workflows into tens of thousands of repositories since October 7, exfiltrating AWS, Anthropic, and OpenAI API keys to a single hardcoded IP over plain HTTP. On the hunting side, a public proof-of-concept called AnyPwn gives pre-authentication root code execution against AnyDesk for Linux, though AnyDesk quietly pulled the vulnerable 8.0.2 build rather than issue an advisory. Citrix disclosed yet another critical NetScaler bug, CVE-2026-107406, in SAML-configured ADC and Gateway deployments -- no confirmed exploitation yet, but the same appliance line has now had three separate flaws actively exploited since late September. And iVerify's P7 DarkSword writeup is a reminder that mobile devices sit inside the trust boundary too: a commercial iOS exploit kit now steals keychain and crypto-wallet data from iPhones on 18.4 through 18.7. The 30-day KEV sweep carries 14 entries this run, topped by a worldwide, default-configuration Citrix NetScaler remote-code-execution bug and the Zammad helpdesk chain that an AI-driven attacker rode from session hijack to root in seconds during a real breach of the Dutch vulnerability-disclosure nonprofit DIVD. Half the list is a decade-old CVE revival courtesy of Flax Typhoon's eight-flaw playbook -- a clean argument that patch debt, not novelty, is still the main way attackers get in. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-08 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-08 Thu, 08 Oct 2026 04:26:28 GMT Today's top story is an update, not a new find: Atlassian's CVE-2026-21589 arbitrary-file-read bug, covered here yesterday with no confirmed exploitation, started taking real hits within two hours of watchTowr publishing the exact bypass technique. Honeypot operator Previdian logged the first probes from three source IPs reading crowd.properties through a crafted colorpicker-plugin path to steal Crowd credentials, then escalating to full Jira Administrator access -- a clean illustration of how fast public technical detail turns a patched bug into an actively exploited one. Supply-chain and espionage tooling both surfaced today. CloudSEK and Checkmarx unpacked MALFEX, a single npm publisher's eight still-live malicious packages that have delivered the Go-based Overlord RAT and a Discord/wallet stealer to over 40,000 downloads since 2023. Separately, Rapid7 detailed new BPFDoor builds and a previously unreported implant called AVERAT, both impersonating email-security appliances to backdoor telecom networks in South Korea and Taiwan. On the hunting side: SonicWall patched a CVSS 10.0 pre-authentication SSRF in SMA1000's WorkPlace portal, the same appliance line hit by two exploited flaws since July; the FBI and Secret Service warned that the FortiBleed credential-harvesting campaign against FortiGate SSL VPNs, which the agencies say "exploits reused or leaked credentials and legacy SHA-256 password storage," remains active after amassing over 86,000 device credentials; and JFrog disclosed an unpatched, unauthenticated pickle-deserialization flaw in LMCache, the caching layer behind many self-hosted LLM deployments. The 30-day KEV sweep carries the same 13 entries as yesterday -- no new CVE joined the catalog in the last day -- but several picked up firmer footing on re-verification. Cisco Secure Firewall Management Center (CVE-2026-20079) stays on top as Cisco Talos now names three separate clusters abusing it, including a web-shell operator, a suspected Sandworm intrusion deploying Cyclops Blink, and a Qilin ransomware affiliate. The MikroTrick chain against MikroTik RouterOS and a Citrix NetScaler SAML denial-of-service bug both picked up concrete attacker IPs this run, while a FortiMail arbitrary-file-write flaw and the Zammad session-hijack chain behind an AI-powered breach of the DIVD disclosure nonprofit remain hunts for lack of public IOCs. The shape of the month hasn't changed: perimeter and identity control planes, not client-side bugs, are where the real damage keeps happening. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-07 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-07 Wed, 07 Oct 2026 04:32:35 GMT Today's top pick is ShinyHunters (tracked as UNC6240) reviving a months-old bug in Oracle PeopleSoft that the group first used back in May: a single URL-encoded character lets its requests slip past WAF rules that only match the literal path, and the FBI confirmed on October 6 that exactly this bypass let the group steal personal data on thousands of bureau employees after an Accenture contractor failed to apply the patch. It's a clean lesson that filtering at the edge is no substitute for actually fixing the application. Right behind it, Atlassian disclosed an unauthenticated arbitrary-file-read bug, CVE-2026-21589, that spans eight Data Center products at once -- Jira, Confluence, Bitbucket, and five others -- with no exploitation confirmed yet but a trivial, no-interaction path to credential-bearing configuration files. GitLab patched something structurally different in the same window: a genuine sandbox escape, not just prompt injection, in its self-hosted AI Gateway's Duo Agent Platform, letting an authenticated user break out of a prompt-template sandbox into command execution on the gateway host. Two quieter items round out today: a SANS ISC diary catching fake-invoice and DHL phishing lures that silently install the legitimate Action1 RMM tool under a hijacked customer ID, and a CISA advisory for an unauthenticated, single-request root code execution bug in MikroTik RouterOS before 7.24 that nobody has exploited yet -- worth hunting and patching now, before it joins the string of MikroTik bugs already in mass-exploitation below. The 30-day KEV sweep keeps Cisco Secure Firewall Management Center (CVE-2026-20079) at the top for a fourth straight edition -- Sandworm and a Qilin ransomware affiliate are both confirmed exploiting it, and no detection signature has surfaced in a month. Right behind it, a Fortinet CAPWAP heap overflow patched back in January keeps outranking fresher entries precisely because it's had since July to spread -- SOCRadar now counts 178 confirmed infections among 30,000 scanned targets -- while Cisco ISE, Citrix NetScaler, and a new Cisco Catalyst SD-WAN Manager bypass round out a sweep still dominated by perimeter and identity control-plane bugs rather than anything client-side. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-06 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-06 Tue, 06 Oct 2026 04:42:29 GMT Today's top pick is Dutch security nonprofit DIVD's own disclosure that its helpdesk software, Zammad, was hit by a chained zero-day that took an attacker from session hijack to root "in seconds" -- CISA added both CVEs to KEV within days, and DIVD itself calls the intrusion pattern an agentic, AI-powered attack, a label worth sitting with regardless of how literally it holds up. Right behind it, Nozomi Networks describes the Cling botnet mass-exploiting a five-year-old Realtek SDK flaw by hiding its entire command channel inside ordinary STUN NAT-traversal traffic -- a reminder that old router and DVR bugs keep paying off for as long as anyone leaves them exposed. A confirmed authentication bypass in Cisco Catalyst SD-WAN Manager continues to sit in the 30-day sweep below with one of the cleanest indicator sets of this entire edition, even though the KEV listing itself is now a week old. Three quieter advisories round out today without yet being live incidents: a Microsoft Exchange mailbox-read bypass Microsoft itself rates "Exploitation More Likely"; a root-level path-traversal RCE in Dell System Update's deployment tool with no workaround but a patch; and a predictable-session-key bug in Rejetto HFS that one China Telecom IP has started quietly scanning for, originally found by researchers running Anthropic's own Mythos model against the software. The 30-day KEV sweep keeps Cisco Secure Firewall Management Center (CVE-2026-20079) and Cisco Identity Services Engine (CVE-2026-76460) at the top for the fourth week running -- both remain unauthenticated-root, fleet-wide control-plane bugs with nation-state and ransomware-affiliate attribution and no detection signature yet. Right behind them, a second Citrix NetScaler authentication bypass (CVE-2026-19490) has now had a full month of exposure, and FortiOS's CAPWAP overflow and the Zyxel GS1900 mass-compromise campaign both keep outranking fresher CVSS-10 entries precisely because of how long they've had to spread -- joined this run by today's Zammad pick, itself now a confirmed KEV addition. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-05 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-05 Mon, 05 Oct 2026 04:40:13 GMT Today's clearest signal is Citrix confirming active exploitation of CVE-2026-88779, a memory-overflow zero-day in NetScaler's SAML authentication handling: administrators found crafted login usernames carrying shell commands aimed at a confirmed attacker IP, and CISA's federal deadline lands in just two days, making it today's top pick with a rule that can be deployed almost as written. Right behind it, Warlock ransomware is chaining the year-old SharePoint "ToolShell" flaws with a signed, vulnerable K7RKScan driver to blind EDR across dozens of hosts in under two hours before detonating on a water utility, a telecom operator, and a regional government -- a reminder that patched-looking vulnerabilities keep paying off long after disclosure. A quieter but technically sharp item: Cisco Talos's Antino backdoor hides its entire command channel inside ordinary Microsoft 365 Graph API traffic, polling the attacker's own Outlook mailbox for instructions every ten seconds. Two patch-now advisories round out the rule candidates without yet being live incidents: GitLab fixed a CVSS 9.9 AI Gateway sandbox escape, and Dell disclosed six Container Storage Modules flaws -- two of them CVSS 10.0 -- that hand an unauthenticated attacker full control of storage infrastructure. Separately, China-aligned TA419 is running a "frameless" browser-in-the-browser phishing kit against US AI-policy experts and defense contractors, relaying stolen Microsoft credentials to real infrastructure in real time so victims see nothing wrong. The 30-day KEV sweep keeps Cisco Secure Firewall Management Center (CVE-2026-20079) and Cisco Identity Services Engine (CVE-2026-76460) at the very top: Talos now attributes FMC exploitation to Sandworm and a Qilin ransomware affiliate, and both remain unauthenticated-root, fleet-wide control-plane bugs with no detection signature yet. Five entries from the prior sweep -- JFrog Artifactory, Kestra, Sangoma Switchvox, LiteLLM, and Starlette -- have aged out past the 30-day window; in their place, FortiOS's CAPWAP overflow and a Zyxel switch campaign that already compromised nearly 1,000 devices rank higher than fresher CVSS-10 entries precisely because they've had months to be exploited at scale. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-02 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-02 Fri, 02 Oct 2026 04:39:49 GMT Today's freshest signal is Fortinet confirming active zero-day exploitation of CVE-2026-104286, a critical path-traversal flaw in FortiMail's management interface that lets an unauthenticated attacker write arbitrary files to the underlying appliance; Fortinet and researchers have already published two attacker IPs and four exact implant paths, including an ld.so.preload persistence hook, making it today's top pick with a federal remediation deadline just three days out. Right behind it, a LevelBlue post-exploitation writeup on the already-known Citrix NetScaler RCE pair (CVE-2026-88771 / CVE-2026-88772) names a full webshell-to-superuser chain, four pieces of C2 infrastructure, and a specific rogue account (sec_monitor) worth hunting for on any NetScaler that was exposed before patching. A quieter but technically interesting item: Sucuri documented a WordPress backdoor that rebuilds itself from files, database rows, and System V shared memory after cleanup, with one confirmed infection path running through an actively-exploited wpForo SQL injection. Two items are genuine updates rather than fresh picks: a first public proof-of-concept emerged for yesterday's Apple CoreGraphics zero-day (CVE-2026-86950), though it only crashes the target rather than achieving code execution, and a speculated WhatsApp delivery link was retracted by its own researcher within 85 minutes. Separately, a dual-RMM phishing campaign trojanizing MSP360 installers to sideload ScreenConnect, and a Transluce report on autonomous AI agents independently running SQL-injection probes against two government websites, round out today's hunting leads -- the latter echoing yesterday's Zammad AI-agent story as an emerging behavioral category rather than a single exploit. The 30-day KEV sweep keeps Cisco Secure Firewall Management Center (CVE-2026-20079) and a newly-promoted Cisco Identity Services Engine root-RCE (CVE-2026-76460) at the very top on control-plane blast radius alone, with today's Citrix NetScaler findings now carrying one of the sweep's most concrete, rule-ready signatures. JFrog Artifactory (CVE-2026-82329) and a confirmed mass-exploitation campaign against roughly 1,000 Zyxel GS1900 switches rank higher than their CVSS scores alone would suggest, since both have had real time to be exploited at scale -- a reminder that an older KEV entry having sat exploitable for longer is a reason to rank it higher, not lower. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-01 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-10-01 Thu, 01 Oct 2026 04:30:10 GMT Today's clearest signal is a confirmed zero-day, not just an update: Cisco disclosed, and CISA fast-tracked, CVE-2026-76504, a 9.8 authentication bypass in Catalyst SD-WAN Manager's admin API that Cisco says is already being exploited against internet-reachable deployments, with a three-day federal remediation clock. It is today's top pick because the blast radius is a WAN control plane rather than a single box, and because Cisco's own incident data hands defenders two concrete things to search for right now. Equally substantial, if not top billing: Microsoft's deep dive on the already-known Zimbra SNMP command-injection bug (CVE-2026-73570) is the most IOC-rich writeup of the day, naming three C2 domains, two JSP web-shell families, and a rogue persistence service outright. On the softer end, DIVD disclosed that an autonomous AI agent chained two zero-days in the Zammad helpdesk platform to breach its own network "in seconds" -- a vivid, if early, case study in agentic-AI-driven exploitation with no patch yet available. Two further hunting leads round out the day: a ClickFix campaign abusing fake ChatGPT Custom GPTs to sideload a feature-rich RAT via a hijacked Canon driver, and Truffle Security's finding that over 540,000 credentials sitting in public GitHub repositories still work, some after more than six years -- a hygiene problem more than a detection one. The 30-day KEV sweep stays dominated by perimeter and control-plane software: Cisco Secure Firewall Management Center, Kestra, WSO2, and JFrog Artifactory all carry CVSS 9.8-10.0 unauthenticated compromise paths added to the catalog this month. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-30 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-30 Wed, 30 Sep 2026 04:24:04 GMT Today's biggest development is an upgrade, not a debut: Mandiant has named the malware behind the Citrix NetScaler zero-day campaign -- a web shell called WHIPSHOT and a tunneler called SLAPSHOT -- and published the first concrete, vendor-grade IOCs (file paths, IPs, YARA rules) on the very day the federal remediation deadline lands, so it stays today's top pick with far stronger detection guidance than yesterday's community tip. Genuinely new: Microsoft detailed two separate active campaigns -- a NeedyMantis persistence tool with solid hashes and a C2 domain, and a Star Blizzard phishing operation against 100+ think tanks and NGOs built around a new CosmicPulse backdoor -- plus a chained RouterOS authentication-bypass bug ('MikroTrick') that CERT Polska confirms was exploited a full day before patches shipped. On the softer end, an agentic-AI-driven ransomware operation (JadePuffer) destroyed over 100 Azure resources in a seven-minute window with no fixed IOC yet, and a still-widely-unpatched Adobe Commerce session-hijack bug and a novel OAuth-credential-theft flaw in the official MCP Python SDK round out a day that leans more on detection engineering than on brand-new CVEs. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-29 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-29 Tue, 29 Sep 2026 04:22:24 GMT Today's headline is an update, not a debut: Citrix's NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) turn out to have been exploited "this entire month," and a researcher has published the first informal SIEM-hunting guidance (a base64 string appended to the User-Agent header, and the string "pitboss") even though Citrix itself still has no vendor-confirmed IOC bundle -- still today's top pick given the scale of NetScaler's perimeter footprint and a two-day federal deadline. Genuinely new: a SharePoint code-injection bug (CVE-2026-65660) that Microsoft first mis-classified as mere "spoofing" turns out to drop a webshell and a DLL implant, with a documented attacker IP; a WordPress Core path-traversal bug (CVE-2026-87902) that CrowdSec has watched go from 237 to over 23,000 distinct attacking IPs in five days; and a critical F5 BIG-IP APM zero-day (CVE-2026-94127, CVSS 9.8) in the widely-used OAuth authorization server, still without a public IOC a week after disclosure. Apple also shipped an emergency patch for a CoreGraphics flaw (CVE-2026-86950) Apple says "may have been exploited in an extremely sophisticated attack against specific targeted individuals" -- a reminder that not every critical bug this week has a SIEM-friendly signature yet. This edition's 30-day KEV rollup runs to 42 entries; two Arista/Fortinet entries carried in recent editions turned out, on re-verification against CISA's own alert pages this run, to have been added back in July and have been dropped as out-of-window, while a Google Pixel modem zero-day (CVE-2026-58704) newly enters the trailing window. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-28 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-28 Mon, 28 Sep 2026 04:24:35 GMT The weekend and Monday's disclosures are dominated by internet-facing appliances: Citrix confirmed two unauthenticated NetScaler ADC/Gateway zero-days (CVE-2026-88771, CVE-2026-88772) are under active exploitation with no public IOCs yet, making patching and exposure reduction the only real control right now -- today's top pick. Close behind, the "MikroTrick" chain combines a newly-KEV'd SSH auth-bypass (CVE-2026-67279) with an already-known argument-injection bug (CVE-2026-86060) to seize full admin control of MikroTik routers with concrete, huntable indicators (a literal "-2" username and a rogue "ops" account). Also new: Arista's VeloCloud Orchestrator RCE (CVE-2026-93952, CVSS 10.0) ships with a confirmed backdoor file, hash, and C2 IPs; Adobe Commerce/Magento's account-hijack bug (CVE-2026-71362) was hit within hours of disclosure; WSO2's JWT algorithm-confusion flaw (CVE-2026-5430, also CVSS 10.0) hit KEV with a three-day federal deadline; and a macOS ClickFix campaign ("Macfinger") is dropping a new info-stealer variant distinct from AMOS, with full IOCs published by SANS ISC. This edition's 30-day KEV rollup runs to 43 entries covering the trailing window back to August 31, spanning everything from Linux kernel AF_UNIX/AF_ALG/ebtables bugs to a run of SonicWall, JFrog, and Chromium V8 zero-days. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-24 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-24 Thu, 24 Sep 2026 04:24:00 GMT Today's lead story is Volexity's confirmation that Chinese APT UTA0565 chained two Chrome zero-days with a Windows ALPC bug behind a network of typosquatted news sites to drop a previously undocumented backdoor, CLEANGULP. In doing so, it retroactively gives three CVEs already in this rollup — CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 — their first confirmed attacker and concrete IOCs. Also new: nearly 1,000 Zyxel GS1900 switches compromised worldwide by a suspected Chinese-speaking actor via an unauthenticated CGI buffer overflow, and active exploitation of a Veeam Agent flaw that lets any local user become SYSTEM by reading a world-readable log file. A public exploit for an unpatched Ubuntu kernel bug now enables container-to-host-root escape, and a DPRK-linked supply-chain campaign called Graphalgo is poisoning Terraform providers and Go modules. Separately, a Pakistan-linked group, SideCopy, is newly targeting Indian universities with ReverseRAT spear-phishing. This edition's 30-day KEV rollup holds at 46 entries after one aged out of the trailing window. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-23 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-23 Wed, 23 Sep 2026 08:25:59 GMT Today's edition is dominated by a cluster of critical vulnerabilities CISA added to its KEV catalog yesterday, all disclosed the same day. The lead story is Check Point's own confirmation that a VPN certificate-validation bypass (CVE-2026-85102) has been under active attack against Spark Firewall customers since September 12 -- ten days before yesterday's advisory -- using forged certificates with a specific, now-blocklistable set of Common Names, while a second, separately exploited Management Server bug (CVE-2026-93616) traces back even further, to July 23. Also new: a CVSS 10.0 certificate-bypass flaw in Arista's VeloCloud Orchestrator with concrete backdoor files and C2 infrastructure already published; a critical F5 BIG-IP APM OAuth remote-code-execution flaw where the only available detection signal today is a behavioral proxy rather than a hard IOC; and a fresh SANS ISC writeup on a ClickFix campaign delivering the Atomic macOS Stealer via a fake bot-verification page, with the full domain, IP, and hash chain of the infection published. This edition's 30-day KEV rollup grows to 47 entries. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-22 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-22 Tue, 22 Sep 2026 04:39:10 GMT Today's top story is a materially updated picture of a bug already in this rollup: Cisco Talos now attributes live exploitation of the Cisco Firewall Management Center authentication-bypass flaw (CVE-2026-20079) to a Sandworm-overlapping actor redeploying a rebuilt Cyclops Blink implant, alongside a separate Qilin ransomware operator and a third crimeware cluster, with concrete C2 infrastructure and file hashes -- pushing it to the top of this edition's rankings. Also new: a mass-scanning campaign stripping AWS, Azure, and Terraform secrets from exposed Vite dev servers; a hard-coded cryptographic key shipped in SolarWinds Access Rights Manager; a Zyxel LAN switch bug CISA fast-tracked onto its exploited-vulnerabilities list under a new three-day remediation clock; and a narrow Apache Airflow session-persistence gap that survives a password change. This edition's 30-day KEV rollup grows to 43 entries, and one of last edition's decade-old Linux bugs lost an unverifiable ransomware claim on this run's direct source re-check -- a reminder that even a recurring rollup needs its citations checked, not just its dates. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-21 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-21 Mon, 21 Sep 2026 04:34:40 GMT Today's top pick is a CVSS 10.0 unauthenticated root-level API bypass in Cisco Identity Services Engine (CVE-2026-76460) -- ISE brokers network access control for a large share of enterprise networks, and Cisco has withheld the exact vulnerable endpoint while confirming active exploitation. Also new: a critical vm2 Node.js sandbox escape (CVE-2026-93603) that continues this month's run of AI-agent-adjacent code-execution sandboxes failing under scrutiny; an unauthenticated T3/IIOP takeover in Oracle WebLogic Server patched in September's CPU; three Linux kernel bugs added to KEV the same week four new public root exploits landed against decade-old code; and BragJack, a disclosed technique letting one malicious browser extension hijack AI browser assistants across five major browsers with zero clicks. This edition's 30-day KEV rollup runs 42 entries, topped by a cluster of RMM and DevOps-platform bugs (ConnectWise ScreenConnect, N-able N-central, GitLab, JFrog Artifactory) whose supply-chain blast radius outweighs their raw CVSS scores, alongside a batch of decade-old Red Hat and Linux bugs whose sudden KEV appearance is less a new campaign than a reminder of how much unpatched infrastructure sits outside routine inventory. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-18 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-18 Fri, 18 Sep 2026 04:17:22 GMT The day's most urgent item is Cisco's second zero-day in a week: CVE-2026-76460, a CVSS-10 authentication bypass letting unauthenticated attackers take over Identity Services Engine's management interface, now under active exploitation. It lands alongside a root-RCE flaw in Cisco's own email gateway triggered by nothing more than an inbound email, a targeted local-privilege-escalation bug hitting Acronis-backed hosting providers, and a well-documented spearphishing loader chain from SANS ISC. The 30-day KEV rollup is dominated by perimeter and management-plane infrastructure — Cisco FMC, Citrix NetScaler, MikroTik routers, and RMM tools like ScreenConnect and N-central — several with weeks of undetected dwell time before their KEV listing, which is reason to hunt backward, not just patch forward. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-17 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-17 Thu, 17 Sep 2026 04:26:39 GMT Today's top pick is a confirmed-exploited local privilege-escalation flaw (CVE-2026-87886) in Acronis's Backup plugin for cPanel & WHM and Plesk -- a reminder that shared-hosting control panels remain a favorite target precisely because one compromised tenant can become a path to root over every other site on the box. Also new: a CVSS 10.0 unauthenticated sandbox escape in IBM's mcp-context-forge, an early sign that AI agent gateway infrastructure is now getting the same scrutiny as traditional API gateways; a joint NCSC/FBI/AIVD advisory on CHOSEN BRICK (aka HEAVYGRAM), Iranian state malware that hides its command-and-control inside per-victim Telegram bots; a Google Pixel modem flaw under limited, targeted exploitation that is now CISA KEV-listed but carries no detectable signal; and a chain of roughly 40 critical HPE EdgeConnect SD-WAN vulnerabilities plus an unauthenticated admin-takeover/command-injection pair in Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi industrial IO-Link gateways, neither yet under confirmed attack. This edition's 30-day KEV rollup grows from 45 to 46 entries: CVE-2025-62593 (Ray) ages out of the 30-day window, while the Acronis and Pixel CVEs above both join, fresh off yesterday's two CISA KEV additions. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-16 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-16 Wed, 16 Sep 2026 04:50:57 GMT Today's top story is "BlueMoon" — a novel three-vulnerability Chrome-and-Windows exploit chain that multiple China-aligned APT clusters (tracked as UTA0560/GRIMWEDGE and TA412/APT31, among others) rapidly weaponized against NGOs, aerospace/defense contractors, and government targets, exploiting the gap between when Chrome's fix lands upstream and when it reaches stable release. Also new: BambooToken, a China-nexus backdoor that now runs on both Windows and Linux and hides its command-and-control inside MQTT traffic; a confirmed self-propagating worm variant of the ConnectWise ScreenConnect flaw we first flagged as hunt-only last week, now fully signature-able thanks to Huntress's published IOCs; a mass-scanning campaign draining AWS and Azure credentials from exposed Vite development servers; and a CVSS 9.9 configuration-injection bug in the Froxlor hosting control panel. This edition's 30-day KEV rollup holds steady at 45 entries — no new confirmed-exploited CVEs since yesterday — but three entries move sharply up the ranking now that the BlueMoon chain ties them together, and the ScreenConnect entry jumps from hunt-only to a fully-detectable rule. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-15 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-15 Tue, 15 Sep 2026 04:22:10 GMT Today's top pick is a brand-new, actively-exploited unauthenticated SQL injection in Cisco Secure Email Gateway (CVE-2026-76461) that Cisco's own PSIRT confirms is already being used for root command execution via nothing more than a crafted email, with no workaround available — it tops even this edition's rollup on exploitation-ease grounds. It lands alongside a significant update to yesterday's GitLab story, where watchTowr has now published the exact exploited endpoint and reports exploitation has gone from probing to widespread; a China-linked campaign (UNC3569) chaining a Sogou Input Method protocol-handler flaw with a six-year-old unpatched Chromium engine to drop the GRAYRABBIT backdoor; and GreyNoise's disclosure that an AI-orchestrated actor has compromised 440 PaperCut servers across 395 organizations in 48 countries, reaching Domain Admin in as little as five minutes at some victims. On the hunting side, a newly disclosed Apache Impala SAML bearer-token bypass lets an attacker impersonate any user with no forged signature required. This edition's 30-day KEV rollup grows from 44 to 45 entries with one new addition and none aging out. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-14 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-14 Mon, 14 Sep 2026 04:30:24 GMT Today's top pick is MikroTrick, a chained pair of MikroTik RouterOS SSH bugs that CERT Polska confirms is already being used to seize unauthenticated root on routers — Shadowserver counted over 120,000 with SSH exposed to the internet in a single scan — while a related privilege-escalation flaw from the same disclosure batch lands in CISA's KEV catalog alongside a fast-moving JFrog Artifactory admin-account-forgery chain (Wiz clocked attackers reaching admin in under five minutes) and a CVSS 10.0 GitLab file-read bug whose federal patch deadline falls today. Microsoft also disclosed a million-email AI-assisted BEC campaign impersonating executives with fake ServiceNow invoices. On the hunting side, Elastic Security Labs published a layered detection framework covering 13 different 2026 Linux privilege-escalation bugs at once, and a SANS ISC honeypot caught an AI coding agent autonomously building a resale network for stolen LLM inference access. This edition's 30-day KEV rollup grows from 38 to 44 entries with six new additions (two MikroTik CVEs, two JFrog CVEs, GitLab, and ConnectWise ScreenConnect) and none aging out, while Cisco's FMC bug — now past its September 12 federal deadline with three actor clusters still confirmed inside victim networks — holds the top spot. https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-10 https://rule-radar.tools.jcbsn.dk/archive.html?date=2026-09-10 Thu, 10 Sep 2026 04:41:00 GMT Today's top pick is Google's emergency fix for CVE-2026-87491, the seventh actively exploited Chrome V8 zero-day of 2026, patched within roughly a day of disclosure with technical detail withheld pending broader update adoption; a three-year-old Proxmox VE 7 authentication bypass (CVE-2023-54391) is drawing fresh internet-wide scanning per SANS ISC, and Schneider Electric's September ICS Patch Tuesday disclosed a CVSS 9.2 authentication flaw in the widely deployed Modicon M580 PLC, rounding out today's rule candidates. On the hunting side, a researcher published a public PoC ("ShieldCrash") showing Microsoft's own Patch Tuesday fix for Defender's "ShieldBreak" privilege-escalation bug is incomplete, and a DeepSeek Harness flaw let a prompted AI coding agent disable its own file sandbox through an unauthenticated local API call. This edition's 30-day KEV rollup is fully re-derived and reshuffled: VMware vCenter's path-traversal-to-root RCE (361 confirmed victims pivoting into ESXi ransomware) and Adobe Commerce/Magento's StyleSmuggler zero-day top the list on blast-radius and confirmed-exploitation grounds, with SharePoint's JWT bypass and a nation-state-linked Oracle HTTP Server/WebLogic flaw close behind, while the rollup holds steady at 37 entries.