Cisco and Google Patch Actively Exploited Zero-Days; WSO2 Flaw Under Attack

Google Fixes Exploited Pixel Modem Flaw CVE-2026-58704

Google has released its September 2026 security update for Pixel devices, patching a high-severity zero-day vulnerability (CVE-2026-58704) in the cellular modem. The flaw, a privilege escalation issue, is reportedly under limited, targeted exploitation. It allows a remote attacker in proximity to the device to escalate privileges without user interaction. CISA has added the vulnerability to its KEV catalog, urging federal agencies to patch by September 19, 2026.

Zero-DayPrivilege EscalationMobile SecurityAndroidKEV +2 more

Google Patches Actively Exploited Zero-Day Flaw in Pixel Modems

Critical WSO2 API Flaw Under Active Attack, Exposes Enterprise Data

WSO2 API Flaw (CVE-2026-5430) Actively Exploited

A critical authentication bypass vulnerability, CVE-2026-5430, in WSO2's widely used API management platform is being actively exploited in the wild. The flaw, which has a CVSS score of 10.0, allows unauthenticated attackers to forge JWT tokens, take over administrator accounts, and access sensitive backend credentials and data. The vulnerability was patched in April 2026, but security researchers have now detected active exploitation attempts, making it urgent for organizations to verify they are patched.

API SecurityAuthentication BypassJWTCVSS 10WSO2

Critical WSO2 API Flaw Under Active Attack, Exposes Enterprise Data

CISA Issues Advisories for Critical Flaws in OT/ICS Systems

CISA Warns of Critical Flaws in OT/ICS Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published several advisories for critical vulnerabilities in operational technology (OT) and industrial control systems (ICS). The flaws affect Digital Watchdog DVRs/NVRs used in surveillance and Wärtsilä onboard ship systems used in the maritime sector. Some vulnerabilities carry CVSS scores as high as 9.6 and could allow for full system takeover, highlighting ongoing risks to critical infrastructure.

ICSOTCISACritical InfrastructureHardcoded Credentials +1 more

3 min read

CISA Issues Advisories for Critical Flaws in OT/ICS Systems

Parallels Desktop Flaw Lets Any Local User Gain Root on macOS

Parallels Desktop Flaw 'ParaShells' Gives macOS Root Access

A high-severity local privilege escalation vulnerability, CVE-2026-90894 or "ParaShells," has been found in Parallels Desktop for Mac. The flaw allows any local user, including those with standard, non-administrative privileges, to escalate their access to full root control over the host macOS system. The vulnerability has been patched by Alludo in Parallels Desktop v27.0.0, and users are strongly urged to update.

LPEmacOSVirtualizationPrivilege EscalationParallels

Parallels Desktop Flaw Lets Any Local User Gain Root on macOS

Critical WordPress Plugin Flaw Allows Unauthenticated Admin Creation

JetFormBuilder Flaw CVE-2026-12793 Allows Admin Takeover

A critical privilege escalation vulnerability, CVE-2026-12793, has been found in the JetFormBuilder WordPress plugin, affecting all versions up to 3.6.2. The flaw, rated 9.8 on the CVSS scale, allows unauthenticated attackers to create new administrator-level user accounts on affected websites by submitting a crafted request. With a public exploit reportedly available, administrators are urged to update the plugin immediately to prevent a complete site takeover.

WordPressPluginPrivilege EscalationAdmin TakeoverVulnerability

Critical WordPress Plugin Flaw Allows Unauthenticated Admin Creation

Click2Mail Discloses Data Breach Involving Financial Information

Click2Mail Data Breach Exposes Customer Financial Data

C2M LLC, which operates the online postal mail service Click2Mail, has disclosed a data breach that exposed customer financial information. According to a notification filed with the Vermont Attorney General, the compromised data includes financial account codes and credit and debit card information. The full scope and timeline of the breach have not yet been made public, but affected individuals are at risk of financial fraud.

Data BreachFinancial DataPIIPrivacy

3 min read

Click2Mail Discloses Data Breach Involving Financial Information

AMOS Stealer Uses Deceptive Setup Guides to Target macOS Systems

Atomic macOS (AMOS) Stealer Activity Analysis

An analysis of the Atomic macOS (AMOS) Stealer reveals its evolving tactics for compromising Apple systems. Threat actors are using deceptive websites with fake setup instructions to trick users into manually executing malicious scripts. This method bypasses some traditional defenses and allows the stealer to harvest system information, browser credentials, and cryptocurrency wallet data. The malware's infrastructure, including C2 servers and domains, changes frequently, making detection challenging. This report breaks down the infection chain from an August 2026 case, providing technical details, indicators of compromise, and mitigation strategies for defenders.

infostealermacOSZshdata theftcredential theft +1 more

7 min read

AMOS Stealer Uses Deceptive Setup Guides to Target macOS Systems

Updated Articles (2)

State-Backed APTs Use 'BlueMoon' Kit to Exploit Chrome & Windows Flaws

Updated: September 16, 2026

Chinese APTs Weaponize BlueMoon Exploit Kit with Zero-Day Chain

Update:

Further analysis by Volexity reveals that two distinct Chinese state-sponsored groups, UTA0560 and JungleBamboo (APT31), independently leveraged the same CVE-2026-85046 exploit. This suggests a potential third-party developer or shared supply chain for the exploit. UTA0560's campaign used a compromised US university website with an XSS vulnerability for redirection. Google Chrome users should update to version 152.0.7977.82/.83 or later to mitigate the vulnerability. The campaigns continue to target NGOs for espionage purposes, reinforcing the initial assessment of sophisticated, state-backed activity.

September 10, 2026

5 min read

APTBlueMoonExploit KitZero-DayPatch Gap +3 more

State-Backed APTs Use 'BlueMoon' Kit to Exploit Chrome & Windows Flaws

Cisco Patches Actively Exploited Zero-Day in Secure Email Gateways

Updated: September 16, 2026

Cisco Patches Zero-Day Flaw in Email Gateway (CVE-2026-76461)

Update:

Further analysis of CVE-2026-76461 in Cisco Secure Email Gateway reveals the SQL injection flaw allows unauthenticated attackers to achieve root-level remote code execution (RCE). This critical detail, with a CVSS score of 9.8, escalates the potential impact, enabling full system compromise, interception of email traffic, and lateral movement within networks. Organizations are urged to patch immediately given the heightened threat.

September 15, 2026