ViewSonic ViewBoard Flaws Expose Screens and Open a Code Path
Three unauthenticated vCast endpoints expose screen images, APK delivery and service input on shared networks. Isolate ViewBoards and check who can reach them.
Reader edition
The Feed
Imprivata EAM Keeps Appliance Keys Trusted Until Redeployment
EAM through 26.2.6 has no supported RSA key-pair rotation. Protect key copies in backups and snapshots, and plan redeployment if the private key is exposed.
Storm-3068 Steals Kubernetes Credentials via Microsoft Azure DevOps
After a password reset, Storm-3068 used an authorized Azure DevOps pipeline to collect Kubernetes credentials. Trace pipeline changes and restrict resource access.
Zimbra Mail Clusters Face Secret Theft After Server Intrusions
Microsoft traces a mail-server intrusion from an optional SNMP notification path to root persistence, shared authentication secrets and peer mailbox nodes.
Cisco SD-WAN Manager Flaw Gives Attackers Admin Access
An exploited URI-encoding bypass reaches the management API as admin. Check Cisco's service-proxy and server logs, restrict exposure, and install a fixed release.
Antino Backdoor Uses Microsoft 365 for Espionage Tasking
Talos traces a phishing-to-Windows backdoor chain affecting Asian institutions. Hunt the script host and sideloaded DLL, then restrict script execution.
Kotaemon Lets Signed-In Users Read and Delete Other Users' Chats
An ownership check is missing from four multi-user chat handlers through v0.12.0. Limit account access and review cross-user conversation activity while awaiting a verified fix.
GTIG Counts 141 Exploited Flaws as CVE Disclosures Double
GTIG recorded 141 disclosed and exploited vulnerabilities through August 2026. Prioritize reachable edge systems and verify the access conditions on affected AI gateways.
CISA Flags Exploited SharePoint Code Injection for Authorized Users
Three on-premises SharePoint editions have affected build ranges. Match each server to its edition's update threshold and triage suspected compromise.
NetScaler Intruders Hide Web Shells Behind Icons and Tunnel Into Networks
Mandiant traces exploited NetScaler packet-engine crashes to disguised PHP shells and an internal proxy. Hunt the config edits and appliance egress, then patch both flaws.
ShinyHunters Bypass PeopleSoft WAF Rules and Plant Web Shells
An encoded request reaches PeopleSoft's vulnerable EMHub servlet past literal path filters. Patch PeopleTools and search every WebLogic node for encoded paths and new JSPs.
Authlib accepts unsigned JWS payloads as verified
An empty signatures array skips Authlib's verification loop. Locate callers of the JSON JWS deserializer and reject unsigned input before trusting its payload.
Check Point Management Servers Face Script-Upload Attacks
Check Point reports customer attacks through an unauthenticated management-server flaw. Match Jumbo Hotfix takes, restrict TCP/19009 and inspect CPM logs.