09/16/2026-09/23/2026 Critical Next.js ImageResponse Flaw; Malicious npm Package Poses as Twilio Bug-Bounty Probe; Docker Sandboxes Vulnerabilities And More.

1. Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

A critical Next.js flaw (CVE-2026-94545, CVSS 9.5) in ImageResponse – used for Open Graph/social preview images – can let attackers run code on the server. It hits apps that pass attacker-controlled values (e. g., request URL text) into SVG content, attributes, or styles during image generation, since ImageResponse builds images via Vercel’s Satori library, which failed to properly escape such values.

Affected: Next.js 16.2.0–16.3.5 on the Node.js runtime (default); the Edge runtime and Next.js 15 are unaffected. Fixed in 16.3.6 (npm install [email protected]); no patch exists yet for the 16.2 line. Next.js 15.5.26 adds hardening to next/og. If upgrading isn’t possible, keep attacker-controlled values out of SVG rendered by ImageResponse.

To check exposure, look for ImageResponse imported from next/og in route handlers and opengraph-image files. No public exploits or attacks were reported as of September 23. Satori itself is fixed in 0.33.5 for direct users.

2. Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

A malicious npm package, “tw-pkgprobe-7731,” posed as an authorized Twilio bug-bounty research tool while harvesting sensitive data. Published in 11 versions over ~45 minutes in mid-August 2026 by the now-deleted account “twdepprobe7731,” it only activates inside Twilio developer environments, then exfiltrates env variables, mounts, and configs via webhook.

Later versions (1.0.1–1.0.3) targeted specific Twilio account SIDs and injected a PoC package into node_modules when matches were found. Version 1.0.4 added theft of ACCOUNT_SID and AUTH_TOKEN, compromising Twilio credentials outright. The final three versions reverted to basic, non-malicious probing but added OSINT scanning of internal Twilio hosts and AWS metadata endpoints.

ReversingLabs says the package violated Twilio’s HackerOne guidelines, and the lack of obfuscation or typosquatting suggests a less sophisticated actor. Developers integrating Twilio should audit dependencies for this package and rotate any exposed credentials.

3. TanStack NPM Supply Chain Attack Exposes 170 Private CrowdSec GitHub Repositories

CrowdSec disclosed that the May 2026 TanStack npm supply-chain attack (42 packages backdoored with Shai Hulud malware by TeamPCP/UNC6780) led to attackers cloning ~170 private CrowdSec GitHub repos on May 22, using a GitHub OAuth token from a former employee’s account that had been left active post-departure. The attacker published the archive on a breach forum September 16, including private code, SaaS components, and internal tooling.

No evidence of code changes, CI/CD tampering, or AWS infrastructure access was found. One exposed AWS SNS credential was narrowly scoped and tested but not exploited further. The leak also exposed 83 user emails (<0.05% of users) and details on 51 potential investors from 2020.

CrowdSec is deploying EDR on developer workstations and tightening GitHub monitoring, credential review, and offboarding. Developers should audit OAuth tokens for departed employees and treat TanStack packages from that period as compromised.

4. Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files 

Two Docker Sandboxes vulnerabilities let malicious guest code escape workspace isolation via symlink races—altering a validated path before the host acts on it. CVE-2026-77179 (Critical, versions 0.28.0–before 0.42.0) affects macOS’s virtio-fs host server, letting a compromised sandbox replace a directory with a symlink to read/write arbitrary host files as the VMM user, potentially leading to host code execution. CVE-2026-79994 (High, 0.37.0–before 0.42.0) affects the guest-to-host Unix socket relay, allowing redirection to unauthorized AF_UNIX sockets and potential data disclosure or access to privileged local IPC services.

Both stem from treating pathname validation as one-time rather than re-checked at use. This is especially relevant for AI-agent and dev workflows handling untrusted repos or dependencies.

Fix: upgrade to Docker Sandboxes 0.42.0+ (0.43.0 adds further hardening). If not possible, use clone mode and avoid read-write host mounts.

5. Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI

Plugin4Shell is a zero-click RCE flaw affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI, exploiting how these agents handle SHA-pinned plugin versions. Agents check out a pinned commit but never verify the working tree matches it. Attackers can create a Git branch named after the commit hash (or, for Gemini CLI, named “FETCH_HEAD”), tricking the agent into checking out malicious code while reporting a successful, “verified” install.

Because Claude Code and Codex auto-update plugins by default, no user action is needed—attackers can compromise a trusted plugin’s upstream repo after adoption. Given plugins inherit the developer’s permissions, exploitation can expose source code, cloud credentials, SSH keys, and CI/CD secrets.

Status: Fixed in Claude Code 2.1.179 and Codex 0.146.0. Gemini CLI won’t be patched (deprecated; migrate to Antigravity). Copilot remains unpatched, though GitHub blocks SHA-like branch names—self-hosted/Bitbucket marketplaces may still be exploitable. Action: update immediately, audit plugin sources, and watch for unexpected branch/ownership changes.

09/09/2026-09/16/2026 Red Heron Exploits Gitea RCE; GitLab CVE-2026-85706; CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV.

1. Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

A suspected Chinese threat actor dubbed Red Heron has rapidly exploited CVE-2026-60004, a critical Gitea RCE flaw, scanning 1,386 instances across seven countries. Within days of the July 2026 disclosure, the group turned public PoC code into an automated Python framework, progressing from source-code theft to persistent access, credential harvesting, and lateral movement — including root access to a Taiwanese Proxmox cluster.

Confirmed compromises span Canada, Argentina, Taiwan, the U.S., Qatar, and Sri Lanka, hitting defense, election, energy, aerospace, telecom, and government targets. Acronis links the group to China with moderate confidence, citing Simplified Chinese labeling and targeting patterns. A staging server revealed JITTERLY, a C++ Linux implant supporting 30+ post-exploitation commands, paired with SIXZUT, an undocumented LD_PRELOAD rootkit that hides malicious activity across 15 Linux functions. Researchers found no evidence AI was used to build the framework.

2. GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours

GitLab disclosed CVE-2026-85706 (CVSS 10.0) on September 10, 2026 — a path traversal flaw in its repository commits API that can expose SSH keys, database credentials, deploy tokens, and CI/CD variables via a single crafted request. Active exploitation began within 24 hours, and CISA has added it to its Known Exploited Vulnerabilities catalog. watchTowr researchers report in-the-wild probes already targeting the flaw and recommend patching public-facing self-hosted instances immediately or restricting access, while hunting logs for POST requests to the commits API containing “file.path” parameters.

Affected: Community and Enterprise Edition versions 18.7–19.1.8, 19.2–19.2.6, and 19.3–19.3.2. The same update also fixes CVE-2026-87719, an insecure deserialization bug exposing search configuration and credentials.

Post-patch, organizations should rotate potentially exposed credentials and check for compromise. GitLab’s CVE-2023-2825, a similar flaw, was also exploited within days — this one moved even faster.

3. CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

CISA added five actively exploited flaws to its KEV catalog, covering JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Two Artifactory bugs (CVE-2026-42016, CVE-2026-42018) are being chained with a third, previously known flaw to bypass auth and gain admin control of self-hosted servers—Wiz observed attackers creating persistent admin accounts, deploying malicious Groovy plugins, and installing Rust-based backdoors between August 15 and September 8.

A ScreenConnect flaw (CVE-2026-84869, CVSS 9.9) lets attackers transfer and execute files through active remote sessions without authorization; Huntress linked it to three incidents spreading malicious VBScript payloads. Two RouterOS flaws, dubbed “MikroTrick” by CERT Polska, allow unauthenticated attackers to seize device control.

Federal agencies must patch RouterOS by September 13, ScreenConnect by September 14, and Artifactory by September 25. Organizations running these products should update immediately given confirmed in-the-wild exploitation.

4. CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

CISA added three actively exploited flaws to its KEV catalog, giving federal agencies until September 12 to patch: CVE-2026-20079 (CVSS 10.0), a Cisco Secure FMC authentication bypass allowing root access, now linked to three post-compromise clusters deploying web shells; CVE-2026-19490 (CVSS 9.3), a Citrix NetScaler auth bypass seeing active honeypot exploitation attempts; and CVE-2025-25249 (CVSS 7.3), a Fortinet buffer overflow tied to a Russian-speaking actor’s PivotC2 campaign, which has infected 178 devices across 3,000+ targeted IPs, mostly in the US.

Cisco separately confirmed exploitation of its flaw since August, and researchers note a broader pattern of China- and Russia-linked actors using compromised edge devices—including Cisco routers—as persistent footholds for espionage and financial gain, exploiting weak monitoring on perimeter appliances.

Organizations are urged to patch immediately, rotate credentials, and hunt for indicators of compromise.

5. AI-powered Attack Exploited PaperCut Flaws To Hack 395 Organizations

A likely Russian-speaking threat actor deployed hundreds of AI agents—combining OpenAI Codex and DeepSeek with commodity offensive tools—to build and run a global exploitation campaign against PaperCut NG/MF servers, according to GreyNoise. The agents developed exploits for two actively exploited flaws, CVE-2026-81578 and CVE-2026-82078, and used the Netlas scanning platform to generate target lists.

Since starting on August 31, the campaign has compromised at least 440 instances across 395 organizations in 48 countries, harvesting credentials from 280 victims and gaining admin privileges at 12. Education was hit hardest, with the US as the top target.

GreyNoise says the speed was extreme: RCE against a real victim in under four hours from an empty workspace, and one high school compromised end-to-end in seven minutes. Post-exploitation relied on DCSync to dump full domain credential databases, using tools like Mimikatz, Certipy, BloodHound, and Impacket.

Admins should apply PaperCut’s emergency patches immediately.

09/02/2026-09/09/2026 Telerik UI Flaws Chain AES-CBC Padding Oracle, SAP Patches CVSS 10.0 Kernel Flaw, Attackers Breached JetBrains Cadence And More.

1. Telerik UI Flaws Chain AES-CBC Padding Oracle to Unauthenticated Remote Code Execution

A vulnerability chain in Telerik UI for ASP.NET AJAX turns an unauthenticated AES-CBC padding oracle into remote code execution. It affects versions 2010.1.309 through 2026.2.519; Progress Software’s 2026.2.708 (2026 Q2 SP1) fixes it.

Researcher Marcio Almeida found that RadAsyncUpload’s encrypted state fields use AES-CBC without integrity protection, letting attackers infer plaintext and forge configuration data — including overriding allowed file extensions to enable DLL uploads. RCE requires two more flaws: CVE-2026-13181, an unguarded Type.GetType call reachable via the FileUploaded handler, exploited using AssemblyInstaller as a deserialization gadget to load a malicious DLL. CVE-2026-13182 covers the core oracle; CVE-2026-13183 is a timing-based variant that persists even with hidden error messages. CVE-2026-13184 involves a predictable fallback HMAC key.

Exploitation requires a reachable RadAsyncUpload page with a non-default encryption key. Progress’s fix replaces AES-CBC with authenticated AES-GCM encryption. Admins should update immediately and check for unusual DLLs, unexpected ASPX files, and suspicious w3wp.exe activity.

2. SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP has released patches for multiple critical vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing. Tracked as CVE-2026-44756 (CVSS 10.0), this memory corruption bug – dubbed OVERPASS by discoverer Onapsis – is remotely exploitable without authentication. Attackers can execute arbitrary OS commands with SAP admin privileges, fully compromising business data and processes. The flaw stems from missing boundary validation during EPP deserialization, allowing crafted requests to trigger memory safety violations and abnormal termination.

Because EPP processing is shared kernel code, OVERPASS is reachable via web, SAP GUI, and RFC layers – none requiring credentials – so no single network control fully mitigates risk. Exploitation enables reading the SAP secure store, extracting database credentials and password hashes, accessing live session data, moving laterally, and modifying binaries.

SAP also patched CVE-2026-58240 (CVSS 9.8), named S4GET, a missing authentication check in SAP NetWeaver Message Server allowing unauthenticated remote code execution as adm. Two other critical flaws address credential disclosure in SAP CAP (CVE-2026-76969) and improper access control in SAP GUI for Java (CVE-2026-66768).

Onapsis urges immediate patching, prioritizing internet-facing systems. Notably, SAP authorizations and SoD controls offer no protection since vulnerable code runs before authentication.

3. PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover

Cyera researchers disclosed PostGREShell (CVE-2026-6471, CVSS 7.2), a 12-year-old PostgreSQL flaw affecting every version since 9.4 (2014). Missing authorization in logical decoding lets any non-superuser with REPLICATION privilege specify a full filesystem path as their output plugin, which PostgreSQL passes unvalidated to dlopen()/LoadLibrary() – executing arbitrary code as the server’s OS account.

Since replication accounts (used by backup tools, pipelines, and monitoring systems) are common and routinely granted this privilege, the bug turns a low-level account into full remote code execution across Windows, Linux, and macOS. That foothold escalates to permanent superuser access, letting attackers read every database, run OS commands, steal private keys, and plant persistent backdoors, including passwordless logins.

The flaw stems from PostgreSQL’s replication protocol accepting plugin names with slashes, path traversal, and UNC paths without validation — unlike the SQL LOAD command, which blocks this for non-superusers.

Fixed in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations should update immediately and audit which accounts hold Replication privileges.

4. Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to immediately revoke and rotate all credentials after threat actors exploited a critical TeamCity vulnerability to breach its environment. Users should treat all executions and related data as potentially untrusted.

Cadence is JetBrains’ cloud service integrated with PyCharm for running ML workloads on cloud GPUs. Attackers exploited CVE-2026-63077 (CVSS 9.8), a deserialization flaw enabling unauthenticated command execution. JetBrains discovered the breach on August 23, 2026, with intrusion occurring August 8 – 24. Threat actors accessed a 2024 Cadence server backup containing usernames, emails, IP addresses, credentials, configuration files, logs, and AWS IAM secrets. Source code synced from PyCharm projects may also have been compromised.
JetBrains has taken the affected server offline and invalidated access tokens. Users should review AWS accounts, S3 buckets, repositories, and deployments for suspicious activity. The company warned of increased phishing and social engineering risks from exposed personal data. Six IP addresses linked to exploitation were published as indicators of compromise. The incident remains under investigation with no attribution yet determined.

5. Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Attackers are actively exploiting a zero-day, dubbed StyleSmuggler, in Adobe Commerce and Magento to backdoor online stores. The flaw lets attackers inject PHP code into Magento’s template system via the “styles” properties, evading detection. The two-stage attack first injects code by generating a failure report, then executes it when Magento sends a failed-payment email — no user interaction required. It affects Magento 2.4.7, 2.4.8, and 2.4.9, including stores on the July and August 2026 patches. Successful attacks deploy a Rust-based backdoor that connects to a command-and-control server, disguising itself as processes like “kworker/u:8:0” or “fc-cache” and hiding C&C traffic as NTP replies. It exfiltrates host details, IP address, and system info.

Sansec found the campaign active from September 4. Unusual spikes in “Payment Transaction Failed Reminder” emails may signal compromise. Adobe’s Patch Tuesday fixes are set for September 8, but it’s unclear if this flaw is included.