{"metadata": {"vulnerability": "cve-2026-89308", "count": 21, "kinds": {"milestone": 4, "sighting": 9, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-11T13:54:43.619Z", "date_only": false, "value": "2026-09-11T13:54:43.619Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-89308", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-15T08:45:06.711Z", "date_only": false, "value": "2026-09-15T08:45:06.711654Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "bb191d5f-f143-4b6b-b34d-d3ade3b83460", "url": "https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza"}, {"timestamp": "2026-09-15T11:44:00.803Z", "date_only": false, "value": "2026-09-15T11:44:00.803Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-89308", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-15T11:44:00.803Z", "date_only": false, "value": "2026-09-15T11:44:00.803Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ENISA", "record": "cve-2026-89308", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T12:00:29.082Z", "date_only": false, "value": "2026-09-15T12:00:29.082384Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvkl7ypncf24", "record": "cve-2026-89308", "field": "creation_timestamp", "uuid": "51c5d973-d4dd-4f14-8419-9820827f8e39", "content": "TREXOM TrxTimeATTENDANCE (1.0.5 \u2013 1.9.5) hit by CRITICAL OS command injection (CVE-2026-89308) in ping.php. Remote code execution risk \u2014 patch or restrict access now. https://radar.offseq.com/threat/cve-2026-89308-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mvkl7ypncf24"}, {"timestamp": "2026-09-15T12:17:53Z", "date_only": false, "value": "2026-09-15T12:17:53Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CGGC-5XPH-QVW8", "record": "GHSA-CGGC-5XPH-QVW8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-15T12:17:53.603Z", "date_only": false, "value": "2026-09-15T12:17:53.603", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89308", "record": "FKIE_CVE-2026-89308", "field": "published"}, {"timestamp": "2026-09-15T12:30:47.734Z", "date_only": false, "value": "2026-09-15T12:30:47.734324Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-89308", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-15T12:30:47.734Z", "date_only": false, "value": "2026-09-15T12:30:47.734324Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89308", "record": "FKIE_CVE-2026-89308", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-15T12:30:57.222Z", "date_only": false, "value": "2026-09-15T12:30:57.222Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-89308", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-15T12:30:57.222Z", "date_only": false, "value": "2026-09-15T12:30:57.222Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-89308", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T12:31:47Z", "date_only": false, "value": "2026-09-15T12:31:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CGGC-5XPH-QVW8", "record": "GHSA-CGGC-5XPH-QVW8", "field": "published"}, {"timestamp": "2026-09-15T12:31:47Z", "date_only": false, "value": "2026-09-15T12:31:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CGGC-5XPH-QVW8", "record": "GHSA-CGGC-5XPH-QVW8", "field": "modified"}, {"timestamp": "2026-09-15T13:38:12.365Z", "date_only": false, "value": "2026-09-15T13:38:12.365509Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/a3dhkf6udpg5f", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "c45e4968-d3db-4a76-b232-64c758b8dc58", "content": "CVE-2026-89308 - Arbitrary command execution in TrxTimeATTENDANCE\nCVE ID : CVE-2026-89308\n \n Published : Sept. 15, 2026, 11:44 a.m. | 31\u00a0minutes ago\n \n Description : An unauthenticated OS command injection vulnerability exists in the\u00a0ping.php\u00a0endpoint, allowing remote attacker...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/a3dhkf6udpg5f"}, {"timestamp": "2026-09-15T14:08:03.277Z", "date_only": false, "value": "2026-09-15T14:08:03.277863Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvkse4optz2g", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "d77660e8-6b10-41a4-9e06-387a8d7004b9", "content": "\ud83d\udea8 CVE-2026-89308 \u2014 CVSS 9.3 CRITICAL\n\nAn unauthenticated OS command injection vulnerability exists in the\u00a0ping.php\u00a0endpoint, allowing remote atta...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89308\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mvkse4optz2g"}, {"timestamp": "2026-09-15T16:01:41.089Z", "date_only": false, "value": "2026-09-15T16:01:41.089412Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/6579574f2d6f7759d85ca961b532236a", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "9888739e-40fe-4dbe-9595-8e8a11cee84c", "content": "This cybersecurity briefing highlights three primary trends:\n\n\u2022 **AI & Agent Security:** New platforms (ELITZE, Exaforce) focus on governing AI agent identities, permissions, and runtime access. Researchers also demonstrate OpenAI Codex sandbox escapes and note AI-accelerated exploitation (e.g., Marimo RCE compromising an SSH bastion in seconds).\n\u2022 **Active Threats & Vulnerabilities:** Attackers are mass-scanning exposed Vite development servers to harvest cloud credentials (exploiting CVE-2026-39364). Critical unauthenticated flaws were disclosed for TrxTimeATTENDANCE (RCE, CVE-2026-89308) and OpenAM (SOAP auth bypass, CVE-2026-45052). Additionally, the BambooToken malware continues targeting Windows/Linux systems via MQTT.\n\u2022 **Community & Tools:** Practitioners are sharing practical resources, including a verification tool for leaked cloud secrets and a low-cost guide to entering the EMFI hacking competition.\n\n**Overall:** The threat landscape is increasingly defined by AI workload governance challenges, automated credential harvesting from misconfigured dev servers, and rapidly exploited critical vulnerabilities.", "url": "https://gist.github.com/ichintu/6579574f2d6f7759d85ca961b532236a"}, {"timestamp": "2026-09-15T17:20:04.708Z", "date_only": false, "value": "2026-09-15T17:20:04.708624Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl53icxhn2t", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "0a2d8a68-cfea-4232-846a-4f046b20005b", "content": "CVE-2026-89308 - trxtimeattendance\nThe ping.php page in TrxTimeAttendance can be accessed without a login, letting anyone send commands that the server will execute. This could give a remote\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#trxtimeattendance #trexom #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl53icxhn2t"}, {"timestamp": "2026-09-16T11:39:39.766Z", "date_only": false, "value": "2026-09-16T11:39:39.766505Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mvn2jpabty2g", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "73a2c0e5-6f44-4e30-868b-8aa2652b9f07", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-89308\n\nAn unauthenticated OS command injection vulnerability exists in the\u00a0ping.php\u00a0endpoint, allowing remote attackers to execute arbitrary commands on t...", "url": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mvn2jpabty2g"}, {"timestamp": "2026-09-18T04:00:13.705Z", "date_only": false, "value": "2026-09-18T04:00:13.705738Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "60ba69d5-561c-4c56-946e-7ff8f8f7d119"}, {"timestamp": "2026-09-18T19:24:36.593Z", "date_only": false, "value": "2026-09-18T19:24:36.593", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89308", "record": "FKIE_CVE-2026-89308", "field": "lastModified"}, {"timestamp": "2026-09-19T00:00:13.510Z", "date_only": false, "value": "2026-09-19T00:00:13.510280Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "record": "CVE-2026-89308", "field": "creation_timestamp", "uuid": "1500f96f-959f-4a1d-85dd-d2c2884bfa55"}]}