https://vulnerability.circl.lu/sightings/feed 2026-09-18T17:29:15.650501+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/decc8969-b43c-458d-88a9-4093a059bdb1/export 2026-09-18T17:29:15.675658+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "decc8969-b43c-458d-88a9-4093a059bdb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28197", "type": "seen", "source": "https://gist.github.com/ichintu/a37032d4209bee987101439e7254e730", "content": "This daily cybersecurity digest highlights emerging threats, critical vulnerabilities, and vendor advisories from September 2026:\n\n**Active Threats & Campaigns**\n- **Transparent Tribe (APT36):** Pakistan-linked group deploying new Rust-based backdoors targeting Indian and Afghan government/defense entities.\n- **GhostCode Phishing:** Exploits Microsoft 365\u2019s OAuth device authorization flow to capture tokens, persistently register devices via Intune/Azure AD, and maintain up to 14 days of SSO-equivalent access.\n- **Teams Impersonation:** Attackers use default external chats to deliver malicious MSI files that steal passwords via fake Windows lock screens.\n\n**Critical Vulnerabilities & Advisories**\n- **AI Coding Agents:** \u201cPlugin4Shell\u201d exposes a zero-click RCE flaw in Anthropic, OpenAI, Google, and GitHub agents by bypassing Git SHA validation. Anthropic and OpenAI are patched; GitHub remains partially exposed.\n- **Network/ICS:** Moxa and Advantech issued advisories for Ethernet switches vulnerable to CVE-2026-15579 (buffer overflow causing DoS).\n- **Enterprise & Browser:** NetBackup Flex OS has a critical (9.4) privilege escalation flaw (CVE-2026-28197). Grafana OSS (v12.3.0\u201313.2.1) contains a Geomap XSS vulnerability. Google Chrome (<153.0.8010.53) requires urgent patching.\n\n**Key Defensive Actions**\nApply all vendor patches immediately, restrict device-code authentication via Conditional Access, disable default Teams external chats for non-essential users, and monitor AI agent plugin installations alongside EDR/CI-CD logs for anomalous activity.", "creation_timestamp": "2026-09-18T16:02:06.659549Z"} 2026-09-18T16:02:06.659549+00:00 https://vulnerability.circl.lu/sighting/8f2f8bc4-af86-4422-96f1-166cfe82f1f0/export 2026-09-18T17:29:15.678907+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8f2f8bc4-af86-4422-96f1-166cfe82f1f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28197", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvsdpnhiz72f", "content": "\ud83d\udea8 CVE-2026-28197 \u2014 CVSS 9.4 CRITICAL\n\nAn authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-28197\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-18T14:07:21.521157Z"} 2026-09-18T14:07:21.521157+00:00 https://vulnerability.circl.lu/sighting/0fce22a8-ba12-4db9-9dbf-c165a18fe59a/export 2026-09-18T17:29:15.679051+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0fce22a8-ba12-4db9-9dbf-c165a18fe59a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28197", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvsdk7uzgp2w", "content": "\ud83d\udfe0 CVE-2026-28197 - High (8.8)\n\nAn authenticated, low-privileged user with access to the NetBackup Flex \nOS management shell coul...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28197/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-18T14:04:19.473064Z"} 2026-09-18T14:04:19.473064+00:00 https://vulnerability.circl.lu/sighting/0fa63aaf-3fc4-4126-8992-7883cdc25833/export 2026-09-18T17:29:15.679172+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0fa63aaf-3fc4-4126-8992-7883cdc25833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28197", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvsb34i7ml2g", "content": "CVE-2026-28197 - netbackup flex os\nA user with limited rights on the NetBackup Flex OS management console can enter specially crafted input that tricks a privileged command into running with full system rights. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cohesity #CVE #infosec", "creation_timestamp": "2026-09-18T13:20:05.093983Z"} 2026-09-18T13:20:05.093983+00:00