cybr.cx Daily Digest — September 21, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2025-39964 | Linux Kernel | No CVSS published
A race condition in the AF_ALG socket interface allows concurrent writes to corrupt internal socket state. CISA added this to the KEV catalogue on September 18 with a remediation deadline of today — patch or mitigate now. Any Linux system exposing cryptographic API sockets to untrusted local users is at risk.

⚠️ Actively exploited — CVE-2026-53266 | Linux Kernel | No CVSS published
An out-of-bounds write in the ebtables SNAT target allows an ARP sender hardware address rewrite to spill into a nonlinear socket buffer fragment backed by a splice-imported file page. Exploitation in the wild is confirmed; this is a kernel-level write primitive and should be treated as critical regardless of the absent CVSS score. Prioritise patching on any host running ebtables NAT rules.

⚠️ Actively exploited — CVE-2025-39682 | Linux Kernel | No CVSS published
A flaw in the TLS receive path permits a zero-length record pulled from the rx_list to bypass record-type handling, causing subsequent TLS records to be processed under incorrect assumptions. In-the-wild exploitation is confirmed. Systems terminating kernel TLS (kTLS) connections are the primary concern.

⚠️ Actively exploited — CVE-2026-58704 | Google Pixel (cellular modem) | No CVSS published
A logic error in Pixel's cellular modem firmware allows an attacker to bypass permission checks and escalate privileges — with no user interaction required. Given the modem's privileged position below the OS, full device compromise is a realistic outcome. CISA's remediation deadline has passed; apply Google's Pixel security update immediately.

⚠️ Actively exploited — CVE-2026-76460 | Cisco Identity Services Engine | No CVSS published
An incorrect use of privileged APIs in Cisco ISE and ISE-PIC allows an unauthenticated remote attacker to bypass the web management interface and gain unauthorised access. ISE is a network access control cornerstone in many enterprise environments — compromise here means lateral movement across the entire network. Patch immediately and review access logs for anomalous authentication activity.

⚠️ Actively exploited — CVE-2026-76461 | Cisco Secure Email Gateway | No CVSS published
A SQL injection vulnerability in Cisco AsyncOS allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges. Email gateways are internet-facing by design, making this trivially reachable. Treat as critical and patch without delay.

⚠️ Actively exploited — CVE-2026-87886 | Acronis Backup (cPanel/Plesk plugin) | No CVSS published
Incorrect default permissions in the Acronis Backup plugin for cPanel & WHM and Plesk enable local privilege escalation. Backup agents typically run with elevated rights, making this a clean path to full host compromise. Check your hosting stack if Acronis Backup is installed.

CVE-2026-93993 | Mistral Vibe < 2.25.5 | CVSS 8.8
Git hooks execute before trust validation during worktree creation, allowing an attacker to supply a repository containing a crafted post-checkout hook that runs arbitrary shell commands under the current user's privileges. Any developer workflow that clones or opens untrusted repositories with Vibe is directly exposed. Update to 2.25.5 immediately and audit recent repository activity.

CVE-2026-94104 | NivoCart ≤ 2.4.0 | CVSS 8.8
The File Manager multi() endpoint fails to validate file extensions when chunks is set to 2 or higher, allowing accounts with only view-only back-office access to upload PHP webshells into the publicly accessible image/data/ directory for instant RCE. The low privilege bar required makes this especially dangerous on shared or multi-tenant installations.

CVE-2026-94109 | openEQUELLA < 2026.1.0 | CVSS 8.8
An unsandboxed FreeMarker TemplateClassResolver allows authenticated users to inject template expressions through collection summaries, dashboard portlets, or MIME templates to instantiate freemarker.template.utility.Execute and achieve RCE. Authenticated-only doesn't mean low-risk here — any legitimate user account becomes an attack vector.

CVE-2026-94106 | getID3 < 1.9.26 | CVSS 8.8
Shell-out handlers fail to escape filenames before inserting them into command strings, enabling OS command injection via crafted filenames containing shell metacharacters. Any application that processes user-supplied media files using getID3 is potentially vulnerable — a very broad attack surface given the library's widespread use.

CVE-2026-94107 | NivoCart ≤ 2.4.0 | CVSS 8.1
Password reset tokens in forgotten.php are generated using substr(md5(mt_rand()), 0, 10) — a 10-character MD5 fragment seeded from PHP's weak mt_rand(). With no rate limiting or token expiry, an attacker who knows an admin's email address can request a reset and brute-force the token offline. Administrative account takeover is the direct outcome.

Headline News

Blink Wallet Breach Drains Custodial Accounts
Blink Wallet has suspended services after an attacker successfully drained funds from custodial user accounts. The incident highlights a structural risk inherent to custodial crypto wallets: users trusting a third party with private key management are entirely dependent on that party's security posture. The breach follows a pattern of attacks against custodial infrastructure where a single compromise of the service's key management system yields access to all held funds simultaneously. For practitioners, this is a textbook case for why secrets management, HSM-backed key storage, and withdrawal anomaly detection are non-negotiable controls in any financial custody architecture.

Critical Infrastructure's Persistent Human Problem
New reporting on cyber risk to energy systems makes clear that despite growing anxiety about AI-assisted attacks, the dominant threat vector remains human: misconfigured systems, poor access controls, and inadequate incident response capability. The energy sector's operational technology (OT) environments present a uniquely difficult security surface — legacy SCADA systems not designed for network connectivity now sitting behind increasingly porous IT/OT boundaries. The framing matters for practitioners: while AI-augmented offensive tooling deserves attention, the fundamentals of OT hardening, network segmentation, and asset visibility are still where most organisations have the widest gaps. Threat actors don't need novel techniques when basic misconfigurations remain pervasive in critical infrastructure.

Schrödinger's Feed

University of Pennsylvania researchers have generated a four-qubit GHZ (Greenberger–Horne–Zeilinger) entangled state using a single gate operation on a room-temperature diamond quantum register — a significant departure from the cryogenic environments most qubit architectures require. Room-temperature operation removes one of the most significant engineering barriers to practical quantum deployment, and GHZ states are precisely the kind of maximally entangled resource that quantum key distribution and cryptographic protocols rely on. Meanwhile, IBM Research's Spacetime PEC framework is cutting error-mitigation sampling overhead by 63×, meaning fault-tolerant computation is becoming less theoretically distant and more engineering problem. Practitioners building long-horizon cryptographic infrastructure should be actively tracking these convergences — the "harvest now, decrypt later" threat calculus keeps getting shorter.

/dev/random

No dedicated weird story surfaced from the feeds today, but the CVE pile more than compensated. Honourable mention to CVE-2026-94107 in NivoCart, where the password reset "security" amounts to taking 10 characters of an MD5 hash of a value from PHP's Mersenne Twister — a PRNG whose internal state can be recovered after observing a handful of outputs. It's the kind of crypto anti-pattern that appears in "what not to do" talks at security conferences, then quietly ships in production e-commerce software anyway. Somewhere, a developer once thought substr(md5(mt_rand()), 0, 10) was "good enough." Reader, it was not.