cybr.cx Daily Digest — August 16, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-72898 | Metabase | CVSS: N/A (KEV listed)
An unauthenticated SQL injection vulnerability in Metabase allows remote attackers to inject arbitrary SQL directly into the application database, escalating to full administrator access. From there, attackers can alter configuration, exfiltrate stored credentials, and pivot further. CISA's patch deadline was August 14 — if you're running Metabase and haven't patched, assume you're already a target. Isolate instances immediately.

⚠️ Actively exploited — CVE-2026-20349 | Cisco ASA / FTD | CVSS: N/A (KEV listed)
A heap inspection flaw in Cisco's Secure Firewall ASA and Firewall Threat Defense (FTD) allows unauthenticated remote attackers to trigger unexpected device reloads, causing denial of service. The CISA remediation deadline has already passed (August 14). Any perimeter firewall that goes down on demand is a serious availability and exposure risk — treat this as a priority even if DoS sounds mild.

⚠️ Actively exploited — CVE-2026-68820 | Windows WinSock AFD Driver | CVSS: N/A (KEV listed)
A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock enables local privilege escalation. In practice, this pairs well with any initial foothold — expect to see it chained in post-exploitation toolkits. CISA's deadline is August 25, but given active exploitation, patch ahead of schedule.

CVE-2026-73682 | Semaphore CI/CD (< 2.18.20) | CVSS: 8.8
An argument injection flaw in Semaphore's git URL handling lets any authenticated Manager or Owner role user execute arbitrary shell commands on the host server by crafting a malicious git_url value exploiting Git's --upload-pack= option. In CI/CD environments, this effectively means full server compromise. Upgrade to 2.18.20 immediately and audit recent project configurations for tampered git URLs.

CVE-2026-18438 | Templately WordPress Plugin (≤ 3.7.1) | CVSS: 8.8
Remote code execution via the fetch_remote_file function, where file type validation is applied against attacker-controlled Content-Type headers rather than the final filename. An authenticated attacker can upload a malicious file and achieve code execution on the server. Disable or update the plugin now — the Elementor/Gutenberg template library ecosystem is a perennially attractive attack surface.

CVE-2026-73683 | Laravel Socialite Facebook Provider | CVSS: 8.1
The Facebook OIDC provider in Laravel Socialite skips nonce validation in getUserByOIDCToken(), meaning a captured valid id_token can be replayed by an unauthenticated attacker to authenticate as another user. Any application using Facebook login via this provider is potentially exposed to account takeover. Review token validation logic and apply patches or implement nonce checks manually.

CVE-2026-19900 | LB-LINK X-PRO Router (1.0.22) | CVSS: 8.1
Hard-coded credentials in /etc/shadow on this router firmware are remotely exploitable, though the attack complexity is rated high. A working exploit is already publicly available. These devices are unlikely to receive vendor patches — if you have them on your network, segment or replace them.

Headline News

macOS Screen Sharing Exploit Delivers Crypto Miners in Under Four Hours

Attackers are actively exploiting CVE-2026-65400, a privilege escalation flaw in macOS Screen Sharing, to obtain root access on exposed Macs and install Monero cryptocurrency miners. What makes this especially concerning is the speed of weaponisation: a functional exploit was reportedly reverse-engineered from Apple's own patch in approximately four hours, meaning the window between fix release and active attacks was negligible. Any macOS system with Screen Sharing enabled and exposed to the internet — or reachable via lateral movement — should be considered at risk until patched. macOS endpoints are increasingly appearing in enterprise environments, and this incident is a sharp reminder that "it's a Mac" is not a security posture. Patch, disable unused remote access services, and check for unexpected outbound connections to Monero mining pools.

U.S. Government Authorises Private Sector Offensive Cyber Operations

A new executive order authorises private companies to conduct offensive cyberattacks against foreign criminal networks on behalf of the U.S. government — a significant doctrinal shift in how cyber operations are sanctioned and executed. For security practitioners, this raises immediate questions about rules of engagement, liability, attribution hygiene, and the risk of escalation when commercial entities operate in spaces previously reserved for intelligence agencies. The practical effect could concentrate offensive capabilities in a handful of large contractors with existing government relationships, while also dramatically expanding the legal surface area for what constitutes a "permitted" cyberattack. Defenders should expect increased noise in threat intelligence as the line between state-sponsored and commercially-executed operations becomes deliberately blurred. Incident responders attributing attacks to nation-state actors will need to account for this new category of authorised-but-commercial operators.

Cheap Android TV Boxes Caught Committing Ad Fraud and Proxying Traffic

Researchers at Bitsight have identified a cluster of low-cost H96 Android TV boxes that are silently performing click fraud — secretly clicking ads in the background — while also routing third-party internet traffic through the owners' home networks, effectively turning them into unwitting residential proxies. These devices, sold cheaply through major online marketplaces, ship with firmware that includes the malicious functionality baked in at manufacture, making it difficult to detect or remediate without replacing the hardware entirely. For enterprise security teams, the residential proxy angle is the more significant concern: traffic originating from these IPs looks indistinguishable from legitimate home users, providing threat actors with highly credible cover for credential stuffing, scraping, and other attacks. This is a hardware supply chain problem without an easy software fix.

Schrödinger's Feed

Quantum Teleportation Is Not What You Think — And That's What Makes It Useful

Quantum teleportation — the transfer of quantum states between particles without moving the particles themselves — remains one of the most misunderstood phenomena in the field, and a new discussion from quantum investment and research circles is pushing back on the Star Trek-flavoured misconceptions. The actual mechanism, transferring quantum state information rather than matter, is precisely what makes it valuable for quantum key distribution and future quantum networking, where it could enable inherently eavesdrop-resistant communication channels. As post-quantum cryptography standardisation matures on the classical side, quantum communication infrastructure is quietly advancing in parallel, representing a longer-horizon but potentially more disruptive shift. Practitioners building cryptographic strategy for 10-year horizons should be watching both tracks simultaneously — PQC for now, quantum networking for what comes after.

/dev/random

AI Is Beating Mathematicians at Competition Problems by Knowing More Problems

A pointed analysis making the rounds argues that frontier AI models aren't succeeding at elite mathematics by reasoning more deeply than human mathematicians — they're succeeding by having seen, during training, an enormous volume of competition problems, proofs, and solution patterns that no human could memorise. The implication is that benchmark performance on mathematical olympiad problems may be measuring recall and interpolation more than novel reasoning, which matters quite a bit if you're using these benchmarks to evaluate general problem-solving capability. For security researchers considering AI-assisted vulnerability research, this is worth sitting with: a model that pattern-matches from training data will shine on known vulnerability classes and struggle precisely where novelty matters most — which is, unfortunately, where the interesting bugs live.