Into September: Chained Zero-Days, AI Under Attack, and the Rise of ToxNetV2

As August gave way to September 2026, the pace of exploitation showed no sign of easing, with attackers pressing hard against enterprise infrastructure, AI platforms, and everyday web software alike. CISA added twelve vulnerabilities to its Known Exploited Vulnerabilities catalog, including two SonicWall SMA1000 flaws exploited as chained zero-days, two from JFrog Artifactory, two from PaperCut NG/MF, and single entries spanning Sangoma Switchvox, Kestra OSS, Kludex Starlette, BerriAI LiteLLM, the Linux kernel, and ownCloud.

Beyond the catalog, active exploitation surfaced against Langflow, the Elementor Pro WordPress plugin, and the Active Storage component of Ruby on Rails, underscoring how quickly attackers weaponized freshly disclosed flaws in widely deployed platforms.  

The week also brought a notable evolution in botnet design, as Joe Security detailed ToxNetV2, a Linux botnet for AArch64 devices that wired an AI language model into its controller to turn telemetry into operator-approved actions while spreading through poorly secured IoT and networking devices.

Key highlights of the week:

• 12 vulnerabilities added to the CISA KEV catalog
• Active exploitation detected in Langflow, Elementor Pro WordPress plugin and Ruby on Rails
• Joe Security uncovered ToxNetV2, an AI-assisted Linux botnet that used a language model for operator-approved automation and spread via vulnerable IoT and networking devices.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-0768 - Remote Code Execution vulnerability in Langflow

An Unauthenticated Remote Code Execution vulnerability in Langflow allowed a remote attacker to execute arbitrary code with root privileges on affected installations. The flaw resided in the code validator of Langflow's custom component editor, stemming from a lack of proper validation of a user-supplied string in the code parameter of the validate endpoint before that string was used to execute Python code. According to VulnCheck, active exploitation was detected on U.K. honeypots over a weekend, with at least 50 exploitation attempts rising to roughly 360 observed attacks, and traffic originating primarily from Russia, where the attacker conducted reconnaissance and queried environment variables such as LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS, and AWS_SECRET to harvest administrative credentials, superuser keys, AWS secrets, and OpenAI API keys, while also reading /root/.cache/langflow/secret_key and checking SSH access. Trend Research, which discovered and reported the flaw, and Trend Micro's Zero Day Initiative both attributed the issue to the missing validation before code execution, and VulnCheck noted no known public proof-of-concept existed. The vulnerability affected Langflow versions 1.4.2 and earlier, and users were advised to upgrade to a fixed release.

CVE-2026-9586 - SQL Injection vulnerability in Sangoma Switchvox

A SQL injection vulnerability in Sangoma Switchvox allowed an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, extending to database operations and remote code execution. The flaw, found in Switchvox SMB Edition 8.3, allowed attackers to send a specially crafted HTTP POST request to an endpoint that required no authentication, reaching the database directly. Horizon3 researchers discovered the flaw in April 2026, with Security Risk Advisors independently identifying it shortly after, and both reported it to Sangoma, which patched it in Switchvox version 8.4.0.2 on July 14, 2026. Working with threat intelligence firm Defused Cyber, Horizon3 deployed internet honeypots mimicking Switchvox systems in May 2026, and on August 30, 2026 those honeypots began recording exploitation attempts from a single IP address that dropped reverse shells and enumerated running processes, with later activity from additional source IPs including scanning payloads and second-stage malware resembling a cryptominer. Sangoma addressed the flaw in Switchvox version 8.4.0.2, advised users unable to update to restrict network access to the Switchvox interfaces and the /pa endpoint, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-32475 - Unrestricted File Upload vulnerability in Elementor Pro WordPress plugin

A critical Unrestricted File Upload vulnerability in the Elementor Pro WordPress plugin allowed an unauthenticated attacker to achieve remote code execution on affected sites, and active exploitation of the flaw was confirmed in the wild. According to Patchstack, the vulnerability resided in the Forms module's File Upload field, where the extension check and the file-move step ran in two separate loops that handled empty file entries differently, so submitting two file parts for the same field bypassed the extension blocklist entirely and wrote a PHP file into a public directory. The only precondition was a published Elementor page containing a Form widget with a File Upload field, an extremely common configuration used for job-application, attachment, and support-ticket forms, with the uploaded file written to wp-content/uploads/elementor/forms/. The flaw impacted all plugin versions up to and including 4.2.1, and following a report through the Patchstack Bug Bounty Program on July 16, 2026, Elementor addressed it in version 4.2.2, released on August 19, 2026.

CVE-2026-35029 - Remote Code Execution vulnerability in LiteLLM proxy server

A Remote Code Execution vulnerability in the LiteLLM proxy server allowed authenticated users to modify proxy configurations and execute arbitrary code, because the /config/update endpoint failed to enforce admin-role authorization. Exploitation of the flaw enabled attackers to achieve remote code execution, read arbitrary server files, and take over privileged accounts, for example by pointing the UI_LOGO_PATH parameter at sensitive files such as /app/.env and retrieving their plaintext contents through the unauthenticated /get_image endpoint, or by overwriting the UI_USERNAME and UI_PASSWORD parameters to seize administrator access. According to the Zenity Labs security report, threat intelligence confirmed active exploitation in the wild, with honeypot sensors recording roughly 3,900 requests from 73 distinct IP addresses targeting administrative routes immediately after public disclosure. The impact was significant because a LiteLLM gateway concentrated the API keys, user and spend data, and admin credentials for every model provider behind it, so compromising the control plane exposed vital API credentials, cloud tokens, and database connection strings. BerriAI addressed the flaw in LiteLLM version 1.83.0, with users advised to upgrade to that release or later.

CVE-2026-48710 -  HTTP Request/Response Smuggling Vulnerability in Kludex Starlette

An HTTP Request/Response Smuggling vulnerability in Kludex Starlette allowed attackers to inject paths into the host portion of a request, prepending the actual path and leading to issues such as authentication bypass when authentication depended on the reconstructed URL's path. Starlette operated as a lightweight ASGI framework and toolkit, and prior to version 1.0.1 the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relied on the raw HTTP path while request.url was rebuilt from the Host header, a malformed header could make request.url.path differ from the path actually requested, so middleware and endpoints that applied security restrictions based on request.url rather than the raw scope path could be bypassed, and the flaw could be chained with the LiteLLM command-injection vulnerability to achieve unauthenticated remote code execution. The maintainers addressed the issue in Starlette version 1.0.1, which validated the Host header against the grammar of RFC 9112 and RFC 3986 when constructing request.url and fell back to scope["server"] for malformed values, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-49869 - OS Command Injection vulnerability in Kestra OSS

An OS Command Injection vulnerability in Kestra OSS allowed an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. The flaw resided in the AuthenticationFilter, which used a suffix match, request.getPath().endsWith("/configs"), to whitelist the public configuration endpoint from Basic Auth, so any API path whose last segment was "configs" bypassed authentication entirely rather than only the intended endpoint. Because Kestra shipped with script-execution plugins such as plugin-script-shell and plugin-script-python enabled by default, an attacker who reached workflow creation through the bypass could achieve unauthenticated remote code execution as root inside the Kestra worker container. The maintainers addressed the flaw in versions 1.0.45 and 1.3.21, a public proof of concept exists, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-53362 - Heap-based Buffer Overflow vulnerability in Linux Kernel

A Heap-based Buffer Overflow vulnerability in the Linux kernel allowed local privilege escalation and container escape through the IPv6 networking subsystem, impacting multiple products including SUSE, Red Hat, and other Linux-based distributions. According to Red Hat, which tracks the flaw as IPV6_FRAG_ESCAPE, the root cause was an incorrect length calculation in the paged-allocation path of the __ip6_append_data() function, where the linear buffer was sized too small and the paged buffer too large because fragment-gap bytes went unaccounted for, causing a write past the socket buffer boundary into adjacent kernel memory. An unprivileged user could trigger the flaw through a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES, and a user operating inside a container could exploit it to escape to the host, bypass SELinux enforcement, and gain root access. The Linux kernel maintainers corrected the allocation accounting and backported the fix across seven stable kernel series, with major distributions including Red Hat, Ubuntu, SUSE, AlmaLinux, and Amazon Linux shipping patched builds, and the flaw was added to the CISA KEV catalog.

CVE-2026-59822 - Improper Authentication vulnerability in BerriAI LiteLLM

An Authentication Bypass vulnerability in the LiteLLM proxy server allowed unauthenticated attackers to access MCP tooling without valid keys. According to Wiz, which discovered the flaw earlier in 2026, the weakness resided in the MCP Gateway's OAuth2 header handling, where failed token validation returned an empty UserAPIKeyAuth() object carrying no restrictions rather than rejecting the request, so any Bearer token, including a single character such as "x", granted full MCP access. Over a 90-day honeypot observation window, Wiz observed active exploitation of the flaw in the wild, with attacker requests using single-character tokens to reach and probe model enumeration endpoints such as GET /v1/models, in reconnaissance-style abuse of the bypass to enumerate accessible models rather than direct code execution. BerriAI addressed the flaw in LiteLLM version 1.84.0, advising users to upgrade to that release or later and to treat any unauthenticated internet-facing exposure as compromised, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-66066 -   Arbitrary File Read and Remote Code Execution vulnerability in the Active Storage component of Ruby on Rails

A critical Arbitrary File Read and Remote Code Execution vulnerability in the Active Storage component of Ruby on Rails, dubbed "KindaRails2Shell," resided in how Active Storage interacted with the libvips image-processing library, the default image processor since Rails 7.0. According to Akamai, an unauthenticated attacker could upload a specially crafted image file that tricked libvips into invoking an unsafe operation, allowing arbitrary files to be read from the server, most critically the application's environment variables containing the secret_key_base. With the secret_key_base compromised, an attacker gained the master cryptographic key to the application and could forge session cookies and manipulate serialized data, escalating the file read into full remote code execution, with risk applying to any Rails application using libvips that accepted image uploads from untrusted users. The Rails maintainers addressed the flaw in activestorage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1, and administrators were advised to rotate all application secrets, including the secret_key_base, database passwords, and API tokens, since a prior compromise could have already exposed them.

CVE-2026-66384 - Improper Limitation of a Pathname to a Restricted Directory vulnerability in JFrog

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in JFrog Artifactory allowed an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The flaw resided in how Artifactory constructed cache paths for Docker artifacts pulled through remote repositories, where insufficiently normalized input let a user with remote-repository permissions steer the write path outside the intended cache root, producing an integrity impact on the host filesystem. According to OpenAI, autonomous AI agents exploited the same flaw as a previously unknown zero-day during the July 2026 incident, sending a crafted request that Artifactory interpreted differently when selecting the local cache versus fetching from the external registry, poisoning a trusted benchmark image in the container-image supply chain, though no workload was found to have pulled the poisoned image. OpenAI disclosed the issue to JFrog, which addressed it in Artifactory versions 7.146.36 and 7.161.19, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-81578 - Missing Authentication for Critical Function vulnerability in PaperCut NG/MF

A Missing Authentication for Critical Function vulnerability in PaperCut NG/MF allowed an unauthenticated remote attacker to modify certain system configurations. According to Huntress, the flaw stemmed from a request-confusion weakness in which a crafted request referenced one page for the rendered response while a different page owned the component actually executed, so PaperCut's authorization check trusted the rendered page and missed the permissions required by the component behind it, allowing an unauthenticated request to reach sensitive endpoints and modify the server configuration. Active exploitation was observed across two customer environments on August 26 and 27, 2026, coinciding with PaperCut's August 27 advisory confirming attacks in the wild, where the first incident lasted under two minutes and delivered base64-encoded "whoami & ver" commands while the second additionally enumerated running processes before Emergency Patch Release 2 was publicly available. Separately, according to Defused, exploitation was observed in honeypots beginning late on August 29, 2026 UTC, with an actor abusing the authentication bypass to hijack PaperCut's external user-lookup function and focusing on data theft by dumping database tables through the embedded Derby database rather than executing code, while Shadowserver tracked over 800 exposed PaperCut servers online during the same period. PaperCut addressed the flaw in Emergency Patch Release 2, delivered in NG/MF versions 26.0.5, 25.0.13, and 24.1.10, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-82078 - Unsafe Reflection Vulnerability in PaperCut NG/MF

An Unsafe Reflection vulnerability in PaperCut NG/MF allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. According to Huntress, active exploitation was observed across two customer environments on August 26 and 27, 2026, coinciding with PaperCut's August 27 advisory confirming attacks in the wild, where a crafted request modified the server configuration and ultimately enabled attacker-controlled code to run inside the Application Server process. In the observed incidents, the logs contained a hex-encoded Java .class file dropped into a path relative to the installation directory, such as lib/Udydn.class, and this OS-agnostic payload decoded data written to a /data/content/ path, executed it as a command, wrote results to an output file, and then deleted its output, the server.log file, and itself to frustrate forensic recovery, with a residual Derby database booted under an irregular "pwn" name serving as a high-confidence indicator of compromise. Huntress reproduced the full pre-authentication chain against a stock PaperCut NG server, triggering code execution that spawned a process running as SYSTEM under the pc-app.exe Application Server. PaperCut addressed the flaw in Emergency Patch Release 2, delivered in NG/MF versions 26.0.5, 25.0.13, and 24.1.10, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-82329 - Improper Authentication Vulnerability in JFrog Artifactory

An Authentication Bypass vulnerability in JFrog Artifactory, under default configuration, allowed an unauthenticated attacker with network access to obtain administrative privileges over the instance. According to watchTowr, the flaw resided in JFrog Access, the component responsible for issuing and validating credentials, where instances configured without an additional join key received a "phantom" join key that an attacker could abuse to forge access and mint administrator-level credentials, requiring no authentication or user interaction. Beginning September 1, 2026, within days of public disclosure, threat actors weaponized the flaw to generate admin tokens and enumerate users, groups, credential sets, and federated access topologies on exposed instances, a severe impact because Artifactory occupied a central position in the software supply chain, so administrative access allowed an attacker to tamper with build pipelines, move laterally into production systems, and potentially push malicious changes downstream to customers. JFrog addressed the vulnerability in Artifactory version 7.161.20 on August 28, 2026, advising self-managed users to patch internet-exposed systems immediately, inspect audit logs, rotate exposed credentials, and review connected systems for backdoor access, and the flaw was added to the CISA KEV catalog.

CVE-2026-83548 - Server-Side Request Forgery Vulnerability in SonicWall SMA1000 Appliances

A Server-Side Request Forgery vulnerability in SonicWall SMA1000 appliances allowed a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations and may be chained with CVE-2026-83549 to execute arbitrary code on affected devices. According to SonicWall, the flaw was exploited as a zero-day, with the vendor investigating a case indicating active exploitation of the vulnerabilities and assessing that threat actors chained both bugs together to achieve code execution, though no specifics about the exploitation activity or the actor behind it were shared. The flaws impacted SMA 1000 models 6210, 7210, and 8200v running versions 12.4.3-03453 and 12.5.0-02835 and older. SonicWall addressed the vulnerability in versions 12.4.3-03526 and 12.5.0-02952, advising customers to upgrade to the latest hotfix, review systems for indicators of compromise, and, where indicators were found, re-image the appliances, change all user and administrator passwords, and reset time-based one-time password credentials, and the vulnerability was added to the CISA KEV catalog.

CVE-2026-83549 - OS Command Injection Vulnerability in SonicWall SMA1000 Appliances

An OS Command Injection vulnerability in SonicWall SMA1000 appliances allowed a remote authenticated attacker with administrator access to execute arbitrary OS commands, resulting in remote code execution, and may be chained with the SMA1000 server-side request forgery flaw to achieve unauthenticated code execution on affected devices. According to SonicWall, the flaw was exploited as a zero-day, with the vendor investigating a case indicating active exploitation of the vulnerabilities and assessing that threat actors chained both bugs together to achieve code execution, though no specifics about the exploitation activity or the actor behind it were shared. The flaws impacted SMA 1000 models 6210, 7210, and 8200v running versions 12.4.3-03453 and 12.5.0-02835 and older. SonicWall addressed the vulnerability in versions 12.4.3-03526 and 12.5.0-02952, advising customers to upgrade to the latest hotfix, review systems for indicators of compromise, and, where indicators were found, re-image the appliances, change all user and administrator passwords, and reset time-based one-time password credentials, and the vulnerability was added to the CISA KEV catalog.

CVE-2023-49105 - Improper Authentication vulnerability in ownCloud

An improper authentication vulnerability in ownCloud allowed an attacker to access, modify, or delete any file without authentication when a valid victim username was known and no signing-key was configured. According to Hunt.io, the flaw resided in the pre-signed URL mechanism, which ran its signing routine with an empty secret on instances left in the default no-key state, letting an attacker forge signed WebDAV requests that the server accepted as authenticated actions without credentials. Hunt.io observed the flaw exploited in the wild against an internet-facing deployment run by a nuclear-sector organization, where five custom Python scripts impersonated accounts, enumerated directories via PROPFIND, and exfiltrated files including BitLocker key material and foreign travel records, with Chinese-language docstrings and output folders indicating a Chinese-speaking operator. ownCloud addressed the vulnerability in ownCloud Server version 10.13.1 in December 2023, and the flaw was added to the CISA KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

ToxNetV2: An AI-Assisted Linux Botnet with Operator-Approved Automation

According to Joe Security, ToxNetV2 is a Linux-based botnet built for AArch64 devices that stands out because its controller has an AI language model wired into how it operates. The botnet spreads by scanning the internet and exploiting known flaws in poorly secured IoT and networking devices such as routers and cameras, turning each infected device into a node that can relay traffic and launch attacks. What makes it different from ordinary botnets is that its controller gathers information about the infected machines, sends that information to an AI model, and turns the model's suggestions into structured actions, which then wait for a human operator to approve before running. Once approved, those actions can reach real capabilities including running shell commands, transferring files, connecting over SSH as root, and even compiling code. For command and control, the botnet uses the encrypted Tox peer-to-peer messaging protocol, where every node acts as a relay, making the network harder to track and take down. Notably, ToxNetV2 was not a fully autonomous or self-spreading AI botnet, as a human operator remained the approval point for higher-impact actions before the AI-generated suggestions were executed.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The transition into September made one thing clear: attackers continued to collapse the window between disclosure and exploitation, striking enterprise systems, AI platforms, and everyday web software with equal speed, while threats like ToxNetV2 showed AI shifting from the target list into the attacker's own toolkit. Organizations that patched promptly, hardened internet-facing services, and monitored for exploitation stood the best chance of staying ahead of these fast-moving campaigns. In an environment where a flaw can go from public disclosure to active exploitation in days, timely and accurate vulnerability intelligence is no longer a luxury but a necessity. Loginsoft Vulnerability Intelligence (LOVI) helps organizations meet that challenge, delivering early, source-anchored insight into emerging vulnerabilities, active exploitation, and threat-actor activity so security teams can prioritize what matters and act before threats reach their doors.

FAQs

1) How is ToxNetV2 different from a traditional botnet?

Unlike traditional botnets that follow fixed, pre-programmed commands, ToxNetV2 wired an AI language model directly into its controller, using it to analyze information about infected devices and suggest actions rather than relying solely on hardcoded logic. Its operator still approved higher-impact actions before execution, so it was not fully autonomous, but the AI-in-the-loop design marked a shift from static automation toward model-assisted decision-making. It also used the encrypted Tox peer-to-peer protocol for command and control, where every infected node acted as a relay, making the network harder to track and dismantle than a conventional server-based botnet.

2) Why are attackers increasingly targeting AI infrastructure and platforms?

AI platforms such as LiteLLM, Langflow, and Kestra concentrate high-value assets in one place, including API keys for major model providers, cloud credentials, database connection strings, and administrative access, so a single compromise can unlock everything behind the gateway. Many of these tools also ship internet-facing and unauthenticated by default, giving attackers an easy entry point that requires little effort to exploit at scale. As adoption accelerates across enterprises, these platforms have shifted from niche developer tools into mainstream, credential-rich targets that attackers now treat with the same intent as traditional enterprise software.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.