CosmicBytez Labs https://labs.cosmicbytez.ca IT & Cybersecurity Intelligence - News, Security Alerts, HOWTOs, and Project Guides en-ca Wed, 09 Sep 2026 15:26:36 GMT https://labs.cosmicbytez.ca/images/icon.png CosmicBytez Labs https://labs.cosmicbytez.ca <![CDATA[Adobe's September 2026 Patch Tuesday Fixes 170+ Flaws Across Experience Manager, ColdFusion & More]]> https://labs.cosmicbytez.ca/news/2026-09-09-adobe-september-2026-patch-tuesday-170-flaws https://labs.cosmicbytez.ca/news/2026-09-09-adobe-september-2026-patch-tuesday-170-flaws Wed, 09 Sep 2026 00:00:00 GMT news Adobe Patch Tuesday Experience Manager ColdFusion Campaign Classic Acrobat <![CDATA[Chainguard Surpasses 1 Billion Container Build Manifests With Factory 2.0]]> https://labs.cosmicbytez.ca/news/2026-09-09-chainguard-1-billion-container-build-manifests https://labs.cosmicbytez.ca/news/2026-09-09-chainguard-1-billion-container-build-manifests Wed, 09 Sep 2026 00:00:00 GMT news Chainguard Supply Chain Security SBOM Container Security Open Source <![CDATA[Linux Rootkit Injects Fileless PHP Web Shells Into Breached F5 BIG-IP APM Servers]]> https://labs.cosmicbytez.ca/news/2026-09-09-f5-big-ip-apm-linux-rootkit-poisonedrefresh https://labs.cosmicbytez.ca/news/2026-09-09-f5-big-ip-apm-linux-rootkit-poisonedrefresh Wed, 09 Sep 2026 00:00:00 GMT news F5 BIG-IP Rootkit Linux Fileless Malware APM <![CDATA[Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days]]> https://labs.cosmicbytez.ca/news/2026-09-09-microsoft-september-2026-patch-tuesday-974-flaws https://labs.cosmicbytez.ca/news/2026-09-09-microsoft-september-2026-patch-tuesday-974-flaws Wed, 09 Sep 2026 00:00:00 GMT news Microsoft Patch Tuesday Zero-Day Windows CISA KEV <![CDATA[CVE-2026-50093: Critical File Upload Flaw in Siemens Siveillance Control]]> https://labs.cosmicbytez.ca/security/cve-2026-50093 https://labs.cosmicbytez.ca/security/cve-2026-50093 Wed, 09 Sep 2026 00:00:00 GMT security Siemens CVE Siveillance Physical Security Unrestricted File Upload <![CDATA[CVE-2026-12645 & CVE-2026-12646: Ivanti Neurons for ITSM Missing-Authorization RCE Flaws]]> https://labs.cosmicbytez.ca/security/ivanti-neurons-itsm-missing-authorization-rce https://labs.cosmicbytez.ca/security/ivanti-neurons-itsm-missing-authorization-rce Wed, 09 Sep 2026 00:00:00 GMT security Ivanti Neurons for ITSM CVE-2026-12645 CVE-2026-12646 Missing Authorization RCE <![CDATA[Headscale: Self-Hosted Tailscale Control Server for Zero-Trust Mesh VPN]]> https://labs.cosmicbytez.ca/projects/2026-09-09-headscale-self-hosted-tailscale-control-server https://labs.cosmicbytez.ca/projects/2026-09-09-headscale-self-hosted-tailscale-control-server Wed, 09 Sep 2026 00:00:00 GMT project headscale tailscale wireguard zero-trust vpn self-hosted homelab <![CDATA[220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak]]> https://labs.cosmicbytez.ca/news/2026-09-08-220-million-traveler-records-exposed-vietnam-apis-leak https://labs.cosmicbytez.ca/news/2026-09-08-220-million-traveler-records-exposed-vietnam-apis-leak Tue, 08 Sep 2026 00:00:00 GMT news Data Breach Cloud Security Vietnam Passport Data Elasticsearch <![CDATA[Adobe Rushes Emergency Fix as Magento "StyleSmuggler" Zero-Day Backdoors Servers]]> https://labs.cosmicbytez.ca/news/2026-09-08-adobe-magento-stylesmuggler-zero-day-linux-backdoor https://labs.cosmicbytez.ca/news/2026-09-08-adobe-magento-stylesmuggler-zero-day-linux-backdoor Tue, 08 Sep 2026 00:00:00 GMT news Magento Adobe Commerce Zero-Day CVE-2026-75650 E-commerce Security Linux Backdoor <![CDATA[Chainguard Doubles Output to 1 Billion Build Manifests in Six Months]]> https://labs.cosmicbytez.ca/news/2026-09-08-chainguard-1-billion-build-manifests https://labs.cosmicbytez.ca/news/2026-09-08-chainguard-1-billion-build-manifests Tue, 08 Sep 2026 00:00:00 GMT news Chainguard Supply Chain Security Container Security DevSecOps SBOM <![CDATA[Grindr to Pay £26 Million to Settle UK Claims Over HIV Data Sharing]]> https://labs.cosmicbytez.ca/news/2026-09-08-grindr-26-million-uk-settlement-hiv-data-sharing https://labs.cosmicbytez.ca/news/2026-09-08-grindr-26-million-uk-settlement-hiv-data-sharing Tue, 08 Sep 2026 00:00:00 GMT news Data Privacy Grindr GDPR HIV Data Legal Settlement <![CDATA["Poisoned Refresh" Rootkit Injects Fileless PHP Web Shells on Breached F5 BIG-IP Devices]]> https://labs.cosmicbytez.ca/news/2026-09-08-hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit https://labs.cosmicbytez.ca/news/2026-09-08-hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit Tue, 08 Sep 2026 00:00:00 GMT news F5 BIG-IP Rootkit Linux PHP Web Shell CVE-2025-53521 <![CDATA[Scammer Behind $245 Million Crypto Heist Pleads Guilty to RICO Charges]]> https://labs.cosmicbytez.ca/news/2026-09-08-scammer-behind-245-million-crypto-heist-pleads-guilty-to-rico-charges https://labs.cosmicbytez.ca/news/2026-09-08-scammer-behind-245-million-crypto-heist-pleads-guilty-to-rico-charges Tue, 08 Sep 2026 00:00:00 GMT news Cryptocurrency RICO Social Engineering Cybercrime Guilty Plea DOJ <![CDATA[CVE-2026-18922: SASL Auth Flaw Lets Attackers Seize Directory Manager on 389 Directory Server]]> https://labs.cosmicbytez.ca/security/cve-2026-18922-389-ds-sasl-directory-manager-bypass https://labs.cosmicbytez.ca/security/cve-2026-18922-389-ds-sasl-directory-manager-bypass Tue, 08 Sep 2026 00:00:00 GMT security CVE-2026-18922 LDAP Authentication Bypass Red Hat 389 Directory Server SASL <![CDATA[CVE-2026-75650: StyleSmuggler Zero-Day Grants Unauthenticated RCE in Adobe Commerce & Magento]]> https://labs.cosmicbytez.ca/security/cve-2026-75650-adobe-commerce-magento-stylesmuggler https://labs.cosmicbytez.ca/security/cve-2026-75650-adobe-commerce-magento-stylesmuggler Tue, 08 Sep 2026 00:00:00 GMT security Adobe Commerce Magento CVE-2026-75650 StyleSmuggler RCE Zero-Day E-commerce Security <![CDATA[CVE-2026-81963: Windows Link Following Flaw Lets Local Attackers Reach SYSTEM]]> https://labs.cosmicbytez.ca/security/cve-2026-81963-microsoft-windows-link-following-vulnerability https://labs.cosmicbytez.ca/security/cve-2026-81963-microsoft-windows-link-following-vulnerability Tue, 08 Sep 2026 00:00:00 GMT security Microsoft Windows CVE-2026-81963 CISA KEV Privilege Escalation Windows Update <![CDATA[Unauthenticated SQL Injection Hits SourceCodester Online Voting System]]> https://labs.cosmicbytez.ca/security/cve-2026-86290-sourcecodester-voting-sqli https://labs.cosmicbytez.ca/security/cve-2026-86290-sourcecodester-voting-sqli Tue, 08 Sep 2026 00:00:00 GMT security CVE SQL Injection SourceCodester Web Security CVE-2026-86290 <![CDATA[Weekly Digest — Issue #34]]> https://labs.cosmicbytez.ca/newsletter/2026-09-08-weekly-digest-issue-34 https://labs.cosmicbytez.ca/newsletter/2026-09-08-weekly-digest-issue-34 Tue, 08 Sep 2026 00:00:00 GMT newsletter Newsletter Weekly Digest StyleSmuggler Magento F5 BIG-IP JetBrains Trezor MikroTik Cybersecurity <![CDATA[Adobe Commerce Zero-Day Exploited to Backdoor Online Stores]]> https://labs.cosmicbytez.ca/news/2026-09-07-adobe-commerce-stylesmuggler-zero-day https://labs.cosmicbytez.ca/news/2026-09-07-adobe-commerce-stylesmuggler-zero-day Mon, 07 Sep 2026 00:00:00 GMT news Adobe Commerce Magento Zero-Day E-Commerce Backdoor Sansec <![CDATA[JSCeal Malware Hijacks Google Sessions via Stolen Cookies]]> https://labs.cosmicbytez.ca/news/2026-09-07-jsceal-malware-google-session-hijack https://labs.cosmicbytez.ca/news/2026-09-07-jsceal-malware-google-session-hijack Mon, 07 Sep 2026 00:00:00 GMT news Malware Google Session Hijacking Cryptocurrency Malvertising JSCeal <![CDATA[N-able Patches Max-Severity N-central RCE Amid Live Attacks]]> https://labs.cosmicbytez.ca/news/2026-09-07-n-able-n-central-critical-rce-hotfix4 https://labs.cosmicbytez.ca/news/2026-09-07-n-able-n-central-critical-rce-hotfix4 Mon, 07 Sep 2026 00:00:00 GMT news N-able N-central RMM RCE CVE-2026-86218 Patch <![CDATA[Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE]]> https://labs.cosmicbytez.ca/news/2026-09-07-telerik-ui-padding-oracle-rce https://labs.cosmicbytez.ca/news/2026-09-07-telerik-ui-padding-oracle-rce Mon, 07 Sep 2026 00:00:00 GMT news Telerik RCE Padding Oracle ASP.NET Progress Software Exploit <![CDATA[Trezor Data Breach Impact Now Reaches 81,000 Customers]]> https://labs.cosmicbytez.ca/news/2026-09-07-trezor-shipmonk-breach-81000-customers https://labs.cosmicbytez.ca/news/2026-09-07-trezor-shipmonk-breach-81000-customers Mon, 07 Sep 2026 00:00:00 GMT news Trezor Data Breach Supply Chain Cryptocurrency SQL Injection ShipMonk <![CDATA[Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack, and More]]> https://labs.cosmicbytez.ca/news/2026-09-07-weekly-recap-chrome-0-day-router-hijacks-coder-supply-chain-attack-and-more https://labs.cosmicbytez.ca/news/2026-09-07-weekly-recap-chrome-0-day-router-hijacks-coder-supply-chain-attack-and-more Mon, 07 Sep 2026 00:00:00 GMT news Zero-Day Supply Chain The Hacker News Chrome MikroTik N-able Weekly Recap <![CDATA[CVE-2026-79697: Advantech WISE-6610 Unauthenticated Command Injection]]> https://labs.cosmicbytez.ca/security/advantech-wise-6610-command-injection-cve-2026-79697 https://labs.cosmicbytez.ca/security/advantech-wise-6610-command-injection-cve-2026-79697 Mon, 07 Sep 2026 00:00:00 GMT security Advantech CVE-2026-79697 Command Injection RCE ICS IIoT Critical Vulnerability <![CDATA[SQL Injection in SourceCodester Class & Exam Timetabling System]]> https://labs.cosmicbytez.ca/security/cve-2026-86208-sourcecodester-timetabling-sqli https://labs.cosmicbytez.ca/security/cve-2026-86208-sourcecodester-timetabling-sqli Mon, 07 Sep 2026 00:00:00 GMT security CVE SQL Injection SourceCodester Web Security CVE-2026-86208 <![CDATA[Second SQL Injection Hits SourceCodester Timetabling System]]> https://labs.cosmicbytez.ca/security/cve-2026-86209-sourcecodester-timetabling-sqli https://labs.cosmicbytez.ca/security/cve-2026-86209-sourcecodester-timetabling-sqli Mon, 07 Sep 2026 00:00:00 GMT security CVE SQL Injection SourceCodester Web Security CVE-2026-86209 <![CDATA[SQL Injection Hits SourceCodester Timetabling System Again]]> https://labs.cosmicbytez.ca/security/cve-2026-86220 https://labs.cosmicbytez.ca/security/cve-2026-86220 Mon, 07 Sep 2026 00:00:00 GMT security CVE SQL Injection SourceCodester Web Security CVE-2026-86220 <![CDATA[Third SourceCodester Timetabling SQLi Hits the Admin Product Form]]> https://labs.cosmicbytez.ca/security/cve-2026-86224-sourcecodester-timetabling-sqli https://labs.cosmicbytez.ca/security/cve-2026-86224-sourcecodester-timetabling-sqli Mon, 07 Sep 2026 00:00:00 GMT security CVE SQL Injection SourceCodester Web Security CVE-2026-86224 <![CDATA[Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication]]> https://labs.cosmicbytez.ca/news/2026-09-06-attackers-hijack-mikrotik-routers-through-internet-exposed-ssh-without-authentic https://labs.cosmicbytez.ca/news/2026-09-06-attackers-hijack-mikrotik-routers-through-internet-exposed-ssh-without-authentic Sun, 06 Sep 2026 00:00:00 GMT news MikroTik RouterOS SSH CERT Polska Router Security Network Security <![CDATA[Elementor Pro Flaw Exploited to Hack WordPress Sites, 190K+ Attempts Blocked]]> https://labs.cosmicbytez.ca/news/2026-09-06-elementor-pro-arbitrary-file-upload-exploited https://labs.cosmicbytez.ca/news/2026-09-06-elementor-pro-arbitrary-file-upload-exploited Sun, 06 Sep 2026 00:00:00 GMT news Elementor WordPress CVE-2026-32475 File Upload Active Exploitation <![CDATA[Critical Unauthenticated Hook Injection in ComboBlocks WordPress Plugin]]> https://labs.cosmicbytez.ca/security/cve-2024-11080-comboblocks-wordpress-hook-injection https://labs.cosmicbytez.ca/security/cve-2024-11080-comboblocks-wordpress-hook-injection Sun, 06 Sep 2026 00:00:00 GMT security CVE-2024-11080 WordPress ComboBlocks Code Injection Web Security <![CDATA[Cua Computer-Server Auth Bypass Enables Unauthenticated RCE]]> https://labs.cosmicbytez.ca/security/cve-2026-86121-cua-computer-server-auth-bypass https://labs.cosmicbytez.ca/security/cve-2026-86121-cua-computer-server-auth-bypass Sun, 06 Sep 2026 00:00:00 GMT security CVE-2026-86121 Cua AI Agents RCE Authentication Bypass Desktop Automation <![CDATA[Unauthenticated Root RCE in AutoAgent's Sandbox TCP Server]]> https://labs.cosmicbytez.ca/security/cve-2026-86124-autoagent-unauthenticated-rce https://labs.cosmicbytez.ca/security/cve-2026-86124-autoagent-unauthenticated-rce Sun, 06 Sep 2026 00:00:00 GMT security CVE-2026-86124 AutoAgent AI Agents RCE Container Security Docker <![CDATA[CVE-2026-86148: Tenda CP3 OS Command Injection via AlarmVoiceURL]]> https://labs.cosmicbytez.ca/security/cve-2026-86148 https://labs.cosmicbytez.ca/security/cve-2026-86148 Sun, 06 Sep 2026 00:00:00 GMT security Tenda CVE-2026-86148 RCE OS Command Injection IoT Security IP Camera Critical Vulnerability <![CDATA[CVE-2026-86149: Tenda CP3 OS Command Injection via NetCheckPing]]> https://labs.cosmicbytez.ca/security/cve-2026-86149 https://labs.cosmicbytez.ca/security/cve-2026-86149 Sun, 06 Sep 2026 00:00:00 GMT security Tenda CVE-2026-86149 RCE OS Command Injection IoT Security IP Camera Critical Vulnerability <![CDATA[Critical Auth Bypass in Frontend Admin Plugin Enables Full Account Takeover]]> https://labs.cosmicbytez.ca/security/frontend-admin-wordpress-auth-bypass-cve-2026-75816 https://labs.cosmicbytez.ca/security/frontend-admin-wordpress-auth-bypass-cve-2026-75816 Sun, 06 Sep 2026 00:00:00 GMT security WordPress Authentication Bypass CVE-2026-75816 Account Takeover Web Security <![CDATA[CVE-2026-16310: MemberDash WordPress Plugin Unauthenticated Account Takeover]]> https://labs.cosmicbytez.ca/security/memberdash-wordpress-idor-cve-2026-16310 https://labs.cosmicbytez.ca/security/memberdash-wordpress-idor-cve-2026-16310 Sun, 06 Sep 2026 00:00:00 GMT security WordPress CVE-2026-16310 IDOR Account Takeover Plugin Vulnerability Critical Vulnerability <![CDATA[SQL Injection in SourceCodester Online Voting System Risks Election Data]]> https://labs.cosmicbytez.ca/security/online-voting-system-sql-injection-cve-2026-86159 https://labs.cosmicbytez.ca/security/online-voting-system-sql-injection-cve-2026-86159 Sun, 06 Sep 2026 00:00:00 GMT security SQL Injection CVE-2026-86159 Web Security Election Security <![CDATA[CVE-2026-86152: Max-Severity Tenda CP3 Command Injection via AutoAddWifi]]> https://labs.cosmicbytez.ca/security/tenda-cp3-autoaddwifi-command-injection-cve-2026-86152 https://labs.cosmicbytez.ca/security/tenda-cp3-autoaddwifi-command-injection-cve-2026-86152 Sun, 06 Sep 2026 00:00:00 GMT security Tenda CVE-2026-86152 OS Command Injection IoT Security Router Vulnerability Critical Vulnerability <![CDATA[CVE-2026-86151: Tenda CP3 OS Command Injection via Network Config Handler]]> https://labs.cosmicbytez.ca/security/tenda-cp3-os-command-injection-cve-2026-86151 https://labs.cosmicbytez.ca/security/tenda-cp3-os-command-injection-cve-2026-86151 Sun, 06 Sep 2026 00:00:00 GMT security Tenda CVE-2026-86151 OS Command Injection IoT Security Router Vulnerability Critical Vulnerability <![CDATA[CVE-2026-86153: Tenda CP3 Improper Privilege Management in Redirect Service]]> https://labs.cosmicbytez.ca/security/tenda-cp3-privilege-management-cve-2026-86153 https://labs.cosmicbytez.ca/security/tenda-cp3-privilege-management-cve-2026-86153 Sun, 06 Sep 2026 00:00:00 GMT security Tenda CVE-2026-86153 Improper Privilege Management IoT Security Router Vulnerability Critical Vulnerability <![CDATA[Tenda HG10 Routers Hit By Critical Unauthenticated Buffer Overflow]]> https://labs.cosmicbytez.ca/security/tenda-hg10-buffer-overflow-cve-2026-86165 https://labs.cosmicbytez.ca/security/tenda-hg10-buffer-overflow-cve-2026-86165 Sun, 06 Sep 2026 00:00:00 GMT security Tenda Router Buffer Overflow CVE-2026-86165 IoT Security RCE <![CDATA[Tenda HG10 formgponConf Flaw Allows Unauthenticated Root Command Injection]]> https://labs.cosmicbytez.ca/security/tenda-hg10-os-command-injection-cve-2026-86167 https://labs.cosmicbytez.ca/security/tenda-hg10-os-command-injection-cve-2026-86167 Sun, 06 Sep 2026 00:00:00 GMT security Tenda Router OS Command Injection CVE-2026-86167 IoT Security RCE <![CDATA[Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials]]> https://labs.cosmicbytez.ca/news/2026-09-05-attackers-breached-jetbrains-cadence-via-unpatched-teamcity-extracting-aws-crede https://labs.cosmicbytez.ca/news/2026-09-05-attackers-breached-jetbrains-cadence-via-unpatched-teamcity-extracting-aws-crede Sat, 05 Sep 2026 00:00:00 GMT news JetBrains TeamCity Data Breach AWS Supply Chain CI/CD Security <![CDATA[Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code]]> https://labs.cosmicbytez.ca/news/2026-09-05-critical-vmware-workstation-and-fusion-flaw-lets-vm-admins-execute-host-code https://labs.cosmicbytez.ca/news/2026-09-05-critical-vmware-workstation-and-fusion-flaw-lets-vm-admins-execute-host-code Sat, 05 Sep 2026 00:00:00 GMT news VMware Broadcom VM Escape CVE-2026-59346 CVE-2026-59347 Virtualization Security <![CDATA[In Other News: Microsoft's Cloud Patches, Hacked Dropbox Accounts, Guardio's $1.1B Valuation]]> https://labs.cosmicbytez.ca/news/2026-09-05-in-other-news-microsofts-cloud-patches-hacked-dropbox-accounts-guardios-11b-valu https://labs.cosmicbytez.ca/news/2026-09-05-in-other-news-microsofts-cloud-patches-hacked-dropbox-accounts-guardios-11b-valu Sat, 05 Sep 2026 00:00:00 GMT news Microsoft Dropbox Guardio Weekly Roundup Cloud Security <![CDATA[OpenAI Admits It Didn't Disclose Rogue AI Wiki Hijacking Incident]]> https://labs.cosmicbytez.ca/news/2026-09-05-openai-admits-it-didnt-disclose-rogue-ai-wiki-hijacking-incident https://labs.cosmicbytez.ca/news/2026-09-05-openai-admits-it-didnt-disclose-rogue-ai-wiki-hijacking-incident Sat, 05 Sep 2026 00:00:00 GMT news OpenAI AI Safety AI Agents Disclosure Misalignment <![CDATA[5,400+ Hacked Sites Serve ClickFix Payloads Stored on the Blockchain]]> https://labs.cosmicbytez.ca/news/2026-09-05-over-5400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain https://labs.cosmicbytez.ca/news/2026-09-05-over-5400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain Sat, 05 Sep 2026 00:00:00 GMT news ClickFix EtherHiding Blockchain WordPress PrestaShop Malware Web Security <![CDATA[Phishing Campaign Used Invisible Unicode Tag Characters to Slip Past Filters]]> https://labs.cosmicbytez.ca/news/2026-09-05-phishing-invisible-unicode-tag-characters https://labs.cosmicbytez.ca/news/2026-09-05-phishing-invisible-unicode-tag-characters Sat, 05 Sep 2026 00:00:00 GMT news Phishing Microsoft Unicode Email Security Social Engineering