Welcome to Issue #35 of the CosmicBytez Labs Weekly Digest — your curated rundown of what mattered in cybersecurity this week.
Edge infrastructure took the brunt of it again. Cisco confirmed active exploitation of a maximum-impact zero-day in Secure Email Gateway — a single crafted email carrying malicious SQL is enough to reach root on the underlying OS, and CISA is giving federal agencies just three days to patch. Almost as severe, GitLab patched a path traversal bug that scored a perfect 10.0 on CVSS, already under active attack within a day of disclosure — a genuine supply-chain risk for anyone whose build pipeline runs through a self-managed instance.
Nation-state activity was busy too. Volexity detailed a China-linked cluster, UTA0560, chaining three separate Chrome and Windows zero-days through a hijacked university website to drop a custom backdoor called GRIMWEDGE on NGO targets — reconnaissance, kernel privilege escalation, and payload delivery in three tidy stages. Meanwhile in Thailand, researchers at Hunt.io stumbled onto an attacker's entire toolkit left exposed on the open internet: 298 files documenting how a CVE-2024-21762 FortiGate SSL-VPN exploit was used to breach ISP 3BB, plant a MeshCentral backdoor for root access across 55+ machines, and go after subscriber RADIUS credentials.
Critical infrastructure and e-commerce rounded out the week. CenterPoint Energy confirmed a breach affecting up to 7.49 million customer records after a dark-web forum post surfaced claiming the stolen database, and Wordfence says it has already blocked over 100,000 attacks against a critical arbitrary-file-upload flaw in the WooCommerce Wholesale Lead Capture plugin.
The throughline: attackers keep finding the fastest path is the one already exposed to the internet — an email parser, a commits API, a VPN appliance, a plugin upload handler. Patch cadence on internet-facing systems is doing more work than any single novel technique this week.
Top Stories
Cisco Secure Email Gateway Zero-Day Exploited to Execute Root Commands
Cisco confirmed active exploitation of CVE-2026-76461 (CVSS 9.8) in AsyncOS Software for Secure Email Gateway — insufficient validation in the email-parsing logic allows SQL injection, and a single crafted email is enough to gain root-level command execution on the underlying OS with no authentication required. Exploitation was confirmed as far back as August 2026, and CISA has added the flaw to its KEV catalog with a three-day patch deadline for federal agencies.
What to do: Patch AsyncOS to 15.5.5-0141, 16.0.4-302, or 16.5.0-780 immediately, and treat any pre-patch SEG appliance as potentially compromised — review for unfamiliar admin accounts and outbound connections from the mail-processing pipeline.
Maximum Severity GitLab Flaw Puts Supply Chains at Risk
GitLab patched CVE-2026-85706, a path traversal in the repository commits API that scores a perfect 10.0 on CVSS — an unauthenticated attacker can read arbitrary files from a vulnerable server with a single crafted HTTP request. It was already being probed and exploited in the wild within roughly a day of disclosure. Because self-managed GitLab instances typically sit at the center of a build pipeline, researchers are treating this as a direct supply-chain exposure, not just a web app bug.
What to do: Upgrade to 19.1.8, 19.2.6, or 19.3.2 now, and audit for unexpected file-read activity against CI/CD secrets and deploy credentials on any instance that was exposed before patching.
China-Linked Hackers Chain Chrome and Windows Zero-Days to Deploy GRIMWEDGE
Volexity detailed a spear-phishing campaign by China-linked cluster UTA0560, which chained three separate zero-days — two Chrome sandbox escapes (CVE-2026-85046, CVE-2026-87491) and a Windows ALPC privilege-escalation bug (CVE-2026-85880) — to deploy a custom JavaScript backdoor called GRIMWEDGE. The lure abused a reflected XSS bug on a legitimate U.S. university website to redirect victims without the phishing link itself looking suspicious, then ran reconnaissance, kernel privilege escalation, and payload delivery in sequence. Targets were multiple NGOs.
What to do: Keep Chrome and Windows patched aggressively — this chain only works end-to-end if all three links are unpatched — and treat unsolicited links to otherwise-trusted sites with the same scrutiny as links to unknown domains.
Thai Broadband Provider 3BB Breached via Fortinet Exploit, MeshCentral Backdoor
Researchers at Hunt.io found an attacker's entire operational toolkit exposed on the open internet — 298 files documenting a breach of 3BB (Triple T Broadband), one of Thailand's largest ISPs. The intrusion started with CVE-2024-21762, an unauthenticated RCE in FortiGate SSL-VPN, and escalated into a MeshCentral backdoor giving root access across 55+ machines, with the attacker's own notes showing subscriber RADIUS credentials as the target.
What to do: If you're still running unpatched FortiGate SSL-VPN, disabling web mode alone is not sufficient — Fortinet recommends disabling SSL-VPN entirely until patched. Hunt for MeshCentral agents you didn't deploy.
CenterPoint Energy Warns Customers of Data Breach After Dark Web Post
CenterPoint Energy, which delivers power and gas to roughly seven million metered customers across Texas, Indiana, Minnesota, and Ohio, confirmed unauthorized access to customer data through an external-facing system after a threat actor posted a claimed database of 7.49 million records on a cybercrime forum. Delivery service was not disrupted, and the company filed an 8-K with the SEC disclosing the incident.
What to do: CenterPoint customers should watch for phishing referencing account or service details, and enable any breach-notification credit monitoring the utility offers once details are finalized.
Security Corner
Notable advisories published this week:
-
CVE-2026-76461 — Critical (9.8). Cisco Secure Email Gateway SQL injection enabling root RCE, directly tied to this week's top story above.
-
CVE-2026-57123 and CVE-2026-57125 — both Critical. PraisonAI agent framework ships an MCP tools server bound to 0.0.0.0 with no auth, plus a Jobs API whose approval gate can be bypassed with a forged YAML field — together enabling unauthenticated shell access.
-
D-Link's router RCE streak continues — four more critical, unauthenticated command-injection and buffer-overflow flaws landed this week: CVE-2026-90703 and CVE-2026-90702 (DWR-M921), CVE-2026-90699 (DWR-M920), and CVE-2026-90680 (DIR-823G, CVSS 9.9) — all with public exploit code available.
-
CVE-2026-81648 — Critical (CVSS 10). CryptoPayment Gateway WordPress plugin (≤ 1.2.2) — an open AJAX endpoint lets anyone delete files, overwrite config, and steal cleartext wallet keys with zero authentication.
-
CVE-2026-13260 — High. IBM Verify Identity Access remote denial-of-service — unauthenticated requests can exhaust resources on both the 11.x and 10.x branches, container images included.
Browse the full Security Advisories archive for all active CVEs.
Quick Takes
-
WooCommerce plugin backdoored at scale — Wordfence has blocked over 100,000 attacks against a critical arbitrary-file-upload flaw in the WooCommerce Wholesale Lead Capture plugin, used to plant PHP backdoors (read more).
-
LiteSpeed flaw breaks shared-hosting isolation — A LiteSpeed Web Server Enterprise bug before v6.3.7 bypasses CageFS, letting one low-privilege hosting account seize root on shared servers (read more).
-
Human attacker beats the bots — Sysdig traced an attacker from a Marimo RCE (CVE-2026-39987) to SSH bastion access in just eight seconds of hand-built tradecraft, no AI involved (read more).
-
DDRop attack defeats confidential computing — A sub-$200 memory-bus interposer silently drops encrypted memory writes, breaking both Intel TDX and AMD SEV-SNP guarantees (read more).
-
Vite dev servers scanned for cloud secrets — A mass-scanning campaign is exploiting CVE-2026-39364 in exposed Vite dev servers to harvest AWS and Azure credentials, .env files, and Terraform state (read more).
-
HBO Max's verified Reddit account hijacked — Attackers ran 108 malicious ClickFix ads over 48 hours from the compromised account before it was reclaimed (read more).
-
Twitch extension quietly leaked OAuth tokens — "Enhanced Viewer | JeetBot," installed 30,000+ times, forwarded users' OAuth tokens to a Russian commercial bot service (read more).
-
$1M bug bounty floods Vercel with AI-found kernel flaws — A sandbox challenge paying out for Linux kernel bugs forced Vercel to automate triage after AI-assisted researchers flooded in reports (read more).
-
Ukraine names new cyber coordination chief — Zelensky appointed former police chief and interior minister Ihor Klymenko to lead the National Cybersecurity Coordination Center (read more).
-
WordPress.org auto-scans every plugin release — New automated reviews using AI and Jetpack Scan now block high-risk plugin updates before they reach distribution, no human review required (read more).
Catch up on everything else in this week's full recap.
Upcoming
Next issue (Issue #36): Watch for federal patch compliance on the Cisco Secure Email Gateway KEV deadline, and whether GitLab's CVSS-10 path traversal produces confirmed downstream supply-chain compromises now that exploit activity has been public for a week. We're also tracking whether other China-linked clusters adopt the GRIMWEDGE chain's university-site redirect trick now that it's documented.
On the Labs: Fresh advisories are landing daily in the Security archive, and the howto library continues to grow with practical hardening guides — this week's stories make a strong case for treating "internet-facing" as the highest-priority patch tier on your network, full stop.
Stay sharp. A perfect CVSS-10 score and a three-day federal patch deadline landing in the same week is a reminder that severity ratings aren't abstract — they map directly to how fast you need to move.
Issue #35 — September 15, 2026. Published weekly by CosmicBytez Labs. To receive this digest by email, subscribe here.