{"uuid": "fb85e26b-9a17-43e9-9de8-efc3a579a9a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://gist.github.com/ichintu/b3032a708e4fafadc23b436584116971", "content": "This daily threat intelligence digest highlights critical vulnerabilities, active exploits, and emerging operational challenges from September 2026. Key developments include:\n\n\u2022 **Malware & Active Exploits:** PamStealer macOS has evolved with server-side decryption and multi-layer persistence. Roundcube Webmail is under active SQL injection attacks (CVE-2026-48842), and new research details an Avast sandbox bypass.\n\u2022 **Critical Patches & Advisories:** Urgent updates are required for MikroTik RouterOS (multiple actively exploited CVEs), Linux Kernel RDMA components, ServiceNow AI Platform, and GitLab (critical patch advisory AV26-962). GitLab also faces a separate design flaw where project-scoped email tokens bypass IP restrictions, enable account-wide reuse, and risk CI/CD compromise. Additionally, Rojo\u2019s HTTP API contains a high-severity DNS rebinding vulnerability.\n\u2022 **Operational Shifts:** AI is lowering the cost of failed attack retries, enabling rapid privilege escalation attempts rather than introducing novel vectors. Meanwhile, Microsoft\u2019s release of 972 patches underscores growing patch management strain, particularly for solo administrators.\n\n**Takeaway:** Immediate patching, strict credential/token management, and SOC strategy adjustments to counter AI-driven attack persistence are prioritized across all advisories.", "creation_timestamp": "2026-09-25T16:00:46.000000Z"}