{"vulnerability": "CVE-2026-89308", "sightings": [{"uuid": "bb191d5f-f143-4b6b-b34d-d3ade3b83460", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-89308", "type": "seen", "source": "https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza", "content": "", "creation_timestamp": "2026-09-15T08:45:06.711654Z"}, {"uuid": "51c5d973-d4dd-4f14-8419-9820827f8e39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89308", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvkl7ypncf24", "content": "TREXOM TrxTimeATTENDANCE (1.0.5 \u2013 1.9.5) hit by CRITICAL OS command injection (CVE-2026-89308) in ping.php. Remote code execution risk \u2014 patch or restrict access now. https://radar.offseq.com/threat/cve-2026-89308-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command...", "creation_timestamp": "2026-09-15T12:00:29.082384Z"}, {"uuid": "c45e4968-d3db-4a76-b232-64c758b8dc58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89308", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/a3dhkf6udpg5f", "content": "CVE-2026-89308 - Arbitrary command execution in TrxTimeATTENDANCE\nCVE ID : CVE-2026-89308\n \n Published : Sept. 15, 2026, 11:44 a.m. | 31\u00a0minutes ago\n \n Description : An unauthenticated OS command injection vulnerability exists in the\u00a0ping.php\u00a0endpoint, allowing remote attacker...", "creation_timestamp": "2026-09-15T13:38:12.365509Z"}, {"uuid": "d77660e8-6b10-41a4-9e06-387a8d7004b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89308", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvkse4optz2g", "content": "\ud83d\udea8 CVE-2026-89308 \u2014 CVSS 9.3 CRITICAL\n\nAn unauthenticated OS command injection vulnerability exists in the\u00a0ping.php\u00a0endpoint, allowing remote atta...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89308\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T14:08:03.277863Z"}, {"uuid": "9888739e-40fe-4dbe-9595-8e8a11cee84c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89308", "type": "seen", "source": "https://gist.github.com/ichintu/6579574f2d6f7759d85ca961b532236a", "content": "This cybersecurity briefing highlights three primary trends:\n\n\u2022 **AI & Agent Security:** New platforms (ELITZE, Exaforce) focus on governing AI agent identities, permissions, and runtime access. Researchers also demonstrate OpenAI Codex sandbox escapes and note AI-accelerated exploitation (e.g., Marimo RCE compromising an SSH bastion in seconds).\n\u2022 **Active Threats & Vulnerabilities:** Attackers are mass-scanning exposed Vite development servers to harvest cloud credentials (exploiting CVE-2026-39364). Critical unauthenticated flaws were disclosed for TrxTimeATTENDANCE (RCE, CVE-2026-89308) and OpenAM (SOAP auth bypass, CVE-2026-45052). Additionally, the BambooToken malware continues targeting Windows/Linux systems via MQTT.\n\u2022 **Community & Tools:** Practitioners are sharing practical resources, including a verification tool for leaked cloud secrets and a low-cost guide to entering the EMFI hacking competition.\n\n**Overall:** The threat landscape is increasingly defined by AI workload governance challenges, automated credential harvesting from misconfigured dev servers, and rapidly exploited critical vulnerabilities.", "creation_timestamp": "2026-09-15T16:01:41.089412Z"}, {"uuid": "0a2d8a68-cfea-4232-846a-4f046b20005b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89308", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl53icxhn2t", "content": "CVE-2026-89308 - trxtimeattendance\nThe ping.php page in TrxTimeAttendance can be accessed without a login, letting anyone send commands that the server will execute. This could give a remote\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#trxtimeattendance #trexom #CVE #infosec", "creation_timestamp": "2026-09-15T17:20:04.708624Z"}]}