Loki Intelligence — Security Briefs · Published
Daily Security Brief: Exploited PBX, Pixel, Cisco ISE, and Web Plugin Flaws
Attackers are exploiting a wide spread of systems, from telephony and identity infrastructure to mobile modems, hosting plugins, and API gateways, often through hard-coded secrets or weak token validation. Teams should prioritize the new KEV entries, patch exposed PBX, WordPress, and API management platforms, and hunt for forged tokens and web shells.
Signal 01 · The Hacker News
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
VulnCheck reports active exploitation of CVE-2026-89026 in Issabel Framework, the web layer of the Issabel PBX platform, which shipped an identical hard-coded JWT signing key in every installation. Forged tokens let unauthenticated attackers trigger OS command execution; an August patch moves the key into local configuration.
Why it matters: Apply the Issabel fix, keep PBX management APIs off the internet, and review systems for unexpected commands run under the Asterisk user.
Source: The Hacker News
Signal 02 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-58704, an improper authorization flaw in Google Pixel devices, to its KEV catalog based on evidence of active exploitation. The catalog describes a logic error in the cellular modem that can let an attacker bypass permission checks and escalate privileges.
Why it matters: Mobile device management teams should enforce the latest Pixel security patch level and flag managed devices that have not yet updated.
Source: CISA
Signal 03 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited flaws to KEV: CVE-2026-76460, an incorrect use of privileged APIs in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions issue in the Acronis Backup plugin for cPanel & WHM and its Plesk extension that enables privilege escalation.
Why it matters: Prioritize ISE upgrades and restrict its management access to trusted networks, and update Acronis hosting plugins on shared servers where local users could escalate.
Source: CISA
Signal 04 · The Hacker News
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Google's September Pixel update fixes CVE-2026-58704, a high-severity cellular modem logic error that can allow proximal privilege escalation without user interaction, and Google says it may be under limited, targeted exploitation. The release addresses 109 other flaws, all resolved by patch level 2026-09-05 or later.
Why it matters: Push the update to Pixel fleets quickly, since a zero-click modem flaw bypasses user-awareness defenses, and watch MDM compliance reports for lagging devices.
Source: The Hacker News
Signal 05 · The Hacker News
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis says CVE-2026-87886, a local privilege escalation caused by insecure file permissions in its Backup plugin for cPanel & WHM and its Plesk extension on Linux, has been exploited in limited, targeted attacks. Fixed builds are available, and few other details about the activity have been released.
Why it matters: Hosting providers should update the plugin immediately, limit shell access for low-privileged accounts, and check servers for unexpected root-level changes.
Source: The Hacker News
Signal 06 · The Hacker News
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Wordfence reports exploitation of CVE-2026-27540 (CVSS 9.8) in the premium WooCommerce Wholesale Lead Capture plugin, where missing file-type checks let unauthenticated attackers upload PHP web shells; it has blocked over 100,000 attempts since June. Wordfence also detailed two critical unauthenticated RCE chains in The Events Calendar plugin.
Why it matters: Update affected plugins, search uploads directories for unexpected PHP files, and review admin-ajax requests that target the vulnerable upload action.
Source: The Hacker News
Signal 07 · The Hacker News
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
watchTowr's honeypots captured exploitation attempts against CVE-2026-5430 in WSO2 API Manager and related gateway products, which accept JWTs signed with unsupported algorithms, enabling forged administrator tokens. Fixes have been available since a May advisory, and successful access could expose API credentials, consumer keys, and traffic to internal services.
Why it matters: Apply WSO2 updates now, rotate application keys and secrets where exposure is possible, and alert on admin-level tokens that did not come from your identity provider.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.