DEV Community: BeyondMachines

CISA Reports Actively Exploited Gitea Critical RCE Vulnerability

BeyondMachines — Wed, 26 Aug 2026 17:01:20 +0000

Summary

Gitea patched a critical remote code execution vulnerability (CVE-2026-60004) that attackers are actively exploiting to install crypto-miners on self-hosted instances. The flaw allows users with write access to inject malicious Git hooks via the diffpatch API, potentially exposing database credentials and system secrets.

Take Action:

Update self-hosted Gitea instances to version 1.27.1 immediately. Now it's urgent, since hackers are actively attacking you. If you can't patch right away, disable public registration to prevent new outsiders from obtaining repository write access. This does not protect against existing users who already have the required permissions.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

LACMA Discloses Year-Old Data Breach Exposing Social Security and Medical Records

BeyondMachines — Wed, 26 Aug 2026 11:01:42 +0000

Summary

The Los Angeles County Museum of Art (LACMA) reports a data breach from July 2025 that exposed the Social Security numbers, medical records, and financial information of an undisclosed number of individuals. The museum has notified law enforcement and is offering one year of identity theft protection to those affected.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Zscaler Patches Critical Unauthenticated RCE in Client Connector for Windows

BeyondMachines — Wed, 26 Aug 2026 10:01:42 +0000

Summary

Zscaler fixed a critical vulnerability (CVE-2026-59568) that allowed unauthenticated remote code execution and privilege escalation as well as three other flaws in its Client Connector for Windows

Take Action:

If you use Zscaler Client Connector on Windows, update every endpoint to the latest patched version. Anything released before June 2026 (including 4.7.0.364, 4.8.0.232/284/291, and 4.9.0.448/455) is at risk of remote takeover. Don't assume your automated update policy reached every machine; manually verify the version on all devices. Check endpoint logs for odd processes launched by Zscaler components or unexpected new listening services.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Critical Remote Code Execution Vulnerability Discovered in JSONata Library

BeyondMachines — Wed, 26 Aug 2026 09:01:43 +0000

Summary

JSONata patched a critical vulnerability (CVE-2026-77413) that allows attackers to execute arbitrary code by exploiting a missing prototype check. The flaw enables full system takeover if an application processes malicious JSONata expressions.

Take Action:

If your applications or systems use the JSONata library, upgrade ASAP to version 1.8.8 (for 1.x) or 2.2.0 (for 2.x). Anything older can let an attacker run commands on your server. Until you can update, stop accepting JSONata expressions from users or treat any that you do accept as untrusted code.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

New Zealand Sotheby’s International Realty Investigates Third-Party CRM Data Breach

BeyondMachines — Wed, 26 Aug 2026 08:01:42 +0000

Summary

New Zealand Sotheby’s International Realty suffered a data breach after the threat actor "2019" gained unauthorized access to a third-party CRM platform, potentially exposing the contact details of thousands of clients. The company has contained the incident and is working with the NCSC and forensic experts to investigate the extent of the data exposure.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

GitPython Patches Critical RCE Vulnerability in Config Parser

BeyondMachines — Tue, 25 Aug 2026 15:01:42 +0000

Summary

GitPython version 3.1.59 patches a critical remote code execution vulnerability (CVE-2026-78676) caused by improper handling of multi-line configuration values. The flaw allows attackers to inject malicious Git directives that execute arbitrary code during routine repository operations.

Take Action:

If you use GitPython in any application or CI/CD pipeline, update it to version 3.1.59 or later. Еvery version up to 3.1.58 is vulnerable to CVE-2026-78676. Until you can update, don't let GitPython read or write config files from cloned repos, shared configs, or workspace caches you don't fully control. Тreat any repository from an outside source as untrusted.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Hackers Exploit miniOrange SAML SSO Vulnerabilities to Hijack WordPress Admin Accounts

BeyondMachines — Tue, 25 Aug 2026 14:01:42 +0000

Summary

Attackers are exploiting two vulnerabilities in the miniOrange SAML SSO plugin to bypass authentication and gain administrative access to WordPress sites.

Take Action:

If you use the miniOrange SAML 2.0 SSO plugin on WordPress, check your version manually and download the latest release from the miniOrange store right away. The plugin has flaws that are actively exploited. The dashboard won't warn you about updates if you're on a paid edition. If you can't update immediately, deactivate the plugin and review your admin login history for logins from unfamiliar IP addresses, since attackers may already have created or hijacked admin accounts.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Integrative Emergency Services Discloses Data Breach Via Unauthorized Email Access

BeyondMachines — Tue, 25 Aug 2026 13:01:17 +0000

Summary

Integrative Emergency Services suffered a data breach after attackers accessed an employee email account for four hours, potentially viewing patient medical records and identifiers. The company secured the account and is now providing retraining to staff and a dedicated support line for affected individuals.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

The Asthma Center Discloses Data Breach Impacting Patient Medical Records

BeyondMachines — Tue, 25 Aug 2026 12:01:17 +0000

Summary

Allergic Disease Associates, P.C., doing business as The Asthma Center, suffered a data breach where attackers accessed its systems for three weeks and downloaded files containing patient medical and personal information. The organization has secured its network, is notifying affected individuals and offering guidance on credit monitoring and fraud prevention.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

ReliaQuest Blocks Data Theft Attempt Following ShinyHunters Social Engineering Attack

BeyondMachines — Tue, 25 Aug 2026 11:01:17 +0000

Summary

ReliaQuest successfully blocked a data theft attempt by the ShinyHunters group after an employee was tricked into providing credentials via a vishing and phishing attack. Device-trust controls prevented the attackers from accessing internal applications or customer data.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Grafton City Hospital Reports Data Breach Following Email Account Compromise

BeyondMachines — Tue, 25 Aug 2026 10:01:17 +0000

Summary

Grafton City Hospital disclosed a data breach resulting from a compromised email account discovered on May 6, 2026. The incident potentially exposed personal and medical information, leading the hospital to enhance security and offer credit monitoring to affected individuals.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

State of (in)security - Week 34, 2026

BeyondMachines — Tue, 25 Aug 2026 09:01:17 +0000

Summary

During the week of Aug. 17–24, 2026, there were 16 advisories and 34 incidents (advisories up from 9, incidents down from 42 the prior week), affecting roughly 20 million known individuals. The largest incident is a ClarityCheck leak of about 9 million biometric facial images. Ransomware/malware, third-party compromise, and unauthorized access were the leading causes, and healthcare, IT, and finance the hardest-hit industries. Active exploitation was reported of flaws in MLflow, Citrix NetScaler, GitLab, Zimbra, Microsoft Entra ID and IKE, plus mass patch releases from Oracle (943 fixes), Atlassian (172), and Mozilla (58).

Take Action:

Update your browser now: Chrome to 151.0.7922.169/.170 (or the matching Edge/Brave/Opera/Vivaldi release) and restart it, since these sandbox-escape flaws are exactly what web-based attacks target first. If you administer servers, patch anything internet-facing that's under active attack: NetScaler, Citrix, Zimbra, Windows IKEv2, Atlassian, GitLab and keep every management interface off the public internet, reachable only from trusted networks.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines