Stay updated with the latest cybersecurity news. This daily roundup covers actively exploited vulnerabilities, major data leaks, supply-chain attacks, AI-agent risks, and law-enforcement takedowns from the last 48 hours so you can brief your team and harden the systems that matter most.
1. Hackers Leak Data of 8.7 Million UK Airport Travelers After MAG Refuses Ransom
Published: 2026-09-02
FulcrumSec published about 550GB of data stolen from Manchester Airports Group after MAG declined to pay. The dump covers roughly 8.7 million people who used Manchester, London Stansted, and East Midlands airports and includes emails, phone numbers, postcodes, vehicle plates, Wi-Fi logins, parking and Fast Track bookings, and device/browser metadata. Payment card data does not appear to have been included, but the volume of PII is large enough to fuel phishing and social-engineering campaigns. MAG says operations were not disrupted and that it has contacted affected customers.
2. SonicWall Warns of Two SMA1000 Zero-Days Chained for Unauthenticated RCE
Published: 2026-09-02
SonicWall says attackers are chaining CVE-2026-83548 (pre-auth SSRF, CVSS 10.0) and CVE-2026-83549 (post-auth command injection) on SMA 1000 series appliances (models 6210, 7210, and 8200v). The pair can lead to unauthorized access and remote code execution. Shadowserver has tracked more than 400 internet-exposed SMA1000 devices. SonicWall has shipped hotfixes and urges upgrades, password resets, TOTP token rotation, and re-imaging if compromise is suspected. These appliances are separate from SonicWall firewall SSL-VPN and the older SMA 100 line.
3. Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Published: 2026-09-02
Manifold Security disclosed a class of flaws (often called GitSpawn) across seven command-line AI coding agents. A repository’s own Git configuration can name a command that the agent runs on the developer’s machine—outside the sandbox and without an approval prompt. Exploitation typically requires the repo (and its .git directory) to land on the machine via clone, shared folder, or USB. Some vendors have shipped fixes; others remained unpatched at publication. Treat untrusted repos as executable content when AI agents have shell access.
4. Critical JFrog Artifactory Flaw Exploited Days After Patch to Mint Admin Tokens
Published: 2026-09-02
CVE-2026-82329 (CVSS 9.8) is an authentication weakness in self-hosted JFrog Artifactory. Under default configuration, an unauthenticated attacker can abuse a “phantom” join key to forge administrator tokens. watchTowr reported exploitation starting around September 1, shortly after the August 28 disclosure. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 2. Cloud-hosted JFrog instances were already hardened; self-hosted operators should jump to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20 depending on branch, then rotate tokens and audit admin activity.
5. WordPress All-in-One WP Migration Flaw Puts Millions of Sites at Risk of Takeover
Published: 2026-09-02
CVE-2026-19949 is a second-order SQL injection in All-in-One WP Migration and Backup through version 7.109. An unauthenticated attacker can plant crafted data via WordPress trackbacks; the payload fires when an admin exports or restores a site. That can leak the plugin’s secret import key and let an attacker import a malicious .wpress archive with executable code. Wordfence notes only about 35% of the install base has updated, leaving roughly 3.25 million sites on vulnerable builds. Update immediately and treat unexpected imports as hostile.
6. Dropbox Says About 5,000 Accounts Were Accessed via a Lenovo ID Verification Flaw
Published: 2026-09-02
Dropbox disclosed that attackers used a weakness in Lenovo’s email verification process to register fraudulent Lenovo IDs with victim email addresses, then signed into linked Dropbox accounts without the Dropbox password. Access occurred between August 4 and 21. Dropbox expired Lenovo ID sessions and now requires the Dropbox password when using that SSO path. Impacted users should review shared links, connected apps, and file activity, then rotate passwords and enable phishing-resistant MFA. Lenovo customers as a whole were not reported as affected by the same issue.
7. 23-Year-Old Sality Botnet Disrupted in Global Sinkhole Operation
Published: 2026-09-02
CrowdStrike, Shadowserver, the FBI, DOJ, Europol, and partners in Bulgaria, Hungary, and Romania disrupted Sality, a peer-to-peer botnet that has been active for more than two decades. Operators poisoned peer lists so bots pointed at defender-controlled sinkholes, then seized payload domains. Infected machines can no longer receive new instructions from the original controllers. Shadowserver is working with ISPs and national CERTs to notify owners of remaining infections. Any long-lived Windows host that has never been rebuilt should be checked against current Sality indicators.
8. Extradited Russian Hacker Charged Over Excel Malware Campaign Targeting 80,000 Freelancers
Published: 2026-09-02
U.S. prosecutors charged Searzhudin Tamirlanovich Aktulaev, extradited from Cyprus on August 28, over a 2016–2017 campaign that used about 255 fake freelance-platform accounts to send malware-laced Excel files to roughly 80,000 users. The attachments delivered TVRAT and DarkVNC, giving operators remote access and credential theft. The case is a reminder that “old” freelance-job phishing still pays, and that document macros, unexpected Excel attachments, and new client outreach remain high-risk even in 2026.
Also on the radar (same 48-hour window)
- BGP hijack of Softaculous traffic delivered a malicious Virtualizor update that could establish persistent root access; operators should apply Patch 9, rotate API credentials, and scan for persistence.
- Google launched Gemini 3.8 Flash Cyber and the Fairwind Program to give trusted defenders earlier access to cyber-focused models; Anthropic and OpenAI also rolled out new enterprise safeguards.
- WhatsApp for Android lock-screen photo bypass: answering a video call and opening filters/edit-photo can expose the gallery on some Pixel and Oppo devices without unlocking. Limit WhatsApp photo access until Meta and OEMs patch.
- Sangoma Switchvox CVE-2026-9586 (unauthenticated SQL injection leading to RCE) is being used to drop reverse shells on exposed VoIP systems.
Stay Vigilant
Patch internet-facing appliances first (SonicWall SMA1000, JFrog Artifactory, Sangoma Switchvox), then WordPress plugins with large install bases. Treat AI coding agents as privileged users: do not point them at untrusted repositories. If you flew through MAG airports or used MAG parking/Wi-Fi, watch for highly targeted phishing that quotes real booking or vehicle details. Subscribe for the next daily digest, and keep backups, MFA, and least-privilege access current. Stay safe online.