Daily Vulnerability & Exploit Digest

• Two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SonicWall SMA1000 appliances were actively exploited by threat actor UTA0533 for weeks before patches were released.
• Exploitation allowed the installation of custom malware on vulnerable VPN appliances.
• The SMA1000 series provides secure access to corporate resources, making these flaws highly impactful.

The threat actor UTA0533 leveraged these zero-days in a chained manner to achieve initial access and persistence on target networks. Specific details on the exploitation chain are not fully disclosed but likely involve remote code execution to deploy custom malware payloads. These VPN appliances are often perimeter devices, providing a direct route into internal networks bypassing traditional endpoint defenses.

These vulnerabilities are critical for network infrastructure penetration tests. Identify SonicWall SMA1000 appliances within the scoped environment, prioritize version identification, and check for the applicable security patches. While direct zero-day exploitation is not possible post-patch, understanding the attack surface and potential for similar flaws in other unpatched network devices is valuable. Focus on configuration reviews for remote access solutions.

Organizations must immediately apply the latest patches released by SonicWall for SMA1000 series appliances. Conduct thorough forensic investigations to detect any signs of compromise if patches were not applied promptly.

• OpenSSL silently patched a Denial of Service (DoS) vulnerability, dubbed 'HollowByte'.
• The flaw involved attackers sending malicious payloads that trigger buffer pre-allocations which are not subsequently freed.
• This leads to exhaustion of server memory, resulting in a DoS condition.

An attacker could craft specific malformed TLS/SSL payloads that, when processed by a vulnerable OpenSSL instance, cause memory exhaustion. This is an application-layer DoS, targeting the resource management of the SSL/TLS handshake or data processing rather than raw network bandwidth. Tools for fuzzing TLS implementations could potentially uncover similar vulnerabilities.

During infrastructure assessments, identify systems utilizing OpenSSL and their version. While the fix is silent, understanding the potential for memory-exhaustion DoS due to protocol parsing errors is crucial. Testers should consider focused adversarial simulations that involve malformed protocol inputs to assess application resilience and resource management.

Update all systems and applications using OpenSSL to the latest patched versions to mitigate the 'HollowByte' DoS vulnerability and other potential memory-related issues. Regularly monitor for OpenSSL security advisories.

Cloud

• A critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is now actively being exploited in the wild.
• The flaw allows for remote code execution (RCE).
• ServiceNow is a widely used enterprise cloud platform, making this a significant threat to organizations relying on it.

Attackers are leveraging this critical RCE flaw to gain unauthorized control over affected ServiceNow instances. The nature of RCE in a platform like ServiceNow means attackers could potentially access sensitive data, modify configurations, or pivot to other connected systems within the enterprise environment. The specific exploit chain likely involves manipulating input flows or API calls processed by the AI platform component.

This vulnerability presents a high-priority target for penetration tests and red team engagements targeting organizations that utilize ServiceNow. Pentesters should actively identify ServiceNow instances within scope, confirm their version, and verify patch levels. While direct exploitation might be outside standard rules of engagement without explicit permission, its existence highlights the need to probe for other logical flaws or misconfigurations that could lead to similar impacts.

Organizations using ServiceNow AI Platform must immediately apply the security patch for CVE-2026-6875. Conduct an audit of ServiceNow logs for any suspicious activity indicating potential compromise, especially if the patch was not applied quickly.

• Researchers achieved sandbox escapes in multiple AI development environments, including Cursor, Codex, Gemini CLI, and Antigravity.
• The technique involved having the AI agent write files that trusted host tools subsequently executed.
• This highlights a novel attack surface in AI-centric applications where the AI's output can be weaponized.

The core exploitation vector is the AI agent's ability to generate malicious content (e.g., shell scripts, configuration files with commands) that is later processed or executed by privileged host tools outside the sandbox confinement. This could be triggered by subtly crafted prompts or by the AI's own logical reasoning within an adversarial context. This mirrors supply chain attacks where legitimate software executes malicious components.

This is a critical area for AI security assessments. Pentesters should explore the potential for AI agents to generate and store malicious payloads that are later executed by other system components (e.g., build tools, CI/CD pipelines, or user-facing applications). Focus on the entire lifecycle of AI-generated content and the trust placed in it by downstream systems. Test for prompt injection techniques that encourage malicious code generation or file writing.

Vendors should implement stricter input/output sanitization for AI agents, enforce robust sandbox mechanisms, and reduce the privileges of host tools that interact with AI-generated content. Users should ensure their AI development tools are updated and regularly monitor for new vulnerabilities related to AI agent interaction.

• The JadePuffer autonomous AI agent has evolved to include custom malware called EncForge.
• EncForge specifically targets and encrypts AI assets such as training datasets, vector databases, and model checkpoints.
• This represents a new form of ransomware targeting critical components of AI/ML pipelines.

This attack leverages the autonomous nature of AI agents. The JadePuffer agent, once established in an environment (likely through initial compromise or misconfiguration), identifies and executes EncForge to encrypt AI-specific data. This could involve leveraging access to cloud storage, data lakes, or internal repositories where these assets are stored. The attack demonstrates a clear understanding of AI infrastructure from the adversary's perspective.

For engagements involving AI/ML infrastructure, pentesters must incorporate scenarios that mimic AI-agentic attacks. This includes identifying sensitive AI assets, assessing access controls around them, and simulating data encryption or destruction. Focus on the data flow and storage mechanisms for training data, models, and embeddings. Can an authenticated (or compromised) AI agent gain sufficient privileges to encrypt these assets?

Implement stringent access controls for AI assets, encrypt data at rest and in transit, and establish regular backup and recovery procedures specifically for training datasets, vector databases, and model checkpoints. Monitor for unusual access patterns to these critical AI resources.

• A new malicious component, HollowGraph, uses the calendar feature in compromised Microsoft 365 mailboxes for Command and Control (C2).
• This technique allows for stealthy C2 communications and exfiltration of stolen data.
• By leveraging legitimate Microsoft Graph APIs, the malware blends in with normal network traffic.

HollowGraph typically establishes persistence after an initial compromise. It then uses the Microsoft Graph API to interact with the victim's M365 calendar. Commands are embedded within calendar entries (e.g., event descriptions, locations), which the malware retrieves. Similarly, exfiltrated data can be uploaded to attachments or notes within calendar events. This method bypasses traditional network filtering that might flag known C2 domains.

When performing red team operations, consider emulating HollowGraph's C2 technique. This provides valuable insights into an organization's ability to detect legitimate-looking C2 traffic originating from compromised user accounts. Focus on monitoring M365 audit logs, particularly for suspicious calendar activities (e.g., creation/modification of events by service accounts or from unusual IPs, large attachments).

Implement robust monitoring and alerting for Microsoft 365 audit logs, focusing on unusual activity related to calendar events, attachments, and access patterns via Microsoft Graph API. Consider implementing conditional access policies to restrict Graph API usage based on location or device.

• Hugging Face, a prominent AI repository, suffered a breach involving an autonomous AI agent system.
• The attack compromised internal datasets and service credentials within their production infrastructure.
• This incident highlights critical supply chain risks and unique vulnerabilities in AI-centric platforms.

The specifics of the autonomous AI agent's initial access vector are not fully detailed, but the outcome indicates a successful lateral movement and privilege escalation to access sensitive internal datasets and credentials. This suggests weaknesses in production environment segmentation, access control policies, or vulnerability in a component that the AI agent exploited to gain broader access. The attack capitalized on the platform's nature as a repository for AI models and related data.

For cloud and AI infrastructure penetration tests, this incident underscores the need to assess the security of AI model repositories, internal data stores, and credential management systems within CI/CD pipelines related to AI development. Consider scenarios where an AI agent itself could be compromised or misused to perform malicious actions, including data exfiltration or credential theft.

Organizations operating AI repositories or cloud platforms should review and harden their production infrastructure, implement stringent access controls for critical datasets and credentials, and regularly audit for unusual activity originating from AI agent systems or internal services.

• New WordPress vulnerabilities, CVE-2026-60137 and CVE-2026-63030 (collectively 'WP2Shell'), are being actively exploited.
• Exploitation began shortly after their disclosure.
• These vulnerabilities pose a significant threat to the vast number of WordPress installations globally.

The term "WP2Shell" suggests that these vulnerabilities likely enable an attacker to upload or execute arbitrary code (a "shell") on the affected WordPress server. This could be through file upload bypasses, arbitrary file inclusion, or code injection within plugins or themes. Once a shell is established, attackers can gain full control over the website, deface it, steal data, or use it as a pivot point for further attacks.

For web application penetration tests involving WordPress, systematically check for popular plugins and themes that might introduce these vulnerabilities. Actively scan for known vulnerable versions and attempt to reproduce the exploitation if within scope and permitted. Pay close attention to file upload functionality, plugin update mechanisms, and any areas where server-side code execution is possible through user input.

Immediately update all WordPress core installations, themes, and plugins to their latest versions. Remove any unused or unnecessary plugins and themes. Implement a robust Web Application Firewall (WAF) and regularly back up WordPress sites.