Cisco Issues Security Updates for IOS XR Fixing Multiple Critical Vulnerabilities
Cisco Systems has published security updates for its network operating system Cisco IOS XR to remediate multiple vulnerabilities identified through internal investigation.
The updates were released on September 2, 2026, local time. Researchers classified the issues into seven categories and assigned individual CVE identifiers to each. All releases are affected regardless of specific configuration settings.
Critical Vulnerabilities
CVE-2026-20274 stems from improper resource management, leading to buffer overflows and out-of-bounds memory read/write operations. CVE-2026-20279 involves access control deficiencies. Both received a CVSS v3.1 base score of 9.8 and are rated Critical.
High-Severity Issues
- CVE-2026-20278, CVE-2026-20275, and CVE-2026-20280 address command injection and related problems with a base score of 8.8.
- CVE-2026-20276 concerns control flow management weaknesses, scoring 8.6.
- CVE-2026-20277 involves protection mechanism failures, rated 8.2.
No evidence of active exploitation was reported at the time of the advisory. Cisco has made available Software Maintenance Updates (SMU) and intends to incorporate the fixes into future versions 26.3.1 and 26.2.2.
Related articles
BloodHound, smbmap and enum4linux-ng: Essential Tools for Starting Active Directory Penetration Testing
Active Directory remains the primary target in most internal penetration tests, regardless of how an attacker first gains network access. The article outlines a practical reconnaissance workflow that begins with identifying the domain name and domain controllers through port scanning for ports 88 and 389. Tools such as enum4linux-ng enable initial data collection without credentials by leveraging null sessions, while smbmap reveals readable and writable SMB shares that often contain SSH keys, certificates, and plaintext passwords. BloodHound, paired with collectors like SharpHound, maps relationships between users, groups, and computers to reveal attack paths toward Domain Admins. The piece stresses understanding Kerberos and NTLM protocols to apply techniques such as Kerberoasting, AS-REP Roasting, and pass-the-hash effectively rather than running commands blindly. It also covers quieter alternatives to noisy tools and provides a concise checklist for beginners, along with references to the Red September CyberED course on Active Directory attacks.
Apple Releases iOS 27 and iPadOS 27 with Fixes for 126 Vulnerabilities
Apple has released iOS 27 and iPadOS 27, addressing a total of 126 CVEs across multiple system components. The updates target issues in the kernel, WebKit, Bluetooth, video encoding, and media handling frameworks. Twenty kernel vulnerabilities were resolved, including problems that could allow memory corruption or privilege escalation to root level. Separate patches were also issued for older devices via iOS 26.7 and iPadOS 26.7. Notable fixes include CVE-2026-43689 in the kernel and CVE-2026-65414 affecting Bluetooth. The release was made available on September 14, 2026.
GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security released GitSpawn, detailing eight vulnerabilities across seven coding agents where opening a folder triggers arbitrary code execution via Git configuration before any user prompt. The core issue stems from the core.fsmonitor setting in .git/config, which Git executes during index updates like git status or git diff. While vendors including Anthropic patched Claude Code in version 2.1.196, the fix only blocks agent-initiated calls and leaves manual Git commands or other tools vulnerable. Additional vectors include nested bare repositories tracked under CVE-2026-45033 affecting GitHub Copilot CLI and unpatched agents such as Qwen Code and Grok Build. The researcher also released the Stroq tool to inspect repositories for dangerous settings like core.fsmonitor and postinstall scripts before opening them. The findings highlight that repository trust mechanisms from 2021 remain bypassed by modern AI coding tools.
Critical Unauthenticated File Upload Flaw in WooCommerce Wholesale Lead Capture Enables Active PHP Web Shell Attacks
A critical vulnerability tracked as CVE-2026-27540 affects WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier, allowing unauthenticated attackers to upload arbitrary files including PHP web shells. The flaw resides in the wwlc_file_upload_handler AJAX action, where the file extension allowlist can be manipulated through the file_settings parameter to accept .php files. Exploitation has been observed in the wild with more than 100,000 blocked attempts since June 2026, including sustained campaigns from repeat IP addresses. The developer released version 2.0.3.2 on 20 February 2026 to address the issue, yet many sites remain unpatched. Organizations are advised to update immediately, audit wp-content/uploads for unexpected PHP files, and monitor admin-ajax.php requests for suspicious activity. In confirmed compromise cases, full remediation requires credential rotation and restoration from verified backups.