<p><strong>TLDR:</strong> HD Moore dropped 15+ new BMC vulnerabilities at Black Hat affecting HPE, Supermicro, Huawei, Lenovo, and Dell — some unpatched for over a decade, all reachable while servers are powered off. CISA added three actively exploited flaws to its KEV catalog, including a CVSS 9.8 RCE in Langflow (the second Langflow entry in a month) and an auth bypass in N-central where the first patch was insufficient. The Snowflake breach guilty plea landed with numbers worth knowing: 165 organizations hit, 100 million individuals affected, $9.5 million in victim losses. Black Hat also surfaced CSS-only keyloggers in webmail and a 22-year-old Wikipedia RCE still alive in the wild.</p>
<hr>
<h2>HD Moore finds 15+ BMC vulnerabilities affecting major server vendors, some unpatched for over a decade</h2>
<p>Security researcher HD Moore presented over a dozen new flaws in baseboard management controllers from HPE, Supermicro, Huawei, Lenovo, and Dell at Black Hat 2026. BMCs are the embedded microcontrollers that run independently of the host OS, maintain their own network stack, and stay active even when the server is powered off — which makes them a particularly ugly target. Some of these vulnerabilities are more than ten years old and remain unpatched despite prior warnings. If you have internet-exposed IPMI or BMC interfaces, that exposure needs to close now. <a href="https://daily.dev/posts/DELcArp96" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>CISA KEV: Langflow CVSS 9.8 RCE, N-central auth bypass with insufficient first patch, Apache Tomcat incomplete fix</h2>
<p>CISA added three flaws to its Known Exploited Vulnerabilities catalog with a three-day federal remediation deadline. CVE-2026-9198 in Langflow scores 9.8 — an unauthenticated attacker chains two API endpoints to get RCE on default deployments, and this is the second Langflow entry in a month. CVE-2026-18576 is the N-central auth bypass covered in yesterday’s digest, but worth flagging again: N-able’s initial patch was insufficient, so if you applied the first fix and moved on, verify you’re actually covered. CVE-2026-34486 in Apache Tomcat is an incomplete fix for a prior critical flaw, with Palo Alto Unit 42 observing a Chinese-speaking threat actor planting reverse shells on Tomcat servers. <a href="https://daily.dev/posts/ci76jfiSh" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Snowflake breach guilty plea: 165 organizations, 100 million individuals, $9.5 million in losses</h2>
<p>Canadian national Connor Riley Moucka pleaded guilty to his role in the 2024 Snowflake credential-stuffing campaign. Between February and October 2024, Moucka and co-conspirator John Erin Binns hit at least 165 organizations — including AT&amp;T, Ticketmaster, and Santander — by exploiting accounts with no MFA using infostealer-sourced credentials. Over 100 million individuals were affected, victims suffered more than $9.5 million in losses, and the attackers extorted at least $2.5 million in bitcoin. Moucka faces up to 32 years and is scheduled for sentencing October 27. Snowflake mandated MFA enforcement after the breaches. <a href="https://daily.dev/posts/5TdnD1XBM" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Black Hat 2026: CSS keyloggers in webmail, 22-year-old Wikipedia RCE, TP-Link Omada 15-flaw chain</h2>
<p>Three notable Black Hat disclosures worth tracking. PortSwigger’s Gareth Heyes demonstrated CSS-only keyloggers that exfiltrate data from webmail without any JavaScript — some vendors quietly patched after initially dismissing the report. A 22-year-old Wikipedia bug still alive in the wild allows shell output to appear on the page, indicating an unpatched command injection. Forescout’s Vedere Labs chained 15 new TP-Link Omada vulnerabilities with two known CVEs to achieve full network takeover from outside — no physical access required, and over 1,800 Omada controllers are currently internet-accessible. TP-Link has patched; update firmware, rotate secrets, and segment provisioning infrastructure. <a href="https://daily.dev/feed-by-ids?id=h8kWZyKKi&amp;id=jJOhGgV3i&amp;id=tjWvL3Z66" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Ransom Cartel creator sentenced to 16 years, $6.7 million in documented losses:</strong> Maksim Silnikau, the Belarusian national behind Ransom Cartel ransomware-as-a-service, was sentenced to 16 years in federal prison after the operation targeted at least 18 companies and caused over $6.7 million in documented losses between 2021 and 2023. <a href="https://daily.dev/posts/bXk6tbmah" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Oracle database used as post-exploitation host via SQL injection and CREATE JAVA SOURCE:</strong> Huntress documented an attack where threat actors exploited SQL injection in a public-facing Java/Tomcat app, then used Oracle’s CREATE JAVA SOURCE to compile and run a custom toolkit called ‘khunt’ inside the database engine itself, achieving SYSTEM-level privileges and dumping Windows credential hives — a technique Huntress says is rarely documented in the wild. <a href="https://daily.dev/feed-by-ids?id=2OUPltTjp&amp;id=nRzsMiW3v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quarkus emergency patches: CVE-2026-16308 DoS and CVE-2026-50559 HTTP auth bypass:</strong> Quarkus shipped emergency releases across three LTS streams (3.27.5.1, 3.33.3.1) and a maintenance release (3.38.1) fixing CVE-2026-16308, a REST denial-of-service via unbounded multipart header accumulation, and CVE-2026-50559, an HTTP path-based authorization bypass via encoded semicolons and slashes. <a href="https://daily.dev/feed-by-ids?id=52FHfAdYG&amp;id=MfzcwBN4A&amp;id=wDULpFQFg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>40 million fake commits per day flooding GitHub’s public feed, traced to Chinese gambling operation:</strong> Since mid-July 2026, a spam campaign has pushed GitHub’s public commit feed to roughly 40 million fake commits daily — over 5x the June baseline and 70% of all observable public events — with GitGuardian tracing the redirect chain through dozens of .cc and .vip domains to an illegal Chinese online gambling site, inflating GitHub’s public metrics in the process. <a href="https://daily.dev/posts/hUhngHKm1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tails 7.10.1 emergency release patches CVE-2026-64560, which could deanonymize users via Tor Browser:</strong> Tails 7.10.1 updates the Linux kernel to 6.12.100 to fix CVE-2026-64560, a flaw that could allow Tor Browser to gain administrator privileges and potentially deanonymize users, plus patches a set of expat privilege escalation vulnerabilities exploitable via malicious files in LibreOffice, Audacity, or Git. <a href="https://daily.dev/posts/QYQPLRaQl" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

HD Moore dropped 15+ new BMC vulnerabilities at Black Hat affecting HPE, Supermicro, Huawei, Lenovo, and Dell — some unpatched for over a decade, all reachable while servers are powered off. CISA added three actively exploited flaws to its KEV catalog, including a CVSS 9.8 RCE in Langflow (the second Langflow entry in a month) and an auth bypass in N-central where the first patch was insufficient. The Snowflake breach guilty plea landed with numbers worth knowing: 165 organizations hit, 100 million individuals affected, $9.5 million in victim losses. Black Hat also surfaced CSS-only keyloggers in webmail and a 22-year-old Wikipedia RCE still alive in the wild.

BMC flaws expose thousands of servers, CISA adds Langflow RCE to KEV