Cybersecurity Weekly Briefing, 12-18 September

GitLab fixes a critical file-reading vulnerability that was actively being exploited within hours

GitLab has released a patch for CVE-2026-85706 (CVSSv3 10.0 according to GitLab), a path traversal vulnerability in the repository commits API that allows an unauthenticated attacker to read arbitrary files from the server, affecting versions 18.7–19.1.8, 19.2–19.2.6 and 19.3–19.3.2 of GitLab CE/EE. According to the security firm watchTower, the vulnerability has been actively exploited since 06:00 UTC on 11 September, allowing an external attacker to read logs and configuration files to obtain credentials and secrets: the presence of at least one public project on the instance is sufficient.

GitLab has also fixed CVE-2026-87719 (CVSSv3 9.9 according to GitLab), an insecure deserialisation in GitLab EE exploitable via Duo Chat that can expose Advanced Search configurations and credentials.

Organisations with self-managed instances exposed to the internet should patch immediately or restrict public access, and check the logs for POST requests to routes /repository/commits/ with file.Path parameters.

More info

Large-scale campaign targets exposed Vite servers to steal AWS and Azure secrets

Researchers at F5 have detected a large-scale scanning campaign targeting Vite development servers accessible from the internet. The attackers are exploiting CVE-2026-39364 (CVSSv4 8.2 according to GitHub), a vulnerability that allows them to read arbitrary files and obtain credentials in plain text. Targets include .env files, AWS credentials, Azure tokens, Terraform states and serverless platform configurations. F5 recorded over 800 attacks and some 32,000 associated events, whilst also observing attempts to exploit historical vulnerabilities within the same ecosystem.

Organisations that have accidentally exposed Vite to the internet should update immediately and rotate any potentially compromised secrets.

More info

KREMLIN: new banking malware that hijacks Chrome and Edge and uses Ethereum as a C2

Elastic Security Labs has documented KREMLIN, a previously undocumented banking malware ecosystem that has been active since May 2025 and is attributed to the actor REF9334. It impersonates a dozen Brazilian banks to install a malicious extension on Chrome and Edge by bypassing Chromium’s integrity mechanisms. Most notably, it uses Ethereum smart contracts as dead drop resolvers to dynamically update C2 domains and payload download locations, making it difficult to dismantle the infrastructure.

The infection chain begins with a JavaScript loader that evades sandboxed environments and virtual machines, and sideloads a legitimate SentinelOne binary to load the final payload, which steals cookies, passwords, browsing history and screenshots, exfiltrating them via requests disguised as CSS file requests.

Financial institutions and users are advised to be on the lookout for unrecognised browser extensions and unauthorised activation of developer mode in Chrome.

More info

The Revolut data breach points to a compromise of the Italian administration’s infrastructure

Revolut has confirmed a data breach, but has stated that its own systems were not compromised. The attackers are believed to have used a PEC account linked to the Prefecture of Reggio Calabria to send fraudulent requests that appeared to come from Italian law enforcement agencies, thereby obtaining information on around 680 customers, including identity documents, addresses, bank details, statements, verification selfies and transaction histories.

The case is particularly significant due to the possible prior compromise of government infrastructure used as a trusted mechanism, although claims by the group IAmNotAVillain regarding six months’ access and the extraction of 147 GB of data have not been independently verified.

The investigation will need to determine how the PEC accounts were compromised and whether credentials, sessions or tokens were stolen.

More info

High-severity 0-day vulnerability in Cisco ISE actively being exploited, with no workaround available

Cisco has released security updates for CVE-2026-76460 (CVSSv3 10.0 according to Cisco), an authentication bypass vulnerability in the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector that is currently being actively exploited in attacks. The flaw lies in an API endpoint with insufficient authentication controls, allowing an unauthenticated remote attacker to send manipulated requests to access the web administration interface without valid credentials, regardless of the system’s configuration. Cisco ISE is the most widely used network access control platform in enterprise environments and critical infrastructure, frequently deployed as the core of Zero Trust architectures; its compromise effectively equates to unrestricted access to the entire corporate network infrastructure.

CISA has added the vulnerability to the KEV catalogue and has ordered federal agencies to apply the patch within a maximum of three days. Cisco confirms that there are no workarounds: the only mitigation is to update to the fixed versions (3.1P12, 3.2P11, 3.3P12, 3.4P7 or 3.5P4 depending on the branch in use).

Security teams should review the access.log files on all nodes for suspicious usernames and, if malicious activity is detected, reimage the nodes and restore them from clean backups.

More info

◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →