Cybersecurity Weekly Briefing, 4 September

ServiceNow patches three CVSS 10.0 vulnerabilities that allow code execution and SQL injection without authentication

ServiceNow has released patches for four vulnerabilities in its AI Platform, three of which have the maximum score. CVE-2026-18885 (CVSSv4.0 10.0 according to ServiceNow) is a code injection vulnerability in the GraphQL Composite Data API that allows arbitrary code execution without authentication; CVE-2026-18886 (CVSSv4.0 10.0 according to ServiceNow) is an inadequate access control in the configuration image upload processor that enables privilege escalation; and CVE-2026-74820 (CVSS v4.0 10.0 according to ServiceNow) is an SQL injection in a dynamic schema ORDER BY clause that allows arbitrary SQL statements to be executed against the database.

ServiceNow has already deployed the patch on its hosted instances, but organisations operating their own instances must apply it manually. The company states that it is not aware of any active exploitation.

It is recommended that organisations prioritise immediate patching on self-managed deployments and review access logs for the affected APIs.

More info

Fire Ant compromises Cisco IOS XR routers and TACACS servers to steal credentials

Sygnia has documented the expansion of Fire Ant, a cyber-espionage actor linked to China, beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers and Linux management hosts in high-value networks. The investigation began when a GRE tunnel was detected on an IOS XR router with no configuration or history to justify it: the implants, tailor-made for the IOS XR control plane, replaced a system library to forward only log messages containing the string ‘Health’ and altered the command execution path by adding a ‘| exclude’ filter to ‘show’ commands, thereby concealing the tunnel from administrators.

From there, they captured PCAPs from various Cisco devices and uploaded them to external FTP servers. On the TACACS server, they deployed TacTap, which injects a malicious library into the `tac_plus` process and dumps the credentials to `/var/log/.tacplus.acct` using a one-byte XOR, a technique which, according to Sygnia, had not been publicly described.

The attacker combined Medusa and REPTILE rootkits, custom SSH backdoors and binaries that impersonated SentinelOne and Cybereason agents, as well as suppressing SNMP traps, disabling SELinux and rewriting the access log.

More info

A ransomware attack carried out using AI agents compromises a corporate network in under 10 hours

Unit 42 has detailed an incident in which a human attacker utilised edge AI models and agent-specific frameworks to carry out the attack, with the aim of compromising a company’s network almost autonomously as part of a ransomware operation. According to the attacker’s own statement during negotiations, the AI agents executed more than 50 techniques from the MITRE ATT&CK framework, completing in under 10 hours an intrusion that would normally require around two weeks of coordinated manual work.

Following initial access via a public API endpoint, the agents mapped the internal architecture, extracted tokens and passwords from code repositories, escalated privileges until they gained master credentials for the secret manager, hijacked CI/CD pipelines to exfiltrate cloud access keys, and attempted to plant backdoors. The attacker even used the victim’s own cloud-based AI infrastructure—which had already been compromised using the stolen keys—as post-compromise infrastructure for future phases of the attack.

It is recommended to deploy synchronised containment playbooks capable of revoking credentials and isolating cloud accounts at the same pace as an automated attack.

More info

PackClient: a new commercial RAT framework used by the Chinese actor TA4922

Proofpoint has identified PackClient, a comprehensive remote access framework sold via Telegram channels and used by the Chinese actor TA4922 in campaigns targeting organisations in China and India. The malware features a modular architecture, dual C2 channels, a keylogger, screenshot capture, SOCKS tunnels, remote system access and specific capabilities for monitoring applications such as Telegram Desktop.

The observed campaigns use tax-related lures and ZIP and IMG files to install the malware via DLL sideloading. The commercial availability of PackClient increases the risk of its adoption by other Chinese-speaking actors and its potential expansion into global campaigns.

More info

Google fixes two critical Chrome vulnerabilities exploitable via malicious web pages

Google has released an update for Chrome that fixes 26 security flaws, two of which are classified as critical by the manufacturer itself. Both are use-after-free (UAF) vulnerabilities, a memory error that allows code to be executed when the browser accesses a region that has already been freed. The first, CVE-2026-84353 (CVSSv3 9.6), lies within the Shared Tab Groups feature and allows a remote attacker, using social engineering and a manipulated HTML page, to execute arbitrary code outside the browser’s sandbox.

The second, CVE-2026-84352 (CVSSv3 9.6), affects WebGL and enables the same type of sandbox escape via a malicious webpage. Given that Chrome has over three billion active installations worldwide, a vulnerability that allows code execution outside the sandbox is a high-value vector for watering hole campaigns or the distribution of malware via the web.

The update is now available on the stable channel (152.0.7977.75/.76 for Windows and Mac, 152.0.7977.75 for Linux). It is recommended to force the update and restart the browser without waiting for the automatic update cycle.

More info

◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →