VoIP flaw lets hackers run code without login

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🔓 VoIP flaw lets hackers run code without login

🔐 File transfer flaw bypasses login

🐛 Researcher claims CrowdStrike Falcon zero-day

💣 Booby-trapped repos hijack AI coding agents

Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.

🔓 VoIP flaw lets hackers run code without login LINK

Hackers are actively exploiting a flaw in the Sangoma Switchvox VoIP platform (CVE-2026-9586) that lets them run operating-system commands on business phone systems without any login, tracked as an unauthenticated SQL injection leading to remote code execution.

The bug lives in Switchvox's exposed /pa endpoint, which parses an XML message and drops the PhoneIP field straight into an unparameterized SQL query, letting an attacker send a crafted request via curl to run commands and open a reverse shell.

Horizon3 saw active exploitation on August 30 from IP 176.65.148.184, which grabbed process data and sent it out base64-encoded; admins should upgrade to Switchvox 8.4.0.2, check /var/log/switchvox/db-quirks.log, and watch for connections to that IP on port 39323.

🔐 File transfer flaw bypasses login LINK

A newly disclosed authentication bypass in the file transfer application Cleo Harmony, tracked as CVE-2026-84115, lets remote attackers slip past login checks and raise their privileges without valid credentials.

The flaw sits in the JWT refresh token logic reached through the '/api/connections' endpoint, where an attacker forges or replays malformed bearer tokens in HTTP headers to bypass access controls, and a working exploit has already been released.

Attackers can keep persistent access, escalate privileges, or move to other systems Cleo Harmony connects to; Cleo fixed it in version 5.8.1.11, and WatchTowr, which reproduced the bug on Tuesday, notes the app is a frequent ransomware target.

🐛 Researcher claims CrowdStrike Falcon zero-day LINK

A researcher going by Nightmare-Eclipse has published a project called FalconFlank that claims to exploit an unconfirmed zero-day in CrowdStrike's Falcon Sensor, letting a local attacker on Windows gain higher access rights up to SYSTEM level.

The project ships proof-of-concept C source code and a compiled x64 build that allegedly abuses Falcon's remediation workflow for malicious Microsoft Office macros, tricking a process that runs with elevated permissions into handling attacker-controlled files or paths on devices where macro removal is enabled.

The researcher says the PoC worked against fully updated Windows 11 25H2 and Windows Server 2025 with Phase 3 Optimal Protection, but CrowdStrike has issued no advisory, CVE, or patch, and the claim is not independently verified.

💣 Booby-trapped repos hijack AI coding agents LINK

A new class of flaws called GitSpawn lets a booby-trapped code repository run commands on a developer's machine the instant it is opened in an AI coding agent, with no typing, no approval, and sometimes before the user has even logged in.

The trick abuses a Git performance setting, core.fsmonitor, read from the repository's own .git/config: when agents like Claude Code, Goose, Grok Build, Qwen Code and Hermes Agent quietly run git status or git diff on startup, Git refreshes its index and runs the attacker's embedded command with the user's full privileges, outside the sandbox.

It only works if the poisoned repository arrives as raw files with its .git directory intact (via zip, shared drive, or USB) not a normal clone; four of eight issues stay unpatched, Goose (CVE-2026-72718) and Hermes (CVE-2026-71963) got fixes or IDs, and developers should inspect .git/config before opening such repos.

💡 Strategies & Tactics

> Singularity Rootkit Bypasses Elastic Defend eBPF Module Load Detection: The Singularity rootkit hides from Elastic's Linux security tool by briefly registering itself as trusted, exposing the risk of trust-based monitoring exclusions.

> HTML-Rendered QR Phishing Evades Image Extraction and OCR-Based Email Scanning: Attackers now draw scannable QR codes from HTML markup instead of images, slipping past email scanners that only inspect image attachments to decode phishing links.

> Your AI agent’s system prompt is not a security control: Enforce data access at retrieval through your existing permission system, because AI agents will leak anything their system prompt alone claims to protect.

> OWASP Top 10 CI/CD Security Risks Explained: Why Credential Hygiene Decides the Outcome: Prioritize cleaning up exposed and overly powerful credentials, since stolen secrets are what let attackers turn any pipeline foothold into a full breach.

> How To Govern The AI Agents That Are Already Inside Your Enterprise: Govern AI agents like employees by giving each a unique identity and least-privilege access, then monitor their behavior in real time to catch harmful actions.

> Ransomware protection for MSPs: A 6-point checklist for faster recovery: Explains how managed service providers can recover from ransomware faster by pairing threat detection with tamper-proof backups and rehearsing every step of the restore process.

Other news you might like

• Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Execute Code as Root Without AuthenticationLINK

• WordPress backup plugin flaw exposes millions of sites to takeover attacksLINK

• Hugging Face Transformers Flaw Writes Malicious Python Code to Disk Before User ConsentLINK

• A breach at Thomson Reuters reached appellate courts in twelve US jurisdictionsLINK

• Pegasus, NoviSpy variant spyware found on devices of Serbian activistsLINK

• US charges Russian for infecting 80,000 freelancers with malwareLINK

• Hackers Turn Trusted Node.js Runtime Into Malware Launcher in Ransomware-Linked AttacksLINK

• StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device TakeoverLINK

🧰 Trending tools

Kastra: runtime authorization layer that checks AI agent actions before execution, blocking unauthorized tool use, prompt injection, and data exposure with sub-millisecond latency.LINK

Perfai Security: autonomously tests AI-coded apps for broken access control, business-logic, and prompt-injection flaws, proves exploits, then opens pull requests with verified fixesLINK

Constellation Gate AI: a proxy layer between agents and LLMs that filters threats, cuts token costs, and logs every request for auditing.LINK

Execlave: enforces runtime policies, kill switches, and audit logs on autonomous AI agents in under 20ms, mapping to SOC 2, EU AI Act, and ISO 27001LINK

TailMux: runs multiple Tailscale profiles at once on macOS and Linux, routing by hostname so work and personal tailnets stay simultaneously reachable.LINK

Lunen.ai: an AI assistant that logs every action, flags risky steps for approval, and keeps audit trails your security team can trust.LINK

📚 Trending papers & reports

Model-loading safety checks flag when the software environment around a saved machine-learning model has quietly changed before it loads, catching hidden mismatches that simple file-integrity checks miss and that can silently break predictions in production.LINK

Expert-routing security hardens the always-on component inside next-generation language models that route each request to different specialists, giving them a router-independent safety anchor that resists jailbreaks and malicious fine-tuning without hurting performance.LINK

Skill-as-API lets AI coding agents borrow each other's specialized abilities while keeping the secret instructions behind them private, so companies can share teammate agents without leaking proprietary know-how, reconnecting across continents in ~2-3 seconds.LINK

Secure enclave partitioning automatically splits low-level programs into protected and unprotected parts, removing the manual, error-prone work of deciding what runs inside secure hardware while guaranteeing sensitive data stays hidden even from strong attackers.LINK

CAPTCHA-solving agents can now learn from every puzzle they see, hitting ~85% accuracy across 16 types and recovering to full strength even after operators scramble images to break them, undermining defenses that assume a blocked bot stays blocked.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!