Some developers are publishing private GitLab email addresses in READMEs, contributing guides and support pages to collect bug reports. According to researchers at application security company Aikido, these addresses carry a credential that attackers can use to act on GitLab as the developer who owns them.
The addresses come from a built-in GitLab feature called "Email work item to this project." GitLab generates them automatically. When someone sends a message to one of these addresses, GitLab turns the email into an issue or task in the project.
The problem is that each address contains a long-lived token tied to the developer's account. This string works as the credential for creating work items by email.
Attackers have moved beyond scanning for WordPress sites vulnerable to CVE-2026-87902. They are now exploiting the flaw to plant files that run shell commands when they are accessed, according to WordPress security firm Patchstack.
The vulnerability was fixed in WordPress 7.1.2. Scanning began less than five hours after that release. Since then, malicious traffic has grown tenfold, and attackers are now trying to deliver payloads.
Patchstack says it saw the first malicious requests at 17:44 UTC on September 22. They came from a small group of IP addresses and targeted several sites under the company's protection.
Researchers at Graz University of Technology in Austria have shown that the file-change notification features in Linux, Android, Windows and macOS can be used to spy on other users of the same system. The information exposed ranges from the rhythm of someone's typing to the websites they visit.
All four operating systems let applications ask to be told when files are created, modified or deleted. Text editors, file managers, sync clients and antivirus tools rely on this. It needs no elevated privileges, only read access to the watched location.
The attacks never reveal what is inside a file. The researchers found that file names and the timing of events are enough to piece together what users, applications and the system are doing. Most scenarios assume an attacker who can already run code on the machine under a separate account. On Android, that attacker could be an app that asks for no permissions at all.
Researchers at Zenity Labs have disclosed three vulnerabilities in Salesforce Agentforce, the company's platform for AI agents. Attackers could have abused the flaws to turn trusted agents against their own organizations. The agents could be made to leak sensitive customer relationship management (CRM) data or to send phishing messages to employees.
The researchers call the set of bugs SalesBleed. According to Zenity Labs, two of the flaws allowed zero-click data exfiltration. The third let an attacker weaponize an Agentforce agent to spread phishing inside a company.
Zenity Labs reported the issues to Salesforce on June 1. Salesforce confirmed that all three had been fixed by August 19.
Check Point has confirmed that attackers are exploiting CVE-2026-85102, a remote code execution (RCE) vulnerability in its Security Gateway product. The flaw sits in the code that handles VPN certificates, and it can be abused without authentication.
The same advisory covers a second exploited bug, CVE-2026-93616. It is a pre-authentication path traversal flaw in the Management web service that can lead to script execution and Java class loading. According to Check Point, attackers have used it as a zero-day since July 23.
Warning from the Netherlands came first
The Security Gateway issue was already on defenders' radar. On September 10, the Nationaal Cyber Security Centrum (NCSC), the Dutch government's national cybersecurity agency, warned about the flaw. It told users to install the available security updates because it expected exploitation soon.
Guy Fawkes News is financed by advertising. You can choose how you want to use this website:
With advertising: we load an advertising script from a third-party ad network. The ad network may set cookies, use your IP address and device information, and may process data outside the EU. We also count your visits for our own visitor statistics (with a random ID stored in your browser).
Ad-free for €0.99 per month: no advertising and no advertising tracking. Cancel at any time.
You can change your decision at any time via "Cookie Settings" at the bottom of every page.
