{"uuid": "8a81f61b-4199-4ad0-8979-d5ebd488ef44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-74232", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-cfe18ce3-213e4f08a71a09d8", "content": "This Week in Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, and AI Makes Things Worse, Faster\nThe AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities.\nCVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication is required for exploitation, if the vulnerability exposes confidential data, and other criteria. A CVSS of 10 is as bad as it gets, and having three of them at once is certainly attention-getting. Of the three vulnerabilities fixed, one allowed unauthenticated modification of data in the hosted instance, a second allowed arbitrary code execution via the GraphQL interface, and the third allowed arbitrary SQL commands that could modify the database.\nServiceNow claims Adobe, Lenovo, Fedex, and Fujitsu among their high-profile customers. With luck, the vulnerabilities were patched before significant public exploitation could happen.\nRouter Malware\nPreviously in 2026 the US Government warned against embedded malware found in consumer routers, which may be linked to the FCC enacting bans against certification and import of foreign-made consumer devices. This week, the NVD (National Vulnerability Database) reported specific embedded malware in the Zbtlink and MoreQuick brands of devices.\nMultiple versions of the firmware, for multiple lines of products, contain a backdoor service that uses unencrypted UDP to connect to a command and control (C2) service. The service, or anyone able to intercept the network traffic, since it\u2019s unencrypted, can execute commands as root, allowing them to change configurations, open tunnels, or steal ISP credentials.\nThe malware is baked into the firmware, so removing it is impossible for most users: a factory reset wouldn\u2019t do. In theory if third-party firmware like OpenWRT supports these devices, the hardware could be made safer with a custom install.\nGiven how commonly the same device is marketed under dozens of names, likely the same devices and firmware have yet to be identified under other brands.\nVulnerability in Qubes\nThe security-focused distribution Qubes has an important security bulletin for recently discovered issues.\nQubes is built on top of the Xen virtualization system, where each application can be given a dedicated container. The utility to copy files from the primary container into an application container, qvm-copy-to-vm, displays a message if there is an error copying the file. To show the message, the utility launches kdialog with the error as arguments, but fails to ensure that the error doesn\u2019t include shell commands.\nThe system call used to show the alerts has the dangerous side effect of calling the command as if it was a normal shell. This is extremely powerful, but equally risky: a shell typically allows multiple commands per lines, require quoted strings to protect arguments with spaces or complex text, and can expand variables. Generating an error that escapes out of the message and runs arbitrary commands was all it took.\nQubes already has a fix ready and everyone getting standard updates should have it waiting.\nWere US Military Freezers Hacked?\nThe controls for the freezers used in the commissaries of a growing number of US military bases may have been compromised.\nIndependent researchers noticed growing reports in Reddit threads that freezer units were out of service, with other service members and families reporting the same. At least fourteen bases throughout the United States appear impacted, and the story has been picked up by the official military newspaper \u201cStars and Stripes\u201d as well as by mainstream media outlets.\nPosts by staff at the bases clarify that it was not a power loss or cooling loss, the fridges and freezers were placed in defrost mode where they self-heated. The commissaries are operated by the Defense Commissary Agency, with central monitoring and control of facilities. Central monitoring makes complete sense when you need to ensure devices are keeping food at a safe temperature, but something definitely seems to have gone wrong.\nDiving into it further, M. Elizabeth finds a post from August 9, 2026 describing vulnerabilities in the Danfoss controllers that allow unauthorized access to the refrigeration controller, and a second paper by the same team exposing over 20 vulnerabilities in Copeland refrigeration controllers that included full control of the unit settings. M. Elizabeth is careful to point out that without confirmation from the commissary agency, it\u2019s impossible to know for sure that this was a hack of the control system, but the evidence is mounting.\nBGP and SSL Hijack Used to Push Bad Updates\nVirtualizor, a web interface for managing virtual machines in an enterprise (bring-your-own AWS), was recently targeted in a global route hijacking scheme.\nBorder Gateway Protocol (BGP) is a core routing system underlying the Internet at large. Service providers use BGP to announce the ranges of IP addresses they handle and how to reach them. BGP is operated as basically a global gentleman\u2019s agreement: the protocol itself lacks any authentication or encryption. If you think this sounds vulnerable to disruption, you\u2019d be completely right.\nGlobal disruptions have happened accidentally, like when an ISP in Pakistan took down YouTube, deliberately, such as when thieves hijacked the routes to cryptocurrency exchanges, and mysteriously, like when China hijacked parts of the Internet repeatedly with no explanation.\nThis time, the BGP attack targeted the IP range used by Virtualizor, and was combined with spoofed SSL certificates for the Virtualizor servers to push spoofed updates. The BGP announcement was targeted to a specific class C: a relatively small allocation of 253 addresses, similar to what a home network would use. BGP gives precedence to the smallest announcement for an IP range, so all systems that received the spoofed announcement routed those addresses accordingly. The network advertising the false route was based in Romania, though of course they could also be a victim.\nWith control over the IP range, the attackers were able to generate a certificate via Lets Encrypt, which was sufficient for browsers and the updater to accept the rerouted addresses. The attackers then published a malicious package that appears to install additional services. The company has not provided details about the trojaned update, so it\u2019s not clear what other risks it poses.\nVirtualizor does not have a public list of customers, but one has to assume it includes high-profile companies to make such an attack viable. Hijacking BGP is extremely obvious, and isn\u2019t frequently used for such obvious spoofing attacks.\nLinux Zoom Steals Clipboard Contents\nSimon Tatham, the author of the extremely popular PuTTY SSH client among other projects, posted on Mastodon an interesting observation about the clipboard behavior of recent Zoom clients on Linux.\nRelatively recently, some operating systems have added the ability to alert the user when an application access the clipboard. Unfortunately, Linux is not yet one of them, but thanks to other clipboard management tools, Simon noticed that the recent update to Zoom 7.1.5 copies the contents of the clipboard as soon as they change. What happens to the clipboard contents once copied is currently a mystery.\nConsidering that the clipboard can often contain passwords, authentication tokens, or simply data you might not want to share with Zoom, automatically scraping the contents isn\u2019t what you\u2019d hope for.\nPlex Vulnerabilities\nThe Plex media streaming software sent out an advisory this week warning about security updates for the server and desktop application.\nDetails are currently thin, with the promise of future details once CVEs have been assigned. For now, make sure you\u2019re on version 1.43.4 or newer. The Plex post has additional directions for updating on platforms that may not have pushed new packages yet.\nAI Accelerates Exploit Development\nSecurity company CrowdStrike has released their 2026 report on threats, focusing on the proliferation of AI tools in exploit writing.\nCrowdStrike observed that 88% of exploits happened with 48 hours of the proof of concept code being released, crediting AI tools for shortening the adaptation. Typically proof of concept code is designed to demonstrate the vulnerability without providing an immediate mechanism for malicious use, and the window from exploit announcement to wide-spread risk was on the order of weeks. The report notes some vulnerabilities being widely exploited in 20 hours after public disclosure.\nThe tightening window makes patching even more important, but rapid patching caries the risk of instability when the patches themselves haven\u2019t had extensive testing. Unfortunately there\u2019s no simple solution; faster exploitation via AI tools drives faster patching, often also with AI tools that can introduce more bugs as well. \nhackaday.com/2026/09/04/this-w\u2026RE: hachyderm.io/users/simontatham\u2026", "creation_timestamp": "2026-09-04T14:37:15.827514Z"}