Daily Threat Briefing
← All briefings

SiYuan Note-Taking App · Acer Planet9 Background Service · OpenTofu

Date: 2026-08-17 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Today’s most notable new developments include a large-scale data theft campaign attributed to Russian cybercriminals targeting Shell, Philips, GE, and other major energy and medical technology firms, with Clop ransomware involvement suspected. A new macOS information stealer (AmnesiaStealer) is actively targeting users via ClickFix lures with interactive browser hijacking capability. Metasploit 6.5 shipped 13 new exploit modules covering multiple enterprise products, significantly lowering the barrier to exploitation for several previously reported CVEs. No new CISA KEV additions or BSI/CERT-EU advisories were published in the last 24 hours.

Critical Vulnerabilities

CVE-2026-73056 — SiYuan Note-Taking App (Authentication Brute-Force Bypass)

  • Severity: CVSS 9.3
  • EPSS: 0.0 (newly published)
  • Technical detail: SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts in the CheckAuth() middleware. The middleware accepts the API token via URL query parameters and performs no rate-limiting or lockout, enabling brute-force attacks against the API token. Combined with the RCE via template injection (CVE-2026-73043) reported yesterday, a remote unauthenticated attacker can brute-force the token and then achieve code execution. This is a distinct, newly published CVE not covered in yesterday’s report.
  • Exploitation status: No confirmed in-the-wild exploitation.
  • Remediation: Upgrade SiYuan to v3.7.4. This CVE is additive to the cluster reported yesterday — if not yet patched, treat the combined RCE + auth bypass as critical priority.

CVE-2026-50602 — Acer Planet9 Background Service (Local Privilege Escalation)

  • Severity: CVSS 8.5
  • EPSS: 0.0 (newly published)
  • Technical detail: Incorrect file permissions on an executable used by the Planet9 background service, which runs with SYSTEM privileges. A local attacker can replace the executable with a malicious binary to achieve SYSTEM-level code execution. Affects Acer enterprise management software deployed on corporate endpoints. The attack requires local access but is trivially exploitable once achieved.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Apply Acer’s patch for Planet9. Audit Planet9 service executable permissions; restrict write access to the affected path to administrators only.

CVE-2026-74796 — OpenTofu (Symlink Attack / Arbitrary File Write)

  • Severity: CVSS 7.0
  • EPSS: 0.0 (newly published)
  • Technical detail: OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. An attacker who can place a malicious symlink in a trusted working directory (e.g., a shared CI/CD workspace) can cause tofu init to follow the symlink and overwrite arbitrary files. In CI/CD pipeline contexts — common in European enterprise environments — this could enable supply chain compromise or privilege escalation.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade OpenTofu to 1.11.7. Audit CI/CD pipeline working directories for unexpected symlinks; restrict write access to provider cache directories.

CVE-2026-74251 — Phoca Cart for Joomla (Unauthenticated SQL Injection)

  • Severity: CVSS 9.3
  • EPSS: 0.0 (newly published)
  • Technical detail: Unauthenticated SQL injection via the a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart’s public shop pages, affecting versions 5.0.0–6.1.6. No authentication is required; exploitation is straightforward from the public internet. Phoca Cart is a widely used Joomla e-commerce extension with European adoption. Full database read/write access is likely achievable.
  • Exploitation status: No confirmed exploitation; unauthenticated network-exploitable SQLi warrants urgent treatment.
  • Remediation: Update Phoca Cart to 6.1.7 or later. Until patched, consider WAF rules blocking array-based GET parameter injection on shop endpoints.

CVE-2026-48907 — Joomla JCE (Unauthenticated File Upload RCE) — STATUS CHANGE

  • Status change: Metasploit 6.5 (released 2026-08-14, wrap-up published 2026-08-16) includes a fully weaponized public exploit module (multi/http/joomla_com_jce_unauth_file_upload_rce). This materially lowers exploitation risk — unauthenticated RCE is now one msfconsole command away.
  • Update: Treat any unpatched JCE instance as actively compromised. Immediately audit tmp/ directories for PHP web shells and review web server access logs for POST requests to the profiles.import task.

ONGOING:

  • CVE-2026-18438 (Templately ≤ 3.7.1): EPSS 0.98 RCE — update immediately.
  • CVE-2026-15826 (User Profile Builder ≤ 3.16.4): EPSS 0.81 auth bypass — update immediately.
  • CVE-2026-74764 (Pandora ≤ 1.12.5): CVSS 10.0 path traversal/RCE — upgrade and isolate.
  • CVE-2026-73043 (SiYuan < 3.7.4): RCE via template injection — upgrade to v3.7.4.
  • CVE-2026-14484 (RapiSafe ≤ 1.0.4): EPSS 0.76 arbitrary file deletion — update or deactivate.
  • CVE-2026-58231 (SAP Commerce Cloud): Active exploitation — patch and initiate IR review.
  • CVE-2026-59310 (VMware vCenter): Active exploitation — patch immediately.
  • CVE-2026-68820 (Windows AFD/Lazarus): CISA KEV deadline 2026-08-25 — apply August Patch Tuesday.
  • CVE-2026-55040 (SharePoint): Active exploitation — apply July 2026 Patch Tuesday.
  • CVE-2026-63077 (JetBrains TeamCity): Actively exploited — upgrade to 2026.1.3.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation — patch immediately.
  • CVE-2026-16232 (Check Point SmartConsole): Actively exploited — treat unpatched as compromised.
  • CVE-2026-8037 (Progress Kemp LoadMaster): Ransomware exploitation — patch immediately.

European Advisories

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

Heise Security reports that Russian cybercriminals claim to have stolen data from Shell, Philips, GE, and other energy and medical technology companies, exploiting vulnerabilities disclosed in July 2026. The Clop ransomware gang’s prior claim against Shell (reported 2026-08-14) appears connected. This has direct European critical infrastructure relevance — see Active Threats below.

Heise Security also reports on a side-channel vulnerability in older AMD processors allowing access to the AMD PSP (Platform Security Processor) RAM. Affects legacy AMD hardware; enterprise impact is limited to environments running older AMD-based servers. Monitor AMD security advisories for patch availability.

Previously reported BSI advisories for PostgreSQL, Golang, Budibase, Elasticsearch, Linux Kernel, and Fortinet FortiWeb remain open — apply vendor patches per standard cycle.

Active Threats and Campaigns

NEW — Russian Cybercriminals: Mass Data Theft from Energy and MedTech Firms: Threat actors (reportedly Russian cybercriminals, potentially Clop-affiliated) claim to have exfiltrated data from Shell, Philips, GE, and additional energy and medical technology companies. Heise Security reports the exploited vulnerabilities were disclosed in July 2026. European organizations in energy, utilities, and healthcare should treat this as an active threat: audit July 2026 patch status, review third-party service provider access, and hunt for indicators of data exfiltration. Shell has confirmed an investigation is ongoing. No public IOCs available at this time. (Heise Security)

NEW — AmnesiaStealer macOS Malware: A new macOS information stealer distributed via ClickFix social engineering lures. Uniquely, AmnesiaStealer includes a streaming module enabling the attacker to interactively control the victim’s browser in real time, enabling session hijacking beyond credential theft. Targets macOS users; relevant for organizations with mixed-OS environments or macOS-heavy developer/executive populations. No public IOCs yet. (Bleeping Computer)

NEW — Threema DDoS Disruption: Large-scale DDoS attacks disrupted the Threema secure messaging service earlier this week. Relevant for European organizations using Threema as a secure communications channel — assess backup communication procedures. (Bleeping Computer)

ONGOING — Evooo1Bot Linux Botnet: Targeting internet-facing gateway devices; no new developments. Audit for unexpected SOCKS5 outbound connections and apply firmware updates.

ONGOING — macOS Screen Sharing active exploitation: No new developments; apply Apple updates, disable Screen Sharing where not required.

Security News and Context

  • SafePal data breach: Cryptocurrency wallet provider SafePal confirmed a breach affecting ~39,798 customers; stolen order data is being sold by a threat actor. (Bleeping Computer)
  • Metasploit 6.5 released: 13 new exploit modules added, including weaponized RCEs for Joomla JCE, SonicWall SMA1000, Ghost CMS, Langflow, and a Linux kernel LPE (CVE-2026-46300). Significantly lowers exploitation barrier for multiple enterprise targets. (Rapid7)
  • Wireshark 4.6.8: Fixes 28 vulnerabilities and 25 bugs; update analyst workstations. (SANS ISC)
  1. Energy/MedTech orgs (Shell/Philips/GE campaign): Audit July 2026 patch status, review third-party provider access logs, and initiate threat hunt for data exfiltration indicators.
  2. CVE-2026-48907 (Joomla JCE): Public Metasploit module now available — immediately audit tmp/ for PHP web shells; treat unpatched instances as compromised.
  3. CVE-2026-73056 (SiYuan < 3.7.4): Upgrade to v3.7.4; combined with yesterday’s RCE, unauthenticated exploitation is now a realistic scenario.
  4. CVE-2026-74251 (Phoca Cart 5.0.0–6.1.6): Update to 6.1.7+; deploy WAF rules for unauthenticated SQLi on shop endpoints.
  5. CVE-2026-50602 (Acer Planet9): Apply Acer patch; restrict write access to service executable path.
  6. CVE-2026-74796 (OpenTofu < 1.11.7): Upgrade; audit CI/CD pipeline directories for unexpected symlinks.
  7. AmnesiaStealer: Brief macOS users on ClickFix lures; enforce browser session controls and MFA on critical SaaS platforms.
  8. Threema disruption: Verify backup secure communications channels are operational for teams relying on Threema.
  9. Wireshark: Update to 4.6.8 on all analyst workstations.
  10. Continue remediation of previously reported items: CVE-2026-18438 (Templately), CVE-2026-15826 (User Profile Builder), CVE-2026-74764 (Pandora), CVE-2026-58231 (SAP Commerce Cloud), CVE-2026-59310 (vCenter), CVE-2026-68820 (Windows/Lazarus — KEV deadline 2026-08-25), CVE-2026-55040 (SharePoint), CVE-2026-63077 (TeamCity), CVE-2026-0257 (PAN-OS), CVE-2026-16232 (Check Point), CVE-2026-8037 (LoadMaster).