TL;DR
Active exploitation of Sangoma Switchvox VoIP flaws and WordPress backup plugin vulnerabilities exposes organizations to unauthenticated RCE attacks. Malicious fake software installers are disabling Windows Defender and blocking updates across multiple sectors. AI agent security gaps discovered in Git configurations pose developer compromise risks.
Executive Summary
- Sangoma Switchvox SQL injection vulnerability (CVE-2026-9586) is actively exploited to deploy reverse shells on VoIP systems.
- WordPress All-in-One WP Migration plugin SQL injection (CVE-2026-19949) allows unauthenticated RCE affecting millions of sites.
- Fake software installers conducting active malware campaign disable Windows Update and weaken Microsoft Defender across multiple industries.
- Eight security flaws in AI coding agents (Claude, Codex, Cursor, others) allow malicious Git configurations to execute attacker code on developer machines.
- Chinese-speaking cybercrime group “Gambling Goblin” deploys malicious Apache modules on Brazilian government and education servers to redirect traffic to gambling pages.
Top Threats Today
1. Sangoma Switchvox VoIP Platform – Unauthenticated RCE via SQL Injection
Severity: HIGH Affected: telecom
Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox VoIP platform, to deploy reverse shells and gain remote code execution [1]. The vulnerability requires no authentication, making it accessible to remote attackers on exposed instances.
Sources:[1] BleepingComputer
Recommended Action
- Immediately inventory all Sangoma Switchvox deployments and assess exposure to internet-facing access
- Apply vendor security patches as soon as available and verify SQL injection input validation is enabled
- Restrict network access to VoIP administration interfaces using IP allowlisting and network segmentation
- Monitor VoIP logs for SQL injection attempts and unexpected outbound reverse shell connections
2. WordPress All-in-One WP Migration Plugin – SQL Injection Takeover
Severity: HIGH Affected: technology
An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress (CVE-2026-19949) allows unauthenticated attackers to execute remote code and gain full control of affected websites [1]. The plugin's widespread adoption puts millions of WordPress sites at direct risk.
Sources:[1] BleepingComputer
Recommended Action
- Audit WordPress installations for the All-in-One WP Migration plugin and disable or remove it immediately
- If the plugin must remain in use, update to the patched version and restrict database access via WAF rules
- Check web server logs for SQL injection payloads targeting common plugin endpoints
- Reset administrator credentials and review user access logs for unauthorized account creation
3. Fake Software Installers – Windows Defender Disablement Campaign
Severity: HIGH Affected: technology
An active malware campaign is using bogus software-download websites impersonating trusted vendors to distribute malicious installers that disable Windows Update and weaken Microsoft Defender [1]. The campaign has targeted users seeking popular software and resulted in compromises across multiple organizations and industries.
Sources:[1] The Hacker News
Recommended Action
- Distribute security awareness training emphasizing software downloads only from official vendor websites and signed repositories
- Deploy DNS and web filtering to block known malicious download sites and lookalike domains
- Force Windows Update to mandatory via Group Policy and monitor for disabled Defender via EDR alerting
- Scan internal systems for disabled or tampered Windows Defender services; restore from backup if necessary
4. AI Coding Agents – Malicious Git Configuration Code Execution
Severity: HIGH Affected: technology
Manifold Security disclosed eight security flaws across seven command-line AI coding agents (including Claude, Codex, Cursor, and others) in which a Git repository's configuration can name a command that the agent runs on the developer's machine [1]. Four flaws remain unpatched, and the command executes outside the agent sandbox with full user privileges. ⚠
Sources:[1] The Hacker News
Recommended Action
- Check vendor advisories for CVE patches to AI agent tools and prioritize patching unpatched tools immediately
- Educate developers to review .git/config files and custom hook scripts before cloning untrusted repositories
- Disable automatic repository hook execution in agent tools where available
- Implement code review and repository access controls to restrict untrusted external dependencies
5. Gambling Goblin – Malicious Apache Modules on Brazilian Government Infrastructure
Severity: HIGH Affected: government
A Chinese-speaking cybercrime cluster known as Gambling Goblin has installed malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, diverting visitors to attacker-controlled pages promoting online gambling and sports betting [1].
Sources:[1] The Hacker News
Recommended Action
- Audit Apache module configurations and verify integrity of loadable modules against vendor checksums
- Review access logs for suspicious module loads or unexpected proxy redirects
- Patch Apache web servers and apply strict change management for module deployment
- Implement file integrity monitoring (FIM) on Apache configuration and module directories
Today’s Action Checklist
- ☐ URGENT: Identify and patch Sangoma Switchvox instances; block internet-facing access if patching delayed
- ☐ URGENT: Disable or update All-in-One WP Migration plugin across all WordPress sites; review admin accounts
- ☐ HIGH: Scan for disabled Windows Defender and Windows Update via EDR; reimage compromised endpoints
- ☐ HIGH: Brief development teams on Git configuration attack surface; patch AI coding agent tools
- ☐ HIGH: Audit web server configurations and Apache modules for signs of compromise; verify domain redirect integrity