This Week's Signals: WatchGuard Firewall RCEs, a 9.5M-Patient Breach, and Memory Integrity Goes Default

Some weeks the news is one big story. This one was a pile of smaller ones, most of them the kind a security team has to act on quietly: firewalls to patch, an exposed mail-server fleet to count, a breach notification to read closely. None of these got a standalone piece here, so this is the triage. What this roundup adds is prioritization: which of the week’s disclosures need a change window right now, which are worth watching, and one concrete action for each. We lead with the flaws already under attack.

Critical Vulnerabilities and Active Exploitation

Four of this week’s flaws are either being exploited right now or have a working exploit in public hands. If you run any of the affected products, treat the list below as your patch order for the week, not a backlog item. Ranking fixes by real-world exploitation, rather than CVSS alone, is the core of vulnerability management, and this week it is the difference between a routine update and an incident.

This week’s patch-now list, ordered by exploitation status. Four flaws (Exchange, Sangoma, Langflow, and Rails) are under active attack or have a public exploit; the WatchGuard trio is a critical patch with no confirmed exploitation yet. Source: WatchGuard PSIRT, Horizon3.ai, VulnCheck, and Shadowserver.

WatchGuard Patched Three Critical Firewall RCEs in the IKE Daemon

WatchGuard shipped three Fireware OS branches on August 27 to fix 11 flaws, including three critical (CVSS 9.3) remote code execution bugs in iked, the daemon that handles IPsec VPN key exchange. Per WatchGuard’s advisory, the trio (CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318) lets an attacker trigger a heap overflow, a stack overflow, or a type confusion with crafted network traffic, and each is reachable before authentication. As SecurityWeek noted, this is the third critical iked RCE in WatchGuard’s stack in under a year. Do this: update to Fireware OS 2026.2.2, 12.12.2, or 12.5.20 now. If you cannot patch a branch-office box immediately, restrict IKE and IPsec exposure on the WAN until you can.

Sangoma Switchvox Is Under Active SQL-Injection-to-RCE Attack

Attackers began hitting Sangoma Switchvox VoIP systems on August 30, exploiting CVE-2026-9586, an unauthenticated SQL injection in the SMB Edition that chains to remote code execution (CVSS 9.3). Per Horizon3.ai, the /pa endpoint concatenates a user-supplied value straight into a PostgreSQL query running with superuser rights, so injected statements can execute operating-system commands. BleepingComputer reports intruders dropping reverse shells and staging follow-on malware. The fix (8.4.0.2) shipped July 14, so this is exposure sitting on unpatched boxes. Do this: upgrade to Switchvox SMB 8.4.0.2, take any Switchvox admin interface off the public internet, and hunt for unexpected shells or new scheduled tasks.

Langflow and Rails Flaws Are Being Probed for Secrets and RCE

VulnCheck telemetry shows attackers actively exploiting two critical flaws, per The Hacker News. The first is CVE-2026-0768 (CVSS 9.8), an unauthenticated RCE in the code validator of Langflow, the low-code AI-app builder, that runs arbitrary Python as root. The second, CVE-2026-66066 (CVSS 9.5, nicknamed “KindaRails2Shell”), lets an unauthenticated attacker read arbitrary files and leak Ruby on Rails secrets, leading to RCE. VulnCheck logged detections climbing from about 50 to 360 within a day of the August 30 activity, much of it querying environment variables and reading secret keys. Do this: patch Langflow and Rails to fixed versions, rotate any secrets those hosts held, and keep a Langflow instance off the public internet entirely.

Nearly 22,000 Exchange Servers Remain Exposed to an Auth-Bypass Flaw

The Shadowserver Foundation counted 21,899 internet-facing Microsoft Exchange servers still vulnerable to CVE-2026-62911 as of August 31, per Help Net Security. The flaw (CVSS 8.0) is an authentication bypass by capture-replay: an attacker who can capture and replay authentication traffic can impersonate users and escalate privileges across Exchange. Microsoft disclosed it on August 11, and NCSC-NL says a working exploit is now circulating, with a public proof-of-concept on GitHub. The United States (about 6,200) and Germany (about 5,100) lead the exposed count. Do this: apply Microsoft’s August Exchange updates, and use Shadowserver’s daily Vulnerable Exchange Server report to confirm your own IP ranges are clean.

Breaches, Espionage, and Malware

The week’s incident side had a familiar shape: a giant healthcare breach that traces to a vendor’s cloud, a nation-state group refreshing its malware, and a criminal campaign that turns off your defenses before it does anything else.

Aesto Health Breach Exposed 9.5 Million Patients via AWS

Aesto Health, an Alabama-based health-data migration and archiving vendor, told regulators that 9,540,683 people had personal and medical data stolen from its Amazon Web Services environment, per SecurityWeek. The intrusion, discovered on December 18, 2025, saw attackers exfiltrate names, Social Security numbers, driver’s license numbers, dates of birth, financial account numbers, and health and insurance information between December 2 and 18. BleepingComputer notes it ranks among the year’s largest confirmed healthcare breaches. The lesson is downstream cloud exposure: a single vendor’s AWS estate held records for millions of patients across many providers. Do this: inventory which vendors and business associates hold your patient or customer data in their own cloud tenants, and confirm what logging and monitoring they actually run on it.

Iran-Linked Mirage Kitten Adds NodeRabbit and PollCat RATs

Kaspersky says the Iranian espionage group Mirage Kitten (also tracked as UNC1549 and Nimbus Manticore) has rolled out two previously undocumented cross-platform remote-access trojans, NodeRabbit (built in Node.js) and PollCat (obfuscated JavaScript), against aviation and fintech targets across the Middle East and Africa. Per Kaspersky’s Securelist, the group lures software-development applicants through fake LinkedIn recruiting and trojanized coding-challenge archives, and the RATs can hit Windows, Linux, and macOS. It is the group’s first documented use of Node.js and JavaScript malware. Do this: warn engineering and hiring teams about “coding test” archives sent by recruiters, and treat developer laptops that run unvetted challenge code as a monitored risk, not a convenience.

Microsoft: Fake Installers Disable Windows Update and Weaken Defender

Microsoft Threat Intelligence detailed a campaign that uses spoofed software-download sites to deliver malicious installers, which then blind the host, per The Hacker News. The malware adds Microsoft Defender exclusions via PowerShell, deletes volume shadow copies, and disables Windows Update by stopping and disabling wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming update DLLs, and clearing the SoftwareDistribution cache. Microsoft assesses with moderate confidence that the activity is consistent with the China-based Silver Fox cluster, a known user of spoofed vendor pages to push Gh0st RAT and ValleyRAT. Victims span healthcare, manufacturing, government, and more. Do this: alert on tampering with those four update services and on newly created Defender exclusions, and block user-initiated installs from unverified download domains.

Platform and Policy Hardening

Two developments this week were not attacks at all, but they change the ground defenders stand on: a default-on Windows protection arriving next month, and a federal warning about a phishing technique that walks around your MFA.

Windows Will Auto-Enable Memory Integrity in October

Starting in October 2026, Microsoft will automatically turn on Memory Integrity (Hypervisor-protected Code Integrity, or HVCI) on eligible Windows 11 devices through standard quality updates, per Help Net Security. HVCI checks kernel-mode code and drivers against a trusted list before they run, and it depends on Virtualization-based Security (VBS), which the October updates will also switch on where it is off. The rollout targets machines upgraded from older Windows or shipped with the feature disabled. Existing administrator or policy decisions to keep it off are respected, and incompatible drivers are the main friction point. Do this: test HVCI against your driver fleet and legacy line-of-business software now, so October’s change lands as a validated rollout rather than a support surprise.

FBI Warns of OAuth Consent Phishing Aimed at Prominent People

The FBI’s Internet Crime Complaint Center warned that since late 2025, attackers have targeted prominent individuals, their family members, and associates with OAuth consent phishing, per the IC3 public service announcement. Instead of stealing a password, the attacker gets the victim to authorize a malicious application through a legitimate OAuth flow, often via a messaging-app link disguised as a file-sharing request. Because the grant is an access token, it sidesteps both passwords and multi-factor authentication, and a password reset does not revoke it. Do this: teach high-risk users to scrutinize app-authorization prompts, and know where to review and revoke third-party app grants in Microsoft 365 and Google Workspace. Revoking the token, not changing the password, is what actually cuts off access.

The Throughline

My read: the thread tying this week together is speed of exploitation. Sangoma, Langflow, Rails, and Exchange all moved from patch or disclosure to real-world attacks or public exploits within days, which means a monthly patch cadence is no longer a safe default for anything internet-facing. Treat the four red items in the list above as this week’s non-negotiables. Everything else here, from Aesto’s cloud exposure to the FBI’s token-phishing alert, points the same direction: the controls that catch these are inventory and monitoring you either already own or can stand up cheaply. Most of this is ordinary defensive hygiene. The only thing that changed is how little time you have to apply it.

Also This Week on The CyberSignal

The stories we covered in full this week:

• SonicWall SMA 1000 Zero-Day Chain Under Active Attack: CVE-2026-83548 and CVE-2026-83549
• Malicious .git Configs Can Make Claude Code, Codex, and Cursor Run Attacker Code
• DOJ and CrowdStrike Disrupt Sality, the 23-Year-Old P2P Botnet, by Poisoning Its Own Peer List
• JFrog Artifactory CVE-2026-82329 Exploited Days After Disclosure to Mint Admin Tokens
• METR API Key Theft: Attacker Burned $600K in AI Model Credits Undetected for Weeks
• FSB Warns Frontier AI Cyber Risk Is the ‘Most Immediate Concern’ to the Global Financial System
• OpenAI Flags Astra as Its First Model With ‘Critical’ Cyber Capabilities