Daily briefing · August 21, 2026
SPIP and GeoTools Under Active Exploitation as Incus Quad-Flaw Enables Host Escape
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention2 seen before CISA
August 21, 2026 carries an ATTENTION-level verdict: two vulnerabilities — CVE-2026-77806 in SPIP and CVE-2026-76904 in GeoTools — were already observed being exploited in the wild by VulnCheck before any official CISA KEV designation, a clear early-warning signal that attackers moved fast. Alongside these, four critical flaws in the Incus container and VM manager enable authenticated users to escape project isolation and execute arbitrary code as root on the host, making this a high-density day for infrastructure defenders. Teams running SPIP, GeoTools with PostGIS, Xinference, Azure SQL Database, or Incus prior to version 7.3.0 should treat today's bulletin as actionable.
Today’s brief
- CVE-2026-77806 (SPIP): unauthenticated RCE actively exploited in the wild — patch or take offline immediately
- CVE-2026-76904 (GeoTools): SQL injection with CVSS 9.8 already seen exploited before CISA confirmation — prioritize if PostGIS-backed
- Incus receives four CVSS 9.9 flaws enabling container escape, privilege escalation, and host file overwrite — update to 7.3.0
- Brazil is under sustained ransomware pressure, with public sector and professional services hit by thegentlemen and emperador
Critical highlights
1
A SQL injection vulnerability in GeoTools' PostGIS DataStore implementation allows attackers to manipulate OGC Filter queries via the jsonArrayContains function, affecting versions 30.5 through the patched releases. VulnCheck observed exploitation before CISA confirmation, signaling rapid attacker interest — organizations using GeoTools with PostGIS 12 or newer must patch immediately.
2
An unauthenticated attacker can inject arbitrary code into SPIP via a crafted X-Spip-Filtre HTTP request header, with active exploitation in the wild confirmed in August 2026 and detected by VulnCheck before CISA. Any internet-facing SPIP installation below version 4.4.21 should be considered compromised-at-risk and patched or taken offline without delay.
3
Xinference passes attacker-controlled Llama3 tool-call output directly to eval(), enabling remote code execution through the /v1/chat/completions endpoint when the tools field is present. With a CVSS 10.0 score and no authentication barrier apparent in the attack path, any exposed Xinference API endpoint running version 2.5.0 or earlier is an unacceptable risk.
4
A server-side request forgery flaw in Azure SQL Database allows an unauthenticated network attacker to elevate privileges, receiving a rare CVSS 10.0 rating. Defenders should monitor Microsoft's advisory for patch availability and apply any available mitigations to restrict lateral network access from database infrastructure.
5
Nezha Monitoring fails to bind stream identifiers to the creating user, allowing any authenticated RoleMember to hijack terminal and file transfer WebSocket sessions belonging to other users. Versions 1.14.13–1.14.14 and 2.0.0–2.0.9 are affected; operators running Nezha for server management should upgrade and audit who holds RoleMember access.
6
A malicious Incus image containing a symlink in metadata.yaml pointing to an arbitrary host path lets an authenticated user read or overwrite any file on the host as root through the instance metadata API. All Incus deployments below 7.3.0 are vulnerable — multi-tenant or shared infrastructure environments face the highest exposure.
7
An unprivileged, project-confined Incus user with image and instance creation rights can achieve arbitrary code execution as root on the host by shipping a crafted image with backup.yaml as a symlink, which the root daemon follows during write operations. This effectively nullifies Incus project isolation prior to version 7.3.0.
8
When copying an instance across Incus projects, dangerous configuration keys such as security.privileged and raw.lxc are merged into the request after the project restriction check, allowing a restricted user to bypass controls and run a privileged container. The race between check and merge makes this a logic-level flaw that is difficult to detect without patching.
9
During cluster member migration in Incus, user-supplied configuration overrides including security.privileged and raw.lxc are applied without project restriction enforcement, enabling a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 is the only effective remediation.
10
Improper validation of user-supplied block.create_options in Incus storage volume configuration allows argument injection into filesystem creation commands executed as root. A project-scoped user can weaponize this to run arbitrary arguments as root, completing a set of four critical Incus escapes all resolved in version 7.3.0.
Ransomware today
Recently, thegentlemen and emperador have claimed Brazilian victims, with UOLconsult in the Professional Services sector and Prefeitura Municipal de Arcos in Government & Defense added to their respective leak sites. Among the most active groups over the past 30 days, thegentlemen stands out with six Brazilian victims, followed by Section9 with six, and Global Secret Group with four — indicating a coordinated and sustained focus on Brazilian targets across sectors.
UOLconsult BRthegentlemen · Professional Services
Prefeitura Municipal de Arcos BRemperador · Government & Defense
thegentlemen 6Section9 6Global Secret Group 4L Group 2direwolf 2emperador 1
Active groups & APTs
Several threat actor aliases — including kazu, kelvinsecurity, krybit, lamashtu, linkc, and the Iranian-linked group blackshadow — are tracked as currently active or recently updated, though no attributed victims have been publicly confirmed for these groups at this time. The presence of an Iranian state-linked actor such as blackshadow in the active tracking list warrants monitoring, particularly for organizations in sectors historically targeted by Iranian cyber operations.
Brazil focus
Brazil continues to face intense ransomware activity, with recent victims spanning government, technology, manufacturing, legal, and professional services sectors. Notable targets include TOTVS (Technology) hit by direwolf, VR Advogados (Professional Services) by Barracuda, Megalaser Industria Metalurgica LTDA (Manufacturing) by thegentlemen, and Vermont XCenter by dragonforce — reflecting a broad, opportunistic campaign against Brazilian organizations with no single sector spared.
UOLconsultthegentlemen · Professional Services
Prefeitura Municipal de Arcosemperador · Government & Defense
Vermont XCenterdragonforce
TOTVSdirewolf · Technology
VR AdvogadosBarracuda · Professional Services
tecnoabi.comm3rx · Technology
Vector Two Technologythegentlemen · Technology
Megalaser Industria Metalurgica LTDAthegentlemen · Manufacturing
Today’s recommendation: Prioritize immediate patching of SPIP to 4.4.21 or later and Incus to 7.3.0, as these represent the highest combination of confirmed exploitation and privileged access impact; also audit and restrict external exposure of GeoTools PostGIS endpoints and any Xinference API instances running version 2.5.0 or below.
Given the breadth of affected platforms — from web CMS and geospatial libraries to container managers and cloud databases — now is the time to validate your own attack surface to determine which of these vulnerabilities your environment is actually exposed to.Don’t wait to become a statistic: validate today, at no cost, whether any of these vectors reach your systems.Meet the Autonomous AI Pentest Agent →Previous briefings
September 8, 2026 — Windows Under Active Exploit, ScreenConnect Zero-Day Detected Before CISA: September 8 Security BulletinSeptember 7, 2026 — 22 Critical CVEs Published on a Quiet Day, With Heavy Ransomware Pressure on BrazilSeptember 6, 2026 — Quiet Day Hides Real Risks: Tenda HG10, NEC UNIVERGE, and Brazilian Ransomware Surge Demand AttentionSeptember 5, 2026 — WordPress Plugin Wave and Tenda CP3 Flaws Lead a Calm But CVE-Heavy DaySeptember 4, 2026 — WordPress Plugins and FreeIPMI Lead a Calm but Patch-Heavy DaySeptember 3, 2026 — Four CVSS 10.0 Critical CVEs Headline a Calm But Dense Vulnerability DaySeptember 2, 2026 — WordPress Plugins Under Fire, Cisco IOS XR and NX-OS in the Crosshairs: ATTENTION Day With Active ExploitationSeptember 1, 2026 — Active Exploitation of Proxmox and SonicWall SMA1000 Leads a High-Alert DayAugust 31, 2026 — WordPress Plugins and Tenda Routers Dominate a High-Alert Day With 41 Critical CVEsAugust 30, 2026 — Calm Day Hides Sharp Edges: Critical Code Injection and Router Flaws Top August 30 BulletinAugust 29, 2026 — Ten Active-Exploitation CVEs Dominate as Ransomware Groups Hammer BrazilAugust 28, 2026 — 10 Actively Exploited CVEs Demand Immediate Action: Metabase, VMware, macOS, Cisco, and More Under FireAugust 27, 2026 — Router Firmware Under Active Exploitation and WordPress Wave Raises Alerts on August 27August 26, 2026 — Ubiquiti UniFi and Gitea Face Active Exploitation Alerts as 62 Critical CVEs Emergeview full archive →