InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has asked federal agencies to protect their systems by Sunday from a serious Splunk Enterprise flaw that is being used in attacks.
Tracked as CVE-2026-20253, this security flaw impacts Splunk Enterprise (versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6). It lets remote attackers without permissions make or delete any files on weak devices using a PostgreSQL sidecar service endpoint.
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
“The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” the Splunk security team said in a security advisory published last week.
On June 12, a few days after Splunk fixed security flaws, WatchTowr shared a technical article, provided proof-of-concept code, and warned that the weakness can be used for remote code execution attacks.
On Wednesday, June 18, Splunk told customers to fix their systems right away because they found proof of attacks happening.
“In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability,” it said.
Shadowserver, a group that checks Internet security, keeps an eye on more than 1,400 Splunk systems that are open on the Internet. Most of these are in North America (952) and Europe (223). But, we don’t know how many of them can be attacked because of the CVE-2026-20253 flaw.
On Thursday, CISA said that hackers are now using the CVE-2026-20253 weakness in their attacks. They told Federal Civilian Executive Branch (FCEB) agencies to fix their Splunk systems by Sunday, as required by Binding Operational Directive (BOD) 26-04.
Issued last week, CISA’s BOD 26-04 requires U.S. government agencies to prioritize patching based on each vulnerability’s risk of exploitation.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency said yesterday. “Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.”
Splunk also gave tips for admins who can’t patch vulnerable systems right away, suggesting they turn off the PostgreSQL sidecar service to lower the risk.
