Cybersecurity, August 20 Threats: From Gogs to macOS, Signed Drivers, and Targeted Campaigns

Gogs Exposes Git Servers to Remote Code Execution

The most serious vulnerability affects Gogs, an open-source, self-hosted platform for managing Git repositories. Tracked as CVE-2026-52813, the flaw affects versions before 0.14.3.

The issue lies in how organization names are handled. By inserting traversal sequences such as ../, an attacker can cause repositories to be written to arbitrary filesystem paths outside the directory intended by the application.

This manipulation can be used to create a nested Git repository structure and overwrite the hooks of another repository. Git hooks run during specific Git operations, so modifying them can ultimately lead to remote code execution on the server.

The vulnerability has a CVSS score of 10, and its vector indicates network-based exploitation without authentication or user interaction:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The flaw is classified as CWE-23, Relative Path Traversal. The fix is available in Gogs 0.14.3.

Administrators should update instances immediately and inspect repositories, hooks, and paths created before the update. It is not known whether this CVE is listed in CISA’s KEV Catalog; based on the available information, no agency-imposed remediation deadline can therefore be established.

macOS Fixes a Vulnerability Affecting Data Access

Apple has fixed CVE-2026-43774, a vulnerability that could allow an application to access sensitive user data through an error in memory-bound checks.

NVD describes the issue as an out-of-bounds read addressed through stronger validation. The CISA-ADP classification instead associates the flaw with CWE-787, which concerns an out-of-bounds write. This discrepancy does not by itself clarify the real-world impact, but it highlights an inconsistency in the technical description.

Affected versions include:

• macOS from 14.0 through versions before 14.8.8;
• macOS from 15.0 through versions before 15.7.8;
• macOS from 26.0 through versions before 26.6.

The fixed versions are macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, and macOS Tahoe 26.6. The NVD record lists the CVE publication date as July 27, 2026, with subsequent updates on July 28 and 29, 2026.

A CVSS 4.0 score is not available. CISA-ADP reports a CVSS 3.1 score of 5.5, with the following vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitation requires local access and user interaction. The stated impact primarily concerns data confidentiality, with no impact reported for integrity or availability.

Mac users should install the corresponding Apple updates. It is not known whether CVE-2026-43774 has been added to the KEV Catalog. Over the past 90 days, however, the catalog has included two other Apple vulnerabilities: CVE-2026-65400 on August 18, 2026, and CVE-2026-11645 on June 9, 2026.

CircleCI Fixes MCP Server Authentication Bypass

Another critical vulnerability affects the npm package @circleci/mcp-server-circleci, used by CircleCI’s MCP server. Advisory GHSA-xv5j-cwgj-22r4 was published on August 10, 2026.

The flaw affects the remote transport server. When request-based authentication is disabled, the component may accept unauthenticated clients that are not browser-based.

The bypass exploits insufficient validation of the Host and Origin headers. An exposed instance with authentication disabled could therefore allow access from clients that should not be considered trusted.

Versions from 0.16.1 through 0.19.1, inclusive, are affected. The fixed version is 0.19.2.

Mitigation consists of updating the package and ensuring authentication is not disabled on network-accessible instances. It is not known whether the vulnerability has been exploited or added to CISA’s KEV Catalog.

Legitimate Drivers and Common Applications Become Attack Tools

Check Point reverse engineering has uncovered abuse of the Microsoft Defender boot-time removal driver, BTR.sys, known as the Defender Boot-Time Removal driver.

The file is signed by Microsoft but can be repurposed as a generalized tool for kernel-level operations. Attackers can use it during the phase between system startup and user-mode initialization, bypassing controls enforced by some EDR products.

This is not the classic BYOVD scenario involving a vulnerable driver introduced by the attacker. Here, the issue is the operational abuse of a legitimate, signed component whose reputation alone is insufficient to distinguish authorized use from malicious activity.

The BTR_CLI tool can imitate the behavior of the legitimate Windows Defender remediation process. Security teams should therefore correlate anomalous loading of BTR.sys, kernel activity during boot, use of BTR_CLI, and the termination or modification of EDR components.

Another campaign distributes Grandoreiro through Duplicate Files Finder (DFF), a legitimate application used for DLL sideloading. Observed infections primarily affect Mexico, Spain, Peru, and Argentina.

The initial sample checks for sandboxes, virtual machines, and blacklisted processes before contacting the C2 server. Useful indicators therefore include unusual execution of DFF, loading of unexpected DLLs, and creation of child processes inconsistent with the program’s normal behavior.

ClickFix, Vulnerable Drivers, and Academic Campaigns

ErrTraffic, a MaaS framework and traffic-distribution system associated with the LenAI actor, fuels campaigns based on compromised WordPress sites and ClickFix pages.

The chain may begin with obfuscated JavaScript, continue with C2 domain resolution through a Polygon smart contract, and end with payload delivery. In one observed sequence, Remus Stealer is executed through process hollowing.

Another operation distributes Cruciferra by exploiting the legitimate but vulnerable DCRCVDrv.sys driver. The goal is to obtain elevated privileges and terminate security processes. Defenses should include blocking vulnerable drivers, monitoring the integrity of WordPress sites, and detecting obfuscated scripts and process hollowing.

On the espionage front, the U.S. Department of Justice has indicted 17 members of the Mabna Institute, an Iranian company accused of operating on behalf of the IRGC.

The campaign reportedly began around 2013 and continued at least through December 2017. It allegedly targeted 144 U.S. universities, 178 foreign universities, at least 42 U.S. private companies, 11 foreign private companies, five U.S. government agencies, and two NGOs.

According to the indictment, more than 31 TB of data was stolen and over 100,000 academic accounts were targeted, with approximately 8,000 accounts compromised. The credentials and content were allegedly resold through Megapaper.ir and Gigapaper.ir.

The State Department is offering a $10 million reward for information about five defendants or related individuals and entities. Universities and research centers remain attractive targets because of the value of their intellectual property and identity controls that are sometimes less stringent than those in corporate environments.

Industrial Systems and Backdoors Require Specialized Controls

Claroty Team82 identified 23 vulnerabilities in Copeland XWEB Pro controllers. Some can be chained to bypass security mechanisms and achieve remote code execution with root privileges.

A compromised controller could allow attackers to modify fans and compressors, alter facility operations, and conceal rising temperatures. In food-processing environments, the result could be the silent spoilage of products.

Vulnerabilities have also been fixed in Danfoss AK-SM 800A controllers, including a hidden “code-of-the-day” mechanism, a command injection flaw enabling remote code execution, and a vulnerability that allowed authenticated users to insert arbitrary Nginx directives.

Available updates should be applied without exposing the controllers to unnecessary networks.

Finally, Gen Digital identified an approximately 12 KB Windows backdoor that impersonated Realtek software and used WMI persistence. The C2 domain was not stored in clear text; instead, it was encoded in the number of trailing spaces at the end of lines in a fake desktop.ini file.

Indicators to investigate include anomalous desktop.ini files, unusual numbers of trailing spaces, WMI persistence, and binaries presented as Realtek components but associated with C2 communications. No connection to a known actor has been established, and the operation may have been targeted.