Aug 31: Elixir CVE Wave, ToolJet 9.9, Ransomware Claims Spike

Elixir/BEAM ecosystem took the most coordinated CVE hit it has seen in a single day. Ransomware claims continue to stack. Two items require immediate action.

AshAI: Unauthenticated Code Injection

CVE-2026-77956. AshAI’s AshAi.Actions.Prompt evaluates untrusted model output as live Elixir code. No authentication required. Any client that can reach the endpoint can execute arbitrary code on the host with application-level OS privileges.

Confidence: confirmed (ERLEF CNA, advisory published August 31). CVSS pending from NVD; ERLEF CNA classified it as code injection. The vulnerability class puts it in the critical tier.

Same pattern: MindsDB earlier this month. Ray AI framework before that. AI frameworks treating model output as executable code is not a new class of mistake. It keeps shipping.

If you run AshAI’s AshAi.Actions.Prompt component in a network-reachable configuration, treat that endpoint as actively compromised until patched. Full advisory batch coverage: 13 CVEs in AshAdmin and AshAI Include Critical RCE.

The same ERLEF CNA batch covers AshAdmin: path traversal allowing arbitrary file write (CVE-2026-82673, unauthenticated), BEAM atom-table exhaustion (CVE-2026-82722, unauthenticated DoS), stored XSS in the admin relationship typeahead (CVE-2026-77850), and a hardcoded CSP nonce that voids nonce-based CSP protection entirely (CVE-2026-81852). Update both packages. Full advisories at cna.erlef.org/cves/.

ToolJet: Seven Auth Bypasses, Worst CVSS 9.9

CVE-2026-82874 (CVSS 9.9). ToolJet’s tooljet-db endpoints accepted an organizationId path parameter without verifying it belonged to the authenticated user’s workspace. Any Builder-level user can read, write, or delete rows across other organizations’ databases.

Confidence: confirmed. GitHub security advisories published August 31. Patch: v3.16.208. Six additional CVEs in the same batch include table creation and deletion across org boundaries (CVE-2026-82870, CVSS 9.6) and schema disclosure without role checks (CVE-2026-82871, CVSS 7.7).

Multi-tenant ToolJet deployments are the primary risk surface. Update. If patching cannot happen immediately: restrict ToolJet to internal networks and audit Builder-role membership now. Full coverage: ToolJet Patches Seven Auth Flaws, Worst CVSS 9.9.

ash_phoenix: Tenant Isolation Failures

ERLEF CNA published four CVEs against ash_phoenix. The one requiring the fastest response: CVE-2026-82726, a permissive Host-header regex an unauthenticated client can exploit to select tenant routing or degrade the request. No session required.

CVE-2026-82724 sends nil to the tenant authorization callback, silently skipping tenant enforcement on affected paths. CVE-2026-82725 lets attacker-controlled filter parameters bypass locked relationship constraints. CVE-2026-82727 writes raw parameter maps, including secrets, to exception messages.

Confidence: confirmed (ERLEF CNA). Patch guidance in advisories at cna.erlef.org/cves/. Full coverage: ash_phoenix Patches Four Auth-Bypass Flaws.

Ransomware Claims: Berlin Confirmed, McKesson Deadline Active

Berlin. City administration confirmed data theft following Rhysida’s listing on their leak site. Rhysida claims over 5TB including personal information and credentials. Official statement: no payment. Per BleepingComputer.

Confidence: data theft confirmed by official Berlin city statement. Scope of exfiltration (5TB, credential content) sourced from Rhysida claims only; treat volume and content as unverified.

McKesson. ShinyHunters claims 284 million records. McKesson has confirmed the breach; attacker deadline is now active, per SecurityWeek. Record count of 284M: claimed by ShinyHunters, not independently verified. Treat as upper-bound estimate until confirmed.

Manchester Airports Group. FulcrumSec claims 80GB exfiltrated and threatens public leak. Confirmation from Manchester Airports Group not issued as of publication. Confidence: unconfirmed.

Round-up

• Profile Builder (WordPress): Unauthenticated file upload via AJAX avatar endpoint. CVE-2026-82607, CVSS 7.3. All versions through 3.16.1 affected. Update immediately. Full coverage.
• Aurora ransomware: Operators observed using Cursor AI for initial access across 10 identified targets, per The Hacker News. AI-assisted intrusion tooling is now operational, not theoretical. Confidence: single-source (THN); treat as reported.
• Sextortion extradition: Two Nigerian nationals extradited to U.S., charged in sextortion schemes linked to deaths of two minors. Per BleepingComputer.