AI Weekly Malaysia

Attackers are actively exploiting CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997) that allows remote code execution as PostgreSQL superuser without credentials. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, but roughly 4,000 internet-exposed instances—mostly in the U.S.—remain vulnerable, with in-the-wild exploitation observed starting August 30, 2026 deploying reverse shells and running Base64-encoded enumeration commands.

Why: If your organization runs Sangoma Switchvox, patch to 8.4.0.2 immediately and audit for reverse shells or unexpected PostgreSQL superuser activity. For everyone else, this is a reminder that unauthenticated SQL injection endpoints concatenating user input directly into queries remain a live attack vector worth checking in your own codebases.

A modified phone booth at Burning Man (3:30 and Ceiba, Black Rock City) lets anyone make free 5-minute VoIP calls to almost anywhere in the world, or receive calls from random passersby at +1 (775) 557-4848. The creator replaced the booth's internals to route calls over the internet without payment.

Why: Minimal practical takeaway for builders; it's a charming art/community project, not a tool or platform to adopt. The only mildly interesting technical detail is that an ordinary phone booth was retrofitted for VoIP, but no implementation specifics are provided to learn from.