This brief covers developments from October 11–13, 2026, drawn from primary advisories and original sources wherever available.

GitLab patches CVSS 10.0 unauthenticated code-execution flaw in CI/CD regex compiler

GitLab · October 12, 2026

GitLab released 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It affects self-managed GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. No in-the-wild exploitation has been reported and the CVE is not reported as a CISA KEV entry; GitLab.com is already patched.

“…could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration…” — GitLab patch release notes

Source: GitLab patch release 19.4.2; BleepingComputer.

Attackers hijack Danfoss refrigeration controllers at French supermarkets

CERT-FR · October 12, 2026

CERT-FR issued alert CERTFR-2026-ALE-012 citing numerous compromises of Danfoss AK-SM and AK-SC devices exposed to the internet. Press reports say the attack began the night of October 11 and forced freezers and fridges into defrost at hundreds of stores. No CVE has been tied to the attack; the entry point is unknown. The AK-SM 800 (end of life since 2021) and AK-SC 355 receive no patches, and Danfoss fixed three earlier AK-SM 800A flaws (CVE-2025-41450/41451/41452) in 2025. CERT-FR advises disconnecting or filtering access and, if compromise is suspected, a factory reset, patching, and rotating all secrets.

“…aware of incidents in France affecting a limited number of refrigeration management systems.” — Danfoss, to Reuters (as reported by The Hacker News)

Source: CERT-FR alert; The Hacker News; BleepingComputer.

Ledger confirms hardware implant in wallets sold via a Southeast Asian reseller

Ledger · October 11, 2026

Ledger confirmed that a device bought through reseller CryptoBilis contained an unauthorized hardware implant, tied to reported crypto thefts. Ledger says a limited number of devices are affected and all confirmed cases came through that reseller. It paused sales via CryptoBilis and advised recent buyers not to set up devices, or to move funds to a new signer with a new seed. Loss estimates (above $86 million, from a pseudonymous analyst) are unverified. No CVE applies.

“…to not initiate set up if you have not done so yet” — Ledger, on X

Source: Ledger statement; The Hacker News; BleepingComputer.

Still developing

SonicWall SMA 1000 CVSS 10.0 SSRF under active exploitation

Previdian / SonicWall · October 9, 2026

CVE-2026-102255 is a pre-authentication SSRF in the SMA1000 Work Place interface (CVSS 10.0). Patched in 12.4.3-03670 and 12.5.0-03082; versions 12.4.3-03526 and 12.5.0-02952 and older are affected. Previdian observed 135 exploitation attempts from two US IPs between October 9 and 10. It is not listed in CISA KEV per Previdian.

“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface” — SonicWall PSIRT, as quoted by Previdian

Source: Previdian; SonicWall advisory SNWLID-2026-0017; The Hacker News.

Bricksforge WordPress plugin file-upload RCE exploited in the wild

Patchstack · October 8, 2026

CVE-2026-85097 (CVSS 10.0) is an unauthenticated arbitrary file upload in Bricksforge 3.1.8.9 and earlier, fixed in 3.1.8.10. Patchstack first saw exploitation October 7 and recorded 63 unique source IPs, with attackers uploading GIF/PHP polyglots.

“Bricksforge validates a file’s MIME type when it is first uploaded.” — Patchstack

Source: Patchstack; The Hacker News.

This brief covers the trailing ~48 hours (October 11–13, 2026).

Primary sources:

• GitLab patch release 19.4.2
• CERT-FR CERTFR-2026-ALE-012
• Ledger statement
• Previdian CVE-2026-102255
• Patchstack Bricksforge

This brief covers the trailing ~48 hours ending October 12, 2026. It was a quieter window for new advisories, so the items below are drawn from vendor, researcher and company disclosures and checked against primary pages. Active campaigns that began slightly earlier are listed at the end.

Ledger confirms hardware implant in wallets sold by reseller CryptoBilis

Ledger · October 11, 2026

Ledger said an affected device contained an unauthorized hardware implant, and that the incident involves a “limited” number of devices, all sold through the reseller CryptoBilis in Southeast Asia. CryptoBilis has paused sales of its hardware wallet inventory while the investigation continues. Ledger told buyers from this reseller in the last 90 days not to begin setup, and advised anyone who already set up a device to move assets to a new signer with a new seed. Blockchain investigator Specter estimated losses above $86 million (an estimate, not a Ledger figure). No CVE applies; this is a supply-chain tampering case.

“Also, we strongly advise users not to purchase from unauthorized resellers” — Ledger, October 11 update

Source: Ledger update, Oct 11 · Ledger implant disclosure · The Hacker News

Daiichi Kosho: malware at contractor Nippon Columbia exposes about 8.7 million records

Daiichi Kosho / BleepingComputer · October 11, 2026

Japan’s largest karaoke operator, Daiichi Kosho, disclosed that malware on an employee’s computer at its contractor, Nippon Columbia Group, exposed 8,631,000 customer records and 93,000 employee records. Exposed fields include names, genders, dates of birth, email addresses and phone numbers; the company says passwords are not included. NCG reported the infection on October 5 and isolated the system the next day. Data theft has not been confirmed. No CVE or KEV entry applies.

Daiichi Kosho “has not confirmed any data theft or leaks” — as reported by BleepingComputer

Source: BleepingComputer, citing Daiichi Kosho’s website notices

CrowdStrike: attacker used ARTEX AI and Claude agents against South Korean banks

CrowdStrike / BleepingComputer · October 10, 2026

CrowdStrike confirmed that a Chinese-speaking actor used the ARTEX AI penetration-testing suite together with Claude agents in attacks on South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank. The intrusions exposed client personal and credit card data and caused outages in some cases. CrowdStrike found open directories holding Claude Code session histories and ARTEX configuration files, and saw no clear plan to monetize the stolen data. The ARTEX developer has since closed the source and stopped updates, though derivatives exist. No CVE is involved.

“The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro,” — CrowdStrike, as reported by BleepingComputer

Source: BleepingComputer

Still developing

SonicWall SMA 1000 SSRF (CVE-2026-102255) draws exploitation attempts

SonicWall / Help Net Security · patched October 6–7, 2026; exploitation attempts reported October 8–12

A pre-authentication server-side request forgery in the Appliance Work Place interface affects SMA 1000 models 6210, 7210 and 8200v. It is fixed in hotfixes 12.4.3-03670 and later, and 12.5.0-03082 and later. The Hacker News reports a CVSS of 10.0 and 135 exploitation attempts seen by Previdian; Defused Cyber also reported attempts beginning October 8. It is unknown whether any succeeded, and no KEV listing has been confirmed. SMA 100 Series and SonicWall firewalls are not affected.

Unauthenticated attackers could “direct the appliance to issue requests on their behalf” — SonicWall, via Help Net Security

Source: SonicWall PSIRT SNWLID-2026-0017 · Help Net Security · BleepingComputer · The Hacker News

Bricksforge WordPress plugin file upload (CVE-2026-85097, CVSS 10.0) exploited

Patchstack · October 8, 2026

An unauthenticated arbitrary file upload in Bricksforge versions 3.1.8.9 and earlier allows remote code execution. Patchstack first saw exploitation on October 7 at 21:47 UTC; the fix is version 3.1.8.10. No KEV listing has been confirmed.

“Our telemetry shows active exploitation attempts targeting Bricksforge installations” — Patchstack

Source: Patchstack · The Hacker News

P7 DarkSword: new iOS spyware variant steals crypto-wallet data

iVerify · October 8, 2026

iVerify identified P7 DarkSword during an August investigation of an infected customer device. It leaves a smaller on-device footprint, extracts keychain data, steals crypto-wallet data (including from imToken), and supports two-way command-and-control with a configurable beacon. The iVerify post names no CVEs; module names reference iOS 18.4 through 18.7.

“P7 DarkSword improves on earlier variants in three areas:” — iVerify

Source: iVerify · The Hacker News

This brief covers the trailing ~48 hours (October 10–12, 2026).

Primary sources:

• Ledger (X)
• Daiichi Kosho disclosure via BleepingComputer
• CrowdStrike findings via BleepingComputer
• SonicWall PSIRT
• Patchstack
• iVerify

This brief covers security developments disclosed between October 1 and October 3, 2026. Every item below was checked against its primary source: the vendor advisory, the CISA KEV alert, or the original research.

Fortinet FortiMail zero-day lets unauthenticated attackers write arbitrary files (CVE-2026-104286)

Fortinet PSIRT · October 1, 2026

Fortinet disclosed CVE-2026-104286 (CVSS 9.8), a path traversal and NULL-byte handling flaw in FortiMail. An unauthenticated attacker can use crafted HTTP/HTTPS requests to write arbitrary files on the system, which can lead to code execution. FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9 are affected. The bug is actively exploited and the fixed releases (8.0.2, 7.6.7, 7.4.9) are still listed as “upcoming.” Until they ship, Fortinet’s workaround is to disable IBE or keep the webmail interface off the internet. CISA added it to KEV on October 1 with an October 4 deadline for federal agencies. Fortinet also published IOCs, including the IPs 79.141.169[.]187 and 45.129.0[.]192.

“This has been reported to be exploited in the wild, customers are urged to apply the workaround below.” — Fortinet, FG-IR-26-175

Source: Fortinet FG-IR-26-175 · CISA KEV alert · The Hacker News

Zammad zero-days used in AI-agent breach of DIVD added to KEV (CVE-2026-102489, CVE-2026-102490)

DIVD CSIRT / CISA · October 2, 2026

CISA added two Zammad helpdesk flaws to KEV on October 2. Both were exploited as zero-days in the September 21 breach of the Dutch Institute for Vulnerability Disclosure (DIVD), which DIVD describes as an agentic-AI-driven attack. CVE-2026-102489 (CVSS 9.4) is a session fixation/hijack bug that leads to RCE as the zammad user. It affects Zammad 6.3.0–6.5.4. Versions 7.0.0–7.1.3 contain the bug, but it isn’t exploitable there because of environment conditions. CVE-2026-102490 (CVSS 9.4) is a local privilege escalation to root that affects all versions. Neither flaw had a fix at disclosure. DIVD has published an IOC log-check script.

“We advise all users of Zammad to upgrade to version 7 of Zammad or to take it offline.” — DIVD CSIRT

Source: DIVD-2026-00015 · CISA KEV alert · SecurityWeek

Fortra patches three critical BoKS flaws, including AD service-account auth bypass

Fortra · October 1, 2026

Fortra fixed eight vulnerabilities in Core Privileged Access Manager (BoKS). Three of them are critical:

• CVE-2026-79901 (CVSS 9.9): AD service-account passwords are generated from a predictable sequence seeded with the Unix timestamp, which allows an authentication bypass.
• CVE-2026-79898 (CVSS 9.1): command injection in crlserver that runs as root on the BoKS Master.
• CVE-2026-12627 (CVSS 9.8): a stack overflow in autoregistration.

Patches are available. Fortra has not reported in-the-wild exploitation, and none of the three is in KEV.

“An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.” — Fortra

Source: Fortra product security advisories · SecurityWeek

Still developing

Cisco Catalyst SD-WAN Manager auth bypass exploited as zero-day (CVE-2026-76504)

Cisco PSIRT · September 30, 2026

CVE-2026-76504 (CVSS 9.8) is an API authentication bypass caused by improper URI-encoding handling. It gives unauthenticated attackers admin-level API access to Catalyst SD-WAN Manager. All deployments are affected regardless of configuration, and there is no workaround. Fixes are in 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2 and 20.9.10.1. CVE-2026-76504 is actively exploited and in KEV, with a federal deadline of October 3. Cisco published IOCs for serviceproxy-access.log and vmanage-server.log.

“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco

Source: Cisco advisory · CISA KEV alert · SecurityWeek

Citrix NetScaler exploitation: post-exploitation payloads create superuser and hide web shells (CVE-2026-88771)

LevelBlue SpiderLabs · October 1, 2026

LevelBlue documented exploitation of CVE-2026-88771 (CVSS 9.5), a pre-auth command injection in NetScaler ADC and Gateway that is already in KEV, across multiple customer environments. In some cases a Perl payload added a “sec_monitor” superuser and exfiltrated /flash/nsconfig. Attackers also planted PHP web shells mapped to URLs that look like CSS resources. Separately, Mandiant/GTIG reported dozens of victims of the companion bug, CVE-2026-88772.

“Taken together, the observed commands demonstrate activity extending beyond basic vulnerability validation.” — LevelBlue

Source: LevelBlue · CISA alert · The Hacker News

Microsoft: Zimbra SNMP command injection was probed before public disclosure (CVE-2026-73570)

Microsoft Threat Intelligence · September 30, 2026

CVE-2026-73570 (CVSS 8.9) is an unauthenticated OS command injection in Zimbra Collaboration Suite. It can be triggered through crafted SMTP traffic when zimbra-snmp is installed and SNMP notifications are enabled. Microsoft says scanning of the vulnerable code path started between the July 20 patch (ZCS 10.1.20) and the August 13 public disclosure. Later attacks deployed JSP web shells, escalated to root and stole credentials. The fix is ZCS 10.1.20 or later.

Source: Microsoft Security Blog · SecurityWeek

This brief covers the trailing ~48 hours (October 1–3, 2026).

Primary sources:

• Fortinet PSIRT FG-IR-26-175
• CISA: Adds One KEV (Oct 1, 2026)
• CISA: Adds Two KEVs (Oct 2, 2026)
• DIVD CSIRT case DIVD-2026-00015
• Fortra product security advisories
• Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU
• LevelBlue SpiderLabs: NetScaler CVE-2026-88771
• Microsoft Security Blog: CVE-2026-73570

This brief covers September 25–27, 2026. Each item was checked against its primary source (CISA’s KEV alert, the vendor advisory, or the original research), with reputable outlets linked for context. Two things lead this window: a warning of unpatched Citrix NetScaler zero-days under active exploitation, and a CISA KEV update covering Microsoft SharePoint and MikroTik RouterOS.

Two unpatched Citrix NetScaler RCE zero-days reported exploited in the wild

watchTowr · September 26, 2026

On September 26, watchTowr said two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway were exploited before any fix existed, and that the exploitation was found during forensic investigations. As of Sunday morning Citrix had published no bulletin, CVE IDs, CVSS scores, workarounds, or IOCs, and no CVE is in KEV. watchTowr expects Citrix communications and patches early in the week of September 28. These are separate from the August authentication bypass CVE-2026-19490. Some administrators have taken appliances offline. Because the exploitation came before any patch, installing the fix will not show whether a device was already compromised. Citrix’s existing guidance for suspected compromise (preserve evidence, isolate the appliance, rotate secrets and certificates) is the relevant playbook until then.

“While details are scarce, the information is credible.” (watchTowr, via X)

Source: The Hacker News · Citrix compromise guidance (CTX694799)

CISA adds exploited SharePoint code injection and MikroTik RouterOS flaws to KEV

CISA / Microsoft MSRC · September 25, 2026

CISA added two entries to the KEV catalog. CVE-2026-65660 (CVSS 8.8) is a code injection flaw in SharePoint Server 2016, 2019, and Subscription Edition. It lets an authenticated low-privilege attacker execute code over the network. Microsoft patched it in August and first classified it as spoofing, then reclassified it as RCE. Previdian saw exploitation attempts starting September 24, after Viettel Security published technical details. CVE-2026-67279 (CVSS 6.9) is a RouterOS flaw that lets an unauthenticated client open a session channel and send an exec request. Chained with CVE-2026-86060 (already in KEV) in the “MikroTrick” exploit, it gives unauthenticated administrative control of exposed routers, according to CERT Polska. Both have fixes available, and the SharePoint deadline for federal agencies is September 28.

“As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.” (Microsoft MSRC advisory)

Source: CISA alert · MSRC CVE-2026-65660 · SecurityWeek · The Hacker News

ShinyHunters resumes mass exploitation of Oracle PeopleSoft with a one-character WAF bypass

Mandiant / Google Threat Intelligence Group · September 25, 2026

Mandiant and GTIG report a new wave of attacks by UNC6240 (ShinyHunters) exploiting CVE-2026-35273 (CVSS 9.8), an unauthenticated Java deserialization RCE in PeopleSoft’s Environment Management Hub (PSEMHUB). Oracle patched it in June. The attackers request /%50SEMHUB/ instead of /PSEMHUB/, which slips past WAF rules that match the literal path before URL decoding. They are targeting organizations that deployed WAF rules but never patched. Web shells (x.jsp, u.jsp) were found on dozens of systems in higher education, technology, healthcare, government, and other sectors, along with the SIDEEYE backdoor, Neo-reGeorg tunnels, and MeshAgent. Mandiant’s advice: apply Oracle’s patch, disable or remove EMHub, and enforce blocking on the normalized path.

“WAF rules and path-based blocking are not a substitute for patching.” (Mandiant)

Source: Google Cloud Threat Intelligence · Oracle Security Alert · BleepingComputer

Kiteworks tells customers to shut down servers after a law-enforcement warning of an imminent attack

Kiteworks · September 25, 2026

Kiteworks, the secure file-sharing vendor formerly known as Accellion, told customers worldwide to take their systems offline for a six-hour window on Saturday, September 26. The company said federal authorities had warned that a threat actor might target Kiteworks systems. Kiteworks says it knows of no compromise and that all known vulnerabilities are fixed in version 9.5.1. It has not confirmed a zero-day, and no CVE has been assigned. Managed file transfer platforms have a long history as targets for data-theft extortion.

“We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach.” (Kiteworks statement to BleepingComputer)

Source: BleepingComputer · The Hacker News

Compromised Mini Shai-Hulud GitHub Actions came back online still serving malware

Socket · September 25, 2026

Socket found that two GitHub Actions compromised in the May 2026 Mini Shai-Hulud supply-chain campaign, actions-cool/issues-helper and actions-cool/maintain-one-comment, became accessible again on September 16. Their release tags still pointed to the malicious commits, so any workflow that referenced them by tag ran the payload again. GitHub has disabled both repositories a second time. Teams that use either action should audit recent workflow runs, rotate any CI secrets those runs could reach, and pin actions to full commit SHAs.

“On September 16, 2026, both repositories became accessible again.” (Karlo Zanki, Socket)

Source: The Hacker News · BleepingComputer

This brief covers the trailing ~48 hours (September 25–27, 2026).

Primary sources:

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Sept. 25, 2026)
• Microsoft MSRC: CVE-2026-65660
• Mandiant / GTIG: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
• Oracle Security Alert: CVE-2026-35273
• Citrix: Steps to take if NetScaler ADC is suspected to be compromised
• CISA Known Exploited Vulnerabilities Catalog

This brief covers security developments from September 23–25, 2026. Every item was checked against the vendor advisory, the CISA KEV catalog, or the original research, with reputable outlets linked for context.

Attackers move from probing to payloads on WordPress core flaw CVE-2026-87902

WordPress / Patchstack · September 23, 2026

CVE-2026-87902 is an unauthenticated path traversal flaw in WordPress core page-template resolution. It affects versions 4.7.0 through 7.1.1, and the WordPress security team rates it critical (CVSS v4.0 9.2). WordPress 7.1.2 fixed it on September 22, and the fix was backported to every branch down to 4.7. Patchstack saw reconnaissance start within hours of the patch. By September 23, traffic had grown tenfold and included pearcmd.php-based payloads that write PHP files to /tmp and /var/tmp. Remote code execution requires specific theme and server conditions, such as a theme directory whose name starts with page- and PHP’s register_argc_argv setting being enabled. None of the sources reviewed reported a CISA KEV listing.

“Because this is a security release, it is recommended that you update your sites immediately.” — WordPress.org, 7.1.2 release notes

Source: WordPress 7.1.2 Release · GHSA-7hp8-65ch-5whp · BleepingComputer

CISA adds WSO2 API Manager auth bypass CVE-2026-5430 to KEV

CISA / WSO2 · September 24, 2026

CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities catalog after evidence of active exploitation. Federal agencies must patch by September 27. WSO2’s advisory scores the flaw CVSS 3.1 10.0, or 9.8 in single-tenant deployments. It describes a JWT authentication bypass: a token signed with an unsupported algorithm is accepted, which can lead to takeover of administrative accounts. CISA’s KEV entry calls it a path traversal. Affected products are WSO2 API Control Plane 4.5.0–4.6.0, API Manager 4.1.0–4.6.0, Traffic Manager 4.5.0–4.6.0, and Universal Gateway 4.5.0–4.6.0. watchTowr reported in-the-wild attempts against its honeypots since at least September 13.

“JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access.” — WSO2 Security Advisory WSO2-2026-5328

Source: WSO2-2026-5328 · CISA alert · The Hacker News

Adobe Commerce / Magento session-switching flaw CVE-2026-71362 added to KEV

CISA / Adobe · September 24, 2026

CISA added CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento Open Source (CVSS 9.1), to the KEV catalog in the same September 24 update. The federal remediation deadline is September 27. The bug lets an unauthenticated attacker switch a customer session to another customer’s account. Sansec reported blocking exploitation attempts in August, shortly after Adobe’s APSB26-92 fix. Adobe has not yet updated its advisory to confirm exploitation. The fix is to install the -2026-aug security release or the APSB26-92 isolated patch.

“The vulnerability lets attackers switch a customer session to another customer account.” — Sansec

Source: CISA alert · Sansec research · The Hacker News

CISA marks JetBrains TeamCity CVE-2026-63077 as used in ransomware campaigns

CISA / JetBrains · September 23, 2026

CISA updated the KEV entry for CVE-2026-63077 to show that it is “Known” to be used in ransomware campaigns. The flaw is a critical authentication bypass in TeamCity On-Premises that JetBrains patched on July 25 in versions 2025.11.7 and 2026.1.3. It allows unauthenticated OS command execution through the agent polling protocol. The CVE was first added to KEV on August 5. Shadowserver still tracks about 160 unpatched internet-exposed servers.

“An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands.” — JetBrains

Source: CISA KEV entry · JetBrains update · BleepingComputer

Still developing

Check Point confirms exploitation of Security Gateway VPN RCE and a Management Server zero-day

Check Point · September 22, 2026

Check Point Research confirmed exploitation of two flaws, both rated CVSS 9.8. The first, CVE-2026-85102, is a pre-authentication RCE in Security Gateway and Spark VPN certificate handling. It was patched September 9, and exploitation attempts against Spark customers started September 12. The second, CVE-2026-93616, is a pre-authentication path traversal zero-day in the Management web service that allows arbitrary script execution and Java class loading. It was used in a handful of targeted attacks on July 23 and is fixed via sk1000171. CISA added both to KEV on September 22 with a September 25 due date.

“Customers running affected versions should install the applicable fixes immediately.” — Lotem Finkelstein, Check Point Research

Source: Check Point advisory · sk1000117 · sk1000171 · BleepingComputer

F5 BIG-IP APM OAuth Authorization Server zero-day CVE-2026-94127

F5 · September 22, 2026

F5 patched CVE-2026-94127, a heap-based buffer overflow in BIG-IP APM (CVSS 3.1 9.8 / CVSS 4.0 9.3). Unauthenticated attackers can get RCE when APM is configured as an OAuth Authorization Server. F5 confirmed in-the-wild exploitation and published indicators of compromise plus an iRule mitigation. CISA added the flaw to KEV on September 22. Shadowserver sees roughly 14,700 IPs with BIG-IP APM fingerprints.

“We have learned that this vulnerability has been exploited.” — F5, K000162605

Source: F5 K000162605 · BleepingComputer

ShinyHunters claims FBI breach via unpatched Oracle PeopleSoft zero-day

BleepingComputer · September 22, 2026

The ShinyHunters extortion group claims it used a new Oracle PeopleSoft RCE zero-day to reach FBI systems and FBI-managed AWS GovCloud infrastructure. It says it stole 2–3 TB of employee and applicant data. The FBI says it is investigating “claims regarding unauthorized activity affecting FBIjobs.gov” but has not confirmed a breach. Oracle has not published an advisory or CVE, and the zero-day has not been independently verified.

Source: BleepingComputer

This brief covers the trailing ~48 hours (September 23–25, 2026).

Primary sources:

• WordPress 7.1.2 Release
• WordPress GHSA-7hp8-65ch-5whp (CVE-2026-87902)
• CISA: Adds Two Known Exploited Vulnerabilities (Sept 24, 2026)
• CISA: Adds Four Known Exploited Vulnerabilities (Sept 22, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• WSO2 Security Advisory WSO2-2026-5328
• Sansec: Adobe Commerce account takeover (APSB26-92)
• JetBrains: CVE-2026-63077 update
• Check Point Security Advisory (CVE-2026-85102 / CVE-2026-93616)
• F5 K000162605 (CVE-2026-94127)

This brief covers September 22–23, 2026. Every item below was checked against CISA’s KEV alert and the vendor advisory as reported. On September 22, CISA added four actively exploited flaws to the Known Exploited Vulnerabilities catalog. Three are zero-days in edge and management infrastructure: F5 BIG-IP APM, Arista VeloCloud Orchestrator, and Check Point Management Server. Federal agencies were given three days to patch under BOD 26-04.

F5 BIG-IP APM: unauthenticated RCE exploited as a zero-day (CVE-2026-94127)

F5 / CISA · September 22, 2026

CVE-2026-94127 (CVSS 9.8) is a heap-based buffer overflow in BIG-IP Access Policy Manager. An unauthenticated attacker can use it for remote code execution when an APM access policy and an OAuth profile are configured on a virtual server. Only deployments using APM as an OAuth Authorization Server are affected; Appliance mode is also vulnerable. Affected versions are 21.1.0, 17.5.0–17.5.1 and 17.1.0–17.1.3. F5 has shipped hotfixes and published three indicators of compromise (IoCs). The flaw is actively exploited and was added to KEV on September 22.

“We have learned that this vulnerability has been exploited.” — F5 advisory K000162605

Source: F5 K000162605 · SecurityWeek

Arista VeloCloud Orchestrator On-Prem: CVSS 10 zero-day under active attack (CVE-2026-93952)

Arista / CISA · September 22, 2026

CVE-2026-93952 (CVSS 10) is an improper input validation flaw in on-premises VeloCloud Orchestrator (VCO). It lets remote attackers reach privileged internal functionality without tenant or operator credentials. Only instances using certificate-based Edge-to-VCO authentication are exposed. The flaw is fixed in VCO 5.2.3.16 and 6.4.2.8, and patches for other trains are coming. Arista has published no definitive IoCs and recommends reviewing web, application and system logs. The flaw is actively exploited and was added to KEV on September 22.

“This issue was discovered externally and is known to be actively exploited.” — Arista Security Advisory 0183

Source: Arista Security Advisory 0183 · SecurityWeek

Check Point Management Server: pre-auth path traversal and file upload zero-day (CVE-2026-93616)

Check Point / CISA · September 22, 2026

CVE-2026-93616 (CVSS 9.8) is a directory traversal and file upload flaw. It lets unauthenticated attackers upload and run arbitrary scripts on Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server and SmartEvent. Fixes are in the R82.20 Security Hotfix and in Jumbo Hotfix Takes for R82.10, R82, R81.20 and R81.10. Standard LivePatch updates do not fix it. As interim mitigation, restrict TCP/19009 to trusted IPs. The flaw is actively exploited against a small number of customers and was added to KEV on September 22.

“This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.” — Check Point sk1000171

Source: Check Point sk1000171 · SecurityWeek

Check Point Security Gateway / Spark VPN auth bypass now exploited (CVE-2026-85102)

Check Point / CISA · September 22, 2026

CVE-2026-85102 (CVSS 9.8) is improper certificate validation during VPN negotiation. It allows unauthenticated authentication bypass and code execution on Security Gateway and Spark firewalls. Check Point patched it on September 9 and at that time had no evidence of exploitation. It now reports exploitation attempts against Spark customers worldwide. The flaw was added to KEV on September 22.

“We are now observing exploitation attempts against Check Point Spark customers globally.” — Check Point

Source: Check Point advisory blog · CISA KEV alert

Still developing

Zyxel GS1900 switch stack overflow added to KEV (CVE-2026-7273)

CISA · September 21, 2026

CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 Series switches, to the KEV catalog based on evidence of active exploitation. SecurityWeek has linked the exploitation to Chinese threat actors. GS1900 owners should apply Zyxel’s fixed firmware.

Source: CISA KEV alert

Brevo supply-chain attack served ClickFix malware through embedded scripts

Brevo / Sansec · September 18, 2026

Attackers used a compromised long-lived Cloudflare API key to deploy a worker. The worker injected malicious scripts into brevo.com, sibforms.com and three JavaScript files that customers embed on their sites. The scripts showed selected visitors fake “verify you are human” ClickFix pages. On WordPress sites where the visitor was a logged-in admin, they tried to install a plugin. Sansec estimates more than 100,000 sites were affected. Sites that embed Brevo widgets should check for unauthorized plugins.

Source: Brevo post-mortem · Sansec · SecurityWeek

This brief covers the trailing ~48 hours (September 22–23, 2026).

Primary sources:

• CISA: Adds Four Known Exploited Vulnerabilities (Sep 22, 2026)
• CISA: Adds One Known Exploited Vulnerability (Sep 21, 2026)
• F5 K000162605
• Arista Security Advisory 0183
• Check Point sk1000171
• Brevo incident post-mortem