This brief covers September 25–27, 2026. Each item was checked against its primary source (CISA’s KEV alert, the vendor advisory, or the original research), with reputable outlets linked for context. Two things lead this window: a warning of unpatched Citrix NetScaler zero-days under active exploitation, and a CISA KEV update covering Microsoft SharePoint and MikroTik RouterOS.

Two unpatched Citrix NetScaler RCE zero-days reported exploited in the wild

watchTowr · September 26, 2026

On September 26, watchTowr said two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway were exploited before any fix existed, and that the exploitation was found during forensic investigations. As of Sunday morning Citrix had published no bulletin, CVE IDs, CVSS scores, workarounds, or IOCs, and no CVE is in KEV. watchTowr expects Citrix communications and patches early in the week of September 28. These are separate from the August authentication bypass CVE-2026-19490. Some administrators have taken appliances offline. Because the exploitation came before any patch, installing the fix will not show whether a device was already compromised. Citrix’s existing guidance for suspected compromise (preserve evidence, isolate the appliance, rotate secrets and certificates) is the relevant playbook until then.

“While details are scarce, the information is credible.” (watchTowr, via X)

Source: The Hacker News · Citrix compromise guidance (CTX694799)

CISA adds exploited SharePoint code injection and MikroTik RouterOS flaws to KEV

CISA / Microsoft MSRC · September 25, 2026

CISA added two entries to the KEV catalog. CVE-2026-65660 (CVSS 8.8) is a code injection flaw in SharePoint Server 2016, 2019, and Subscription Edition. It lets an authenticated low-privilege attacker execute code over the network. Microsoft patched it in August and first classified it as spoofing, then reclassified it as RCE. Previdian saw exploitation attempts starting September 24, after Viettel Security published technical details. CVE-2026-67279 (CVSS 6.9) is a RouterOS flaw that lets an unauthenticated client open a session channel and send an exec request. Chained with CVE-2026-86060 (already in KEV) in the “MikroTrick” exploit, it gives unauthenticated administrative control of exposed routers, according to CERT Polska. Both have fixes available, and the SharePoint deadline for federal agencies is September 28.

“As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.” (Microsoft MSRC advisory)

Source: CISA alert · MSRC CVE-2026-65660 · SecurityWeek · The Hacker News

ShinyHunters resumes mass exploitation of Oracle PeopleSoft with a one-character WAF bypass

Mandiant / Google Threat Intelligence Group · September 25, 2026

Mandiant and GTIG report a new wave of attacks by UNC6240 (ShinyHunters) exploiting CVE-2026-35273 (CVSS 9.8), an unauthenticated Java deserialization RCE in PeopleSoft’s Environment Management Hub (PSEMHUB). Oracle patched it in June. The attackers request /%50SEMHUB/ instead of /PSEMHUB/, which slips past WAF rules that match the literal path before URL decoding. They are targeting organizations that deployed WAF rules but never patched. Web shells (x.jsp, u.jsp) were found on dozens of systems in higher education, technology, healthcare, government, and other sectors, along with the SIDEEYE backdoor, Neo-reGeorg tunnels, and MeshAgent. Mandiant’s advice: apply Oracle’s patch, disable or remove EMHub, and enforce blocking on the normalized path.

“WAF rules and path-based blocking are not a substitute for patching.” (Mandiant)

Source: Google Cloud Threat Intelligence · Oracle Security Alert · BleepingComputer

Kiteworks tells customers to shut down servers after a law-enforcement warning of an imminent attack

Kiteworks · September 25, 2026

Kiteworks, the secure file-sharing vendor formerly known as Accellion, told customers worldwide to take their systems offline for a six-hour window on Saturday, September 26. The company said federal authorities had warned that a threat actor might target Kiteworks systems. Kiteworks says it knows of no compromise and that all known vulnerabilities are fixed in version 9.5.1. It has not confirmed a zero-day, and no CVE has been assigned. Managed file transfer platforms have a long history as targets for data-theft extortion.

“We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach.” (Kiteworks statement to BleepingComputer)

Source: BleepingComputer · The Hacker News

Compromised Mini Shai-Hulud GitHub Actions came back online still serving malware

Socket · September 25, 2026

Socket found that two GitHub Actions compromised in the May 2026 Mini Shai-Hulud supply-chain campaign, actions-cool/issues-helper and actions-cool/maintain-one-comment, became accessible again on September 16. Their release tags still pointed to the malicious commits, so any workflow that referenced them by tag ran the payload again. GitHub has disabled both repositories a second time. Teams that use either action should audit recent workflow runs, rotate any CI secrets those runs could reach, and pin actions to full commit SHAs.

“On September 16, 2026, both repositories became accessible again.” (Karlo Zanki, Socket)

Source: The Hacker News · BleepingComputer

This brief covers the trailing ~48 hours (September 25–27, 2026).

Primary sources:

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Sept. 25, 2026)
• Microsoft MSRC: CVE-2026-65660
• Mandiant / GTIG: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
• Oracle Security Alert: CVE-2026-35273
• Citrix: Steps to take if NetScaler ADC is suspected to be compromised
• CISA Known Exploited Vulnerabilities Catalog

This brief covers security developments from September 23–25, 2026. Every item was checked against the vendor advisory, the CISA KEV catalog, or the original research, with reputable outlets linked for context.

Attackers move from probing to payloads on WordPress core flaw CVE-2026-87902

WordPress / Patchstack · September 23, 2026

CVE-2026-87902 is an unauthenticated path traversal flaw in WordPress core page-template resolution. It affects versions 4.7.0 through 7.1.1, and the WordPress security team rates it critical (CVSS v4.0 9.2). WordPress 7.1.2 fixed it on September 22, and the fix was backported to every branch down to 4.7. Patchstack saw reconnaissance start within hours of the patch. By September 23, traffic had grown tenfold and included pearcmd.php-based payloads that write PHP files to /tmp and /var/tmp. Remote code execution requires specific theme and server conditions, such as a theme directory whose name starts with page- and PHP’s register_argc_argv setting being enabled. None of the sources reviewed reported a CISA KEV listing.

“Because this is a security release, it is recommended that you update your sites immediately.” — WordPress.org, 7.1.2 release notes

Source: WordPress 7.1.2 Release · GHSA-7hp8-65ch-5whp · BleepingComputer

CISA adds WSO2 API Manager auth bypass CVE-2026-5430 to KEV

CISA / WSO2 · September 24, 2026

CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities catalog after evidence of active exploitation. Federal agencies must patch by September 27. WSO2’s advisory scores the flaw CVSS 3.1 10.0, or 9.8 in single-tenant deployments. It describes a JWT authentication bypass: a token signed with an unsupported algorithm is accepted, which can lead to takeover of administrative accounts. CISA’s KEV entry calls it a path traversal. Affected products are WSO2 API Control Plane 4.5.0–4.6.0, API Manager 4.1.0–4.6.0, Traffic Manager 4.5.0–4.6.0, and Universal Gateway 4.5.0–4.6.0. watchTowr reported in-the-wild attempts against its honeypots since at least September 13.

“JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access.” — WSO2 Security Advisory WSO2-2026-5328

Source: WSO2-2026-5328 · CISA alert · The Hacker News

Adobe Commerce / Magento session-switching flaw CVE-2026-71362 added to KEV

CISA / Adobe · September 24, 2026

CISA added CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento Open Source (CVSS 9.1), to the KEV catalog in the same September 24 update. The federal remediation deadline is September 27. The bug lets an unauthenticated attacker switch a customer session to another customer’s account. Sansec reported blocking exploitation attempts in August, shortly after Adobe’s APSB26-92 fix. Adobe has not yet updated its advisory to confirm exploitation. The fix is to install the -2026-aug security release or the APSB26-92 isolated patch.

“The vulnerability lets attackers switch a customer session to another customer account.” — Sansec

Source: CISA alert · Sansec research · The Hacker News

CISA marks JetBrains TeamCity CVE-2026-63077 as used in ransomware campaigns

CISA / JetBrains · September 23, 2026

CISA updated the KEV entry for CVE-2026-63077 to show that it is “Known” to be used in ransomware campaigns. The flaw is a critical authentication bypass in TeamCity On-Premises that JetBrains patched on July 25 in versions 2025.11.7 and 2026.1.3. It allows unauthenticated OS command execution through the agent polling protocol. The CVE was first added to KEV on August 5. Shadowserver still tracks about 160 unpatched internet-exposed servers.

“An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands.” — JetBrains

Source: CISA KEV entry · JetBrains update · BleepingComputer

Still developing

Check Point confirms exploitation of Security Gateway VPN RCE and a Management Server zero-day

Check Point · September 22, 2026

Check Point Research confirmed exploitation of two flaws, both rated CVSS 9.8. The first, CVE-2026-85102, is a pre-authentication RCE in Security Gateway and Spark VPN certificate handling. It was patched September 9, and exploitation attempts against Spark customers started September 12. The second, CVE-2026-93616, is a pre-authentication path traversal zero-day in the Management web service that allows arbitrary script execution and Java class loading. It was used in a handful of targeted attacks on July 23 and is fixed via sk1000171. CISA added both to KEV on September 22 with a September 25 due date.

“Customers running affected versions should install the applicable fixes immediately.” — Lotem Finkelstein, Check Point Research

Source: Check Point advisory · sk1000117 · sk1000171 · BleepingComputer

F5 BIG-IP APM OAuth Authorization Server zero-day CVE-2026-94127

F5 · September 22, 2026

F5 patched CVE-2026-94127, a heap-based buffer overflow in BIG-IP APM (CVSS 3.1 9.8 / CVSS 4.0 9.3). Unauthenticated attackers can get RCE when APM is configured as an OAuth Authorization Server. F5 confirmed in-the-wild exploitation and published indicators of compromise plus an iRule mitigation. CISA added the flaw to KEV on September 22. Shadowserver sees roughly 14,700 IPs with BIG-IP APM fingerprints.

“We have learned that this vulnerability has been exploited.” — F5, K000162605

Source: F5 K000162605 · BleepingComputer

ShinyHunters claims FBI breach via unpatched Oracle PeopleSoft zero-day

BleepingComputer · September 22, 2026

The ShinyHunters extortion group claims it used a new Oracle PeopleSoft RCE zero-day to reach FBI systems and FBI-managed AWS GovCloud infrastructure. It says it stole 2–3 TB of employee and applicant data. The FBI says it is investigating “claims regarding unauthorized activity affecting FBIjobs.gov” but has not confirmed a breach. Oracle has not published an advisory or CVE, and the zero-day has not been independently verified.

Source: BleepingComputer

This brief covers the trailing ~48 hours (September 23–25, 2026).

Primary sources:

• WordPress 7.1.2 Release
• WordPress GHSA-7hp8-65ch-5whp (CVE-2026-87902)
• CISA: Adds Two Known Exploited Vulnerabilities (Sept 24, 2026)
• CISA: Adds Four Known Exploited Vulnerabilities (Sept 22, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• WSO2 Security Advisory WSO2-2026-5328
• Sansec: Adobe Commerce account takeover (APSB26-92)
• JetBrains: CVE-2026-63077 update
• Check Point Security Advisory (CVE-2026-85102 / CVE-2026-93616)
• F5 K000162605 (CVE-2026-94127)

This brief covers September 22–23, 2026. Every item below was checked against CISA’s KEV alert and the vendor advisory as reported. On September 22, CISA added four actively exploited flaws to the Known Exploited Vulnerabilities catalog. Three are zero-days in edge and management infrastructure: F5 BIG-IP APM, Arista VeloCloud Orchestrator, and Check Point Management Server. Federal agencies were given three days to patch under BOD 26-04.

F5 BIG-IP APM: unauthenticated RCE exploited as a zero-day (CVE-2026-94127)

F5 / CISA · September 22, 2026

CVE-2026-94127 (CVSS 9.8) is a heap-based buffer overflow in BIG-IP Access Policy Manager. An unauthenticated attacker can use it for remote code execution when an APM access policy and an OAuth profile are configured on a virtual server. Only deployments using APM as an OAuth Authorization Server are affected; Appliance mode is also vulnerable. Affected versions are 21.1.0, 17.5.0–17.5.1 and 17.1.0–17.1.3. F5 has shipped hotfixes and published three indicators of compromise (IoCs). The flaw is actively exploited and was added to KEV on September 22.

“We have learned that this vulnerability has been exploited.” — F5 advisory K000162605

Source: F5 K000162605 · SecurityWeek

Arista VeloCloud Orchestrator On-Prem: CVSS 10 zero-day under active attack (CVE-2026-93952)

Arista / CISA · September 22, 2026

CVE-2026-93952 (CVSS 10) is an improper input validation flaw in on-premises VeloCloud Orchestrator (VCO). It lets remote attackers reach privileged internal functionality without tenant or operator credentials. Only instances using certificate-based Edge-to-VCO authentication are exposed. The flaw is fixed in VCO 5.2.3.16 and 6.4.2.8, and patches for other trains are coming. Arista has published no definitive IoCs and recommends reviewing web, application and system logs. The flaw is actively exploited and was added to KEV on September 22.

“This issue was discovered externally and is known to be actively exploited.” — Arista Security Advisory 0183

Source: Arista Security Advisory 0183 · SecurityWeek

Check Point Management Server: pre-auth path traversal and file upload zero-day (CVE-2026-93616)

Check Point / CISA · September 22, 2026

CVE-2026-93616 (CVSS 9.8) is a directory traversal and file upload flaw. It lets unauthenticated attackers upload and run arbitrary scripts on Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server and SmartEvent. Fixes are in the R82.20 Security Hotfix and in Jumbo Hotfix Takes for R82.10, R82, R81.20 and R81.10. Standard LivePatch updates do not fix it. As interim mitigation, restrict TCP/19009 to trusted IPs. The flaw is actively exploited against a small number of customers and was added to KEV on September 22.

“This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.” — Check Point sk1000171

Source: Check Point sk1000171 · SecurityWeek

Check Point Security Gateway / Spark VPN auth bypass now exploited (CVE-2026-85102)

Check Point / CISA · September 22, 2026

CVE-2026-85102 (CVSS 9.8) is improper certificate validation during VPN negotiation. It allows unauthenticated authentication bypass and code execution on Security Gateway and Spark firewalls. Check Point patched it on September 9 and at that time had no evidence of exploitation. It now reports exploitation attempts against Spark customers worldwide. The flaw was added to KEV on September 22.

“We are now observing exploitation attempts against Check Point Spark customers globally.” — Check Point

Source: Check Point advisory blog · CISA KEV alert

Still developing

Zyxel GS1900 switch stack overflow added to KEV (CVE-2026-7273)

CISA · September 21, 2026

CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 Series switches, to the KEV catalog based on evidence of active exploitation. SecurityWeek has linked the exploitation to Chinese threat actors. GS1900 owners should apply Zyxel’s fixed firmware.

Source: CISA KEV alert

Brevo supply-chain attack served ClickFix malware through embedded scripts

Brevo / Sansec · September 18, 2026

Attackers used a compromised long-lived Cloudflare API key to deploy a worker. The worker injected malicious scripts into brevo.com, sibforms.com and three JavaScript files that customers embed on their sites. The scripts showed selected visitors fake “verify you are human” ClickFix pages. On WordPress sites where the visitor was a logged-in admin, they tried to install a plugin. Sansec estimates more than 100,000 sites were affected. Sites that embed Brevo widgets should check for unauthorized plugins.

Source: Brevo post-mortem · Sansec · SecurityWeek

This brief covers the trailing ~48 hours (September 22–23, 2026).

Primary sources:

• CISA: Adds Four Known Exploited Vulnerabilities (Sep 22, 2026)
• CISA: Adds One Known Exploited Vulnerability (Sep 21, 2026)
• F5 K000162605
• Arista Security Advisory 0183
• Check Point sk1000171
• Brevo incident post-mortem

This brief covers the trailing ~48 hours (September 22–23, 2026). Every item below was checked against its primary source — the vendor advisory, CISA’s Known Exploited Vulnerabilities (KEV) catalog, or the original research post — and the dates and scores shown are the ones published there.

CISA adds four zero-days to KEV in one day: Check Point (×2), F5 BIG-IP APM, Arista VeloCloud

CISA · September 22, 2026

CISA added four vulnerabilities to the KEV catalog on September 22, all of them edge or management-plane products and all with a federal remediation deadline of September 25, 2026: CVE-2026-85102 and CVE-2026-93616 (Check Point), CVE-2026-93952 (Arista VeloCloud Orchestrator), and CVE-2026-94127 (F5 BIG-IP APM). Each is covered in its own item below. A day earlier, on September 21, CISA also added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, with a September 24 deadline.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.” — CISA

Source: CISA alert (Sept 22) · CISA alert (Sept 21, Zyxel)

Check Point discloses exploited Security Management zero-day (CVE-2026-93616) and confirms in-the-wild attacks on the VPN certificate flaw (CVE-2026-85102)

Check Point · September 22, 2026

Check Point published sk1000171 and a security blog for CVE-2026-93616 (CVSS 9.8), a pre-authentication directory traversal and file upload bug in the Security Management Server, Multi-Domain Server, Log Server, and SmartEvent that lets an attacker with access to the management web service (TCP/19009) run arbitrary scripts. The company says it was used in a handful of targeted attacks on July 23, 2026. Affected: R82.20, R82.10 JHF Take 44 and below, R82 Take 126 and below, R81.20 Take 166 and below, and end-of-support R81.10 and earlier; fixes are R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, R81.10 Take 192+, and a hotfix for R82.20. There is no LivePatch for this one. The same advisory reports that CVE-2026-85102 (CVSS 9.8, the improper certificate validation flaw patched September 9) is now seeing exploitation attempts against Spark firewall customers globally, starting around September 12. Both CVEs were added to CISA KEV on September 22.

“CVE-2026-93616 is a newly discovered zero-day vulnerability in Security Management, and a fix is available now as part of this advisory.” — Lotem Finkelstein, Check Point

Source: Check Point sk1000171 · Check Point blog · BleepingComputer

F5 patches BIG-IP APM heap overflow exploited for unauthenticated RCE on OAuth authorization servers (CVE-2026-94127)

F5 · September 22, 2026

F5 advisory K000162605 describes CVE-2026-94127, a heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager rated 9.8 on CVSS v3.1 and 9.3 on CVSS v4.0. It is reachable only when an APM access policy and OAuth profile are attached to a virtual server with APM acting as an OAuth Authorization Server; client- and resource-server-only deployments are not affected. F5 says the bug has been exploited and shipped engineering hotfixes for 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, with an iRule mitigation available from F5 Support. Other BIG-IP modules, BIG-IP Next, F5OS, NGINX, and Distributed Cloud are not vulnerable. Added to CISA KEV September 22.

“This vulnerability allows an unauthenticated attacker to perform RCE.” — F5, K000162605

Source: F5 K000162605 · BleepingComputer

Arista VeloCloud Orchestrator CVSS 10.0 input-validation flaw actively exploited (CVE-2026-93952)

Arista · September 22, 2026

Arista Security Advisory 0183 covers CVE-2026-93952, an improper input validation bug in on-premises VeloCloud Orchestrator rated 10.0 on CVSS v3.1 (9.5 on v4.0). It affects deployments that use certificate-based Edge-to-Orchestrator authentication; an attacker with network access to the VCO web UI and the public portion of an Edge authentication certificate can reach privileged internal functions without tenant or operator credentials. Affected: 5.2.3.15 and below, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below. Fixes are available for 5.2.3.16+ and 6.4.2.8+; Arista says patches for the 6.1.x and 7.0.x lines are still pending, and hosted VCO instances have already been patched. The advisory lists file, service, and IP indicators of compromise. Added to CISA KEV September 22.

“This issue was discovered externally and is known to be actively exploited.” — Arista Security Advisory 0183

Source: Arista SA 0183 · BleepingComputer

WordPress 7.1.2 fixes unauthenticated path traversal (CVE-2026-87902); exploitation began within hours

WordPress.org / Patchstack · September 22–23, 2026

WordPress 7.1.2 shipped on September 22 to fix CVE-2026-87902, an unauthenticated path traversal in page template resolution that yields local file inclusion and, on servers with a writable include path or PEAR’s pearcmd available, code execution. WordPress rates it 9.2 on CVSS v4.0 (8.1 on v3.1); it affects every core release from 4.7.0 through 7.1.1, with backports down to 4.7.37. A proof of concept from the reporter is public. Patchstack observed reconnaissance traffic less than five hours after the release and, by September 23, attackers writing PHP files to disk via the flaw. Not in CISA KEV at time of writing.

“That is arbitrary file write with attacker-controlled PHP content, which is code execution.” — Patchstack

Source: WordPress 7.1.2 release · Patchstack · BleepingComputer

Next.js 16.3.6 patches critical RCE in next/og ImageResponse (CVE-2026-94545)

Vercel · September 22, 2026

Vercel published GHSA-vcvr-r3jv-pc5j for CVE-2026-94545, rated Critical (CVSS v4.0 9.5), in the Node.js implementation of ImageResponse from next/og. Improper escaping in SVG output generated by the upstream Satori library can lead to remote code execution when attacker-controlled values land in SVG content, attributes, or styles. Affected: Next.js 16.2.0 through 16.3.5; fixed in 16.3.6 (15.5.26 adds hardening, and the Edge runtime implementation is not affected). No exploitation has been reported and the flaw is not in KEV.

Source: GHSA-vcvr-r3jv-pc5j · Next.js blog · The Hacker News

Public exploit for unpatched Ubuntu kernel AF_UNIX use-after-free enables container-to-host root (CVE-2026-80521)

DepthFirst · September 22, 2026

DepthFirst researcher Zhenpeng Lin published a working container escape exploit for CVE-2026-80521 (CVSS 7.8), a use-after-free in the Linux kernel’s AF_UNIX socket garbage collector introduced in 6.10 and backported to 6.1 and 6.6. Upstream fixed it on August 6 (mainline 7.2, stable 7.1.10), but Ubuntu’s tracker still lists the kernel packages for 26.04 and 24.04 as “Vulnerable, work in progress.” The exploit code is public on GitHub. No in-the-wild exploitation has been reported and the CVE is not in KEV.

“As of today, it is still unpatched in the latest ubuntu 26.04 release.” — DepthFirst

Source: DepthFirst research · The Hacker News

Financially motivated actor uses open-source AI agent frameworks to skim 600,000+ payment cards

Gambit Security · September 22, 2026

Gambit Security’s threat intelligence team documented an ongoing campaign, active since at least July, in which a threat actor runs open-source agent frameworks (Strix, Cairn, Hermes) to attack online retailers autonomously at roughly $25 per target. The report counts more than 600,000 unexpired card records taken from two victims, skimmers on at least 119 sites, and 105 attack projects against 27+ companies in the September 10–15 window alone. No CVE is involved; the agents chain ordinary web application weaknesses.

“Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees.” — Gambit Security

Source: Gambit Security · BleepingComputer

ShinyHunters claims FBI breach via alleged Oracle PeopleSoft zero-day; FBI says it is investigating

Reuters / 404 Media · September 22, 2026

ShinyHunters claims to have breached the FBI through an unpatched Oracle PeopleSoft vulnerability, pivoted into AWS GovCloud infrastructure, and stolen 2–3 TB of data on agents and job applicants; apply.fbijobs.gov was defaced and currently shows a maintenance page. 404 Media verified some phone numbers in a roughly 5,000-record sample. The FBI told Reuters and BleepingComputer it is aware of the claims and investigating. No CVE has been published, Oracle has not commented, and the zero-day claim remains unverified.

“The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” — FBI statement to Reuters

Source: Reuters · 404 Media · The Hacker News

Still developing

Three Linux kernel flaws added to KEV; Red Hat flags known exploits

CISA / Red Hat · September 18–19, 2026

CISA added CVE-2025-39682 (kTLS receive path, CVSS 9.8), CVE-2026-53266 (ebtables SNAT ARP out-of-bounds write, CVSS 8.8), and CVE-2025-39964 (AF_ALG race condition, CVSS 7.8) to KEV on September 18 with a September 21 federal deadline. Red Hat updated its advisories on September 19 to mark all three as having known exploits. Fixed upstream kernels have been available since 2025 for the two older bugs and since June 2026 for CVE-2026-53266.

Source: CISA alert (two) · CISA alert (one) · The Hacker News

Joint advisory: North Korea’s WaterPlum infected 30,000 devices, moved $10.7M in crypto

FBI / Japan NPA / ACSC / BfV · September 18, 2026

A joint advisory from U.S., Japanese, Australian, and German authorities attributes the “Contagious Interview” fake-recruiter campaign to WaterPlum, a unit under North Korea’s 313 General Bureau, and ties it to the DPRK IT-worker scheme. It names the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware families and notes the actors’ use of AI face-swapping in video interviews.

“WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets.” — Joint cybersecurity advisory

Source: IC3 joint advisory (PDF) · BleepingComputer

ShinyHunters defaces Clop’s leak site, claims theft of onion keys

BleepingComputer · September 19, 2026

ShinyHunters breached and defaced the Clop ransomware gang’s Tor data leak site via what it says is an unauthenticated file upload flaw in Grav CMS, and claims to have taken source code, logs, and the onion service private keys. BleepingComputer confirmed the defacement but not the theft claims. The group frames it as retaliation in a feud dating to Clop’s 2025 Oracle E-Business Suite campaign.

Source: BleepingComputer

This brief covers the trailing ~48 hours (September 22–23, 2026).

Primary sources:

• CISA — KEV additions, September 22, 2026
• CISA — KEV addition (Zyxel), September 21, 2026
• Check Point sk1000171 — CVE-2026-93616
• Check Point sk1000117 — CVE-2026-85102
• F5 K000162605 — CVE-2026-94127
• Arista Security Advisory 0183 — CVE-2026-93952
• WordPress 7.1.2 — CVE-2026-87902
• Vercel GHSA-vcvr-r3jv-pc5j — CVE-2026-94545
• DepthFirst — CVE-2026-80521
• Gambit Security — AI agent skimming campaign
• IC3 — WaterPlum joint advisory
• CISA — KEV additions (Linux kernel), September 18, 2026

This brief covers the trailing ~48 hours (September 17–19, 2026). Every item below was traced to a primary source — CISA’s KEV catalog, a vendor release or advisory, or the original researcher’s write-up — and the disclosure date was confirmed on that page.

CISA adds three actively exploited Linux kernel flaws to KEV, federal deadline Sept. 21

CISA · September 18, 2026

In two separate alerts on September 18, CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-39682 (improper check in the kernel TLS receive path, where a zero-length record from rx_list bypasses recvmsg() record-type handling), CVE-2026-53266 (out-of-bounds write in the ebtables SNAT target’s ARP hardware-address rewrite), and CVE-2025-39964 (race condition on concurrent writes to the same AF_ALG socket). Published CVSS scores are 9.8, 8.8, and 7.8 respectively. All three carry a KEV due date of September 21, 2026, and CISA marks each as requiring forensic triage under BOD 26-04; ransomware use is listed as “Unknown.” Red Hat updated its advisories for all three to acknowledge active exploitation, and fixes are available in current stable kernels.

“CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-39964 Linux Kernel Race Condition Vulnerability. CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability.” — CISA alert, September 18, 2026

Source: CISA alert (two KEVs) · CISA alert (one KEV) · KEV catalog entry · The Hacker News

Public root exploits released for four Linux kernel LPEs: DirtyAH6, TUNderflow, PPPoEject, DiagSpill

Asim Manizada (researcher write-up) · September 18, 2026

Researcher Asim Manizada published a coordinated write-up and working proof-of-concept exploits for four Linux kernel local privilege escalation bugs, all found with an AI-assisted hunting harness: CVE-2026-80844 (DirtyAH6, IPv6 IPsec AH routing-header OOB), CVE-2026-81000 (TUNderflow, TUN/TAP headroom integer underflow), CVE-2026-68121 (PPPoEject, PPPoE use-after-free), and CVE-2026-74469 (DiagSpill, SCTP sctp_diag 16-bit transport counter wrap spilling ~8 MiB). The bugs were reported to the kernel security team in mid-July; patches landed upstream and the first stable releases containing all four fixes are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Three require unprivileged user namespaces; DiagSpill needs no special privileges when SCTP is available. No CVSS scores are listed in the write-up, and no in-the-wild exploitation has been reported. Not in KEV.

“Four more Linux LPEs; two of the corruption bugs are reachable remotely under very specific circumstances, with one theoretically remote-groomable to remote root.” — Asim Manizada, lpe-quartet write-up

Source: Researcher write-up (heyitsas.im) · The Hacker News

WordPress 7.1.1 ships 11 security fixes, including the “Click2Shell” forced theme-install flaw

WordPress.org · September 17, 2026

WordPress 7.1.1 is a short-cycle security and maintenance release with 17 core bug fixes, 19 Block Editor fixes, and 11 security fixes. The headline items are an unauthenticated stored cross-site scripting bug in wpautop() (subject to comment approval) and a flaw where specially crafted URLs can automatically install and preview an inactive theme from WordPress.org when opened by a logged-in administrator — reported by Paulos Yibelo and pwn.ai, who describe a chain they call Click2Shell. Other fixes include an authenticated path traversal in the REST Templates Controller and a Contributor+ arbitrary post overwrite (both reported by Anthropic), an XML-RPC edit_css bypass, and several authorization and disclosure issues. The release post does not list CVE IDs or CVSS scores. Backports to older branches are in progress. Not in KEV.

“Because this is a security release, it is recommended that you update your sites immediately.” — WordPress 7.1.1 release announcement

Source: WordPress.org release post · The Hacker News

vm2 sandbox-escape wave: more than a dozen CVEs, several at CVSS 10, fixed in 3.11.7

VulnCheck (CNA) / CVE.org · September 17, 2026

A batch of CVE records published September 17 covers a wave of sandbox escapes in the widely used vm2 Node.js library. CVE-2026-92941 (CVSS 10.0, CWE-732) allows NodeVM sandbox code to reach the host tls module and call tls.setDefaultCACertificates(), replacing the process-wide certificate trust store; it affects vm2 3.11.3 through 3.11.6 and is fixed in 3.11.7. Related records in the same batch (including CVE-2026-92937, CVE-2026-92940, CVE-2026-92946, CVE-2026-92953, CVE-2026-92955, CVE-2026-92956, and CVE-2026-92960, each scored 10.0, plus several at 9.9) describe escapes via Promise rejection handling, https.globalAgent, require.external, TypedArray/ArrayBuffer prototypes, WebAssembly compilation streams, and the os/dns builtins. Any service running untrusted JavaScript in-process with vm2 — including many AI-agent tool runners — should upgrade to 3.11.7 or later. No exploitation in the wild has been reported; not in KEV.

“vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities.” — CVE-2026-92941 record (VulnCheck)

Source: CVE.org record · vm2 GitHub advisory · Vulners

Plugin4Shell: SHA-pinning bypass in four AI coding agents; Claude Code and Codex patched, Copilot and Gemini CLI unfixed

Air Security · September 17, 2026

Air Security disclosed a plugin supply-chain flaw affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. Each agent checks out a marketplace-pinned commit but never verifies that the resulting working tree matches the pin; an attacker controlling a plugin’s repository can create a default branch named with the 40-hex pinned SHA (or, for Gemini CLI, a branch named FETCH_HEAD) so that git checkout resolves the ref instead of the commit. Combined with background auto-update, the swap requires no user interaction. Per Air’s timeline, the flaw was found in May, disclosed to all four vendors in June, fixed in Claude Code 2.1.179 and Codex 0.146.0, while Copilot has no fix and Google will not patch the deprecated Gemini CLI. GitHub rejects hash-shaped branch names, so the branch variant applies to plugins hosted on Bitbucket or self-hosted git. No CVE has been assigned, no CVSS is published, and Air reports no evidence of in-the-wild exploitation. Not in KEV.

“It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin’s repo makes the checkout resolve to malicious code while the pin still looks honored.” — Air Security, Plugin4Shell disclosure

Source: Air Security disclosure · The Hacker News

Microsoft Fabric authentication bypass rated CVSS 10.0 (CVE-2026-69843)

Microsoft MSRC · September 17, 2026

Microsoft published CVE-2026-69843, an authentication bypass by spoofing in Microsoft Fabric that allows an unauthorized attacker to elevate privileges over a network, rated CVSS 10.0 and classified as CWE-287. As a cloud-service vulnerability it was mitigated on Microsoft’s side and carries no customer patch. It was published alongside a cluster of other Microsoft cloud-service CVEs the same day. Microsoft has not reported exploitation; not in KEV.

“Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.” — MSRC Security Update Guide, CVE-2026-69843

Source: MSRC CVE-2026-69843 · CVE Brief daily roundup

Brevo post-mortem: stolen Cloudflare API key used to inject ClickFix into customer-embedded scripts

Brevo (status.brevo.com) / BleepingComputer · September 17, 2026

Brevo published a post-mortem confirming that attackers obtained a long-lived, full-permission Cloudflare API key that had been hardcoded in application source code and used it to create a malicious Cloudflare Worker. For roughly five and a half hours on September 14 (16:07–20:30 UTC), the Worker rewrote responses at the CDN edge for brevo.com, sendinblue.com, and sibforms.com, and modified the Brevo forms, Conversations widget, and SDK loader scripts that customers embed on their own sites — Sansec estimates up to 100,000 sites were affected. Visitors were shown a fake Cloudflare verification page with ClickFix instructions; on WordPress sites the script also tried to upload a backdoor plugin (“Web Media Optimizer”) if the visitor was a logged-in admin. Brevo revoked the key, removed the Worker, and says its app, API, and customer data were not affected. No CVE applies.

“Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.” — Brevo post-mortem, as quoted by BleepingComputer

Source: Brevo post-mortem · BleepingComputer · SecurityWeek

Still developing

Cisco ISE zero-day authentication bypass (CVE-2026-76460, CVSS 10.0) exploited in the wild

Cisco PSIRT · September 16, 2026

Cisco published an advisory for CVE-2026-76460, a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), exploitable regardless of configuration. Cisco PSIRT confirmed active exploitation, and successful attacks can lead to command execution as root. There are no workarounds; fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. CISA added the CVE to KEV on September 16 with a three-day federal deadline. Cisco recommends checking access.log on every node for suspicious usernames and re-imaging nodes where compromise is suspected.

“The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” — Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5

Source: Cisco advisory · CISA KEV alert · BleepingComputer

This brief covers the trailing ~48 hours (September 17–19, 2026).

Primary sources:

• CISA — Adds Two Known Exploited Vulnerabilities to Catalog (Sept. 18)
• CISA — Adds One Known Exploited Vulnerability to Catalog (Sept. 18)
• CISA — Known Exploited Vulnerabilities Catalog
• Asim Manizada — A quartet of Linux local root vulns
• WordPress — 7.1.1 Maintenance and Security Release
• CVE.org — CVE-2026-92941
• Air Security — Plugin4Shell
• Microsoft MSRC — CVE-2026-69843
• Brevo — Incident post-mortem
• Cisco — cisco-sa-ISE-ABP-VNSW7Tn5

This brief covers the trailing ~48 hours (September 12–14, 2026). Every item below was verified against its primary source — vendor advisory, CISA KEV entry, or the original research — with the publish date confirmed on that page. It was a quiet weekend: two developments cleared verification inside the window, followed by several active campaigns from the days just before it.

Cisco Secure Email Gateway SQL injection actively exploited for root, added to CISA KEV

Cisco PSIRT / CISA · September 14, 2026

Cisco published a critical advisory for CVE-2026-76461 (CVSS 9.8, CWE-89), a SQL injection flaw in the email-parsing logic of AsyncOS for Cisco Secure Email Gateway that lets an unauthenticated remote attacker execute arbitrary commands as root simply by sending a crafted email through the appliance. It affects physical and virtual Secure Email Gateway deployments regardless of configuration (Secure Email and Web Manager and Secure Web Appliance are not affected); fixed releases are 15.5.5-0141, 16.0.4-3021 and 16.5.0-780, and there are no workarounds. Cisco confirmed in-the-wild exploitation, has already upgraded all Secure Email Cloud tenants, and has directly contacted cloud customers where indicators of compromise were found. CISA added the CVE to the KEV catalog the same day with a September 17 remediation due date; the advisory includes a mail_logs grep for COPY.*TO PROGRAM as a triage indicator.

“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX

Source: Cisco advisory · CISA KEV alert

Microsoft ships out-of-band updates after September security patches broke Remote Desktop Services

Microsoft · September 14, 2026

Microsoft released emergency out-of-band cumulative updates to fix Remote Desktop Services (RDS) failures introduced by the September 8 security updates: KB5129237 (Windows Server 2022, OS Build 20348.5631), KB5129235 (Windows Server 2025), KB5129195 (Windows 11 24H2/25H2, builds 26100.9457 and 26200.9457), KB5129194 (Windows 11 26H1) and KB5129236 (Windows 10 21H2/22H2). The server packages are available via the Microsoft Update Catalog only. The regression matters from a security standpoint because many admins had been rolling back KB5122882 / KB5122871 to restore RDP, which also removed that month’s security fixes, including the two exploited zero-days (CVE-2026-81963 and CVE-2026-85880). The OOB updates also fix a Hyper-V/Plan9 shared-folder issue and a multichannel USB audio problem; a separate USB Audio Class 1.0 “Code 10” failure remains unresolved.

“In affected environments, RDS might become unstable, causing RDP connection and sign-in failures or servers to become unresponsive during Remote Desktop configuration.” — Microsoft, KB5129237 release notes

Source: Microsoft KB5129237 · Microsoft KB5129195 · BleepingComputer

Still developing

GitLab CVSS 10 file read, ScreenConnect and chained Artifactory flaws land in KEV

CISA · September 11, 2026

CISA added four vulnerabilities to KEV on September 11: CVE-2026-85706 (GitLab CE/EE path traversal in the repository commits API, CVSS 10.0, unauthenticated arbitrary file read; fixed in 19.1.8, 19.2.6 and 19.3.2, with watchTowr observing in-the-wild probes within hours of disclosure), CVE-2026-84869 (ConnectWise ScreenConnect improper privilege management / missing authorization, CVSS 9.9, allowing file transfer and execution through active remote sessions without host confirmation), and CVE-2026-42016 / CVE-2026-42018 (JFrog Artifactory, CVSS 8.1 and 7.5). Wiz reports the two Artifactory bugs were chained between August 15 and September 8 to mint admin-scoped tokens on self-hosted instances, install malicious Groovy plugins and drop a Rust backdoor. Federal due dates: September 14 for GitLab and ScreenConnect, September 25 for Artifactory.

“Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances.” — Wiz Research

Source: CISA KEV catalog · GitLab 19.3.2 patch release · ConnectWise bulletin · BleepingComputer

Check Point VPN: two CVSS 9.8 pre-auth RCEs, Dutch NCSC expects large-scale exploitation

Check Point / NCSC-NL · September 9–10, 2026

CVE-2026-85102 (improper certificate validation during VPN negotiation, sk1000117) and CVE-2026-85103 (heap overflow in the VPN certificate ASN.1 decoder, sk1000118), both CVSS 9.8, allow unauthenticated remote code execution on Quantum Security Gateways, with the second also reaching Security Management Servers. Affected lines include R81.20, R82, R82.10, R81.10.x and R82.00.x plus end-of-support R80.x/R81; R82.20 is not affected. Fixes ship via LivePatch Take 24 and Jumbo Hotfix Accumulator Takes 44/126/166. Check Point reported no evidence of exploitation at disclosure; the Dutch NCSC issued an alert the next day rating the likelihood of exploitation as high. Neither CVE is in KEV yet.

“The NCSC assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon.” — Nationaal Cyber Security Centrum (translated)

Source: Check Point sk1000117 · Check Point sk1000118 · NCSC-NL alert · BleepingComputer

UNC3569 exploited a one-click RCE in Tencent’s Sogou Input Method to drop GRAYRABBIT

Gen Threat Labs · September 10, 2026

Gen Digital disclosed CVE-2026-51990, a one-click remote code execution chain in Sogou Input Method for Windows (hundreds of millions of installs) that combines unvalidated argument injection in the sgbiz: protocol handler, unrestricted URL navigation in a CEF webview, and a bundled Chromium 80 engine running with the sandbox and same-origin policy disabled. The PRC-nexus group UNC3569 exploited it in the wild using a public exploit for CVE-2021-38003 to deploy the GRAYRABBIT backdoor via DLL sideloading. Tencent patched the protocol handler in version 16.3.0.3498 (April 21, 2026), but the researchers note the embedded browser remains outdated and unsandboxed. No CVSS score has been published by the vendor, and the CVE is not in KEV.

“We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link.” — Gen Threat Labs

Source: Gen Threat Labs research · BleepingComputer

Mass scanning of exposed Vite dev servers for AWS, Azure and Terraform secrets

F5 Labs · September 11, 2026

F5 Labs’ honeypots recorded roughly 32,000 events across 807 attack sessions in August exploiting CVE-2026-39364 (CVSS 7.5, CWE-200), a server.fs.deny bypass in the Vite development server’s /@fs/ route that returns restricted files when query strings such as ?raw?? or ?import&raw are appended. Affected versions are Vite 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 (fixed in 7.3.2 and 8.0.5). The scanner cycled through .env variants, .aws/credentials across user home directories, Azure accessTokens.json, Terraform state and /proc/self/environ, spoofing Googlebot, ClaudeBot and GPTBot user agents from Google Cloud IP space. The CVE is not in KEV, although the related CVE-2025-31125 is.

“The rapid increase from baseline background noise highlights how quickly newly disclosed bypass methods are folded into automated credential-harvesting operations.” — F5 Labs, Sensor Intel Series

Source: F5 Labs research

This brief covers the trailing ~48 hours (September 12–14, 2026).

Primary sources:

• Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX (CVE-2026-76461)
• CISA: Adds One Known Exploited Vulnerability to Catalog (Sept. 14, 2026)
• Microsoft KB5129237 (Windows Server 2022 out-of-band)
• Microsoft KB5129195 (Windows 11 24H2/25H2 out-of-band)
• CISA Known Exploited Vulnerabilities Catalog
• GitLab Patch Release 19.3.2 (CVE-2026-85706)
• ConnectWise ScreenConnect Security Bulletin (CVE-2026-84869)
• Check Point sk1000117 (CVE-2026-85102)
• Check Point sk1000118 (CVE-2026-85103)
• NCSC-NL alert on Check Point VPN vulnerabilities
• Gen Threat Labs: Gray Rabbits and the Tale of a One-Click Backdoor (CVE-2026-51990)
• F5 Labs: Cloud Takeover — Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364)