← All threat briefs

Cybersecurity Brief - 2026-09-26

SECURITY // 2026-09-26

Cybersecurity Brief — 2026-09-26

Critical Vulnerabilities & Active Exploitation

  • Roundcube Webmail pre-auth SQL injection (CVE-2026-48842, CVSS 8.1) under active exploitation. The Canadian Centre for Cyber Security warns that attackers are exploiting this flaw in Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The bug stems from unsafe preg_replace() handling in the virtuser_query plugin. Patch immediately. (Source: The Hacker News, SecurityWeek)

  • WSO2 API Control Plane path traversal (CVE-2026-5430, CVSS 9.8) and Adobe Commerce/Magento flaws added to CISA KEV. CISA confirmed active exploitation of both. WSO2 flaw allows unauthenticated file access; Adobe Commerce issue enables remote code execution. Apply vendor patches now. (Source: The Hacker News, BleepingComputer)

  • Kiteworks urges customers to shut down servers for 6 hours Saturday after receiving threat intelligence of a potentially imminent zero-day attack against its secure file-sharing platform. The vendor says the window is needed to deploy mitigations. (Source: BleepingComputer)

  • Elementor WordPress plugin CSRF vulnerability allows unauthenticated admin account creation. Sites running affected versions should update immediately; the flaw requires no authentication and can lead to full site compromise. (Source: BleepingComputer)

Major Incidents & Threat Activity

  • Bitget cryptocurrency exchange loses $351.6M to suspected North Korean hackers (Lazarus Group). Unauthorized transfers from hot/warm wallets detected Sep 24 18:31 UTC; cold wallets unaffected. Blockchain analysis links wallet addresses to known DPRK infrastructure. (Source: The Hacker News, SecurityWeek, The Register)

  • U.S. Army soldier Cameron Wagenius ("Kiberphant0m") sentenced to 70 months for stealing call/text metadata of 100M+ AT&T customers via exposed Snowflake credentials, plus extortion of multiple telcos. Co-conspirators include Kenneth Schuchman (Satori botnet) and Canadian Connor Moucka (Snowflake extortions). (Source: Krebs on Security)

  • Kosovar national Ardit Kutleshi pleads guilty to operating Rydox marketplace, a cybercrime forum selling stolen PII, credentials, credit cards, and tools. Faces up to 22 years. Rydox facilitated thousands of fraud transactions. (Source: BleepingComputer, SecurityWeek)

  • ShinyHunters compromises Clop ransomware gang's leak site via unauthenticated path traversal in Grav CMS. Clop forced to migrate to new Tor address. ShinyHunters claims motive was "protecting our business." (Source: BleepingComputer, SecurityWeek, The Register)

Supply Chain & Development Threats

  • Compromised actions-cool GitHub Actions (issues-helper, maintain-one-comment) re-enabled and resumed executing Mini Shai-Hulud malware. Originally compromised in May 2026 campaign; repos were briefly accessible last week before being disabled again. Audit workflows using these actions. (Source: The Hacker News)

  • Placeholder domain third-party.com (referenced in 1,700+ repos as documentation example) now serves ClickFix malware lures to Windows browsers while showing decoy content to others. Attackers exploit trust in common placeholder domains. (Source: The Hacker News)

  • Open source AI agents (Strix, Cairn, Hermes) used in near-autonomous campaign hitting 27+ companies, stealing 600K+ credit cards and deploying skimmers. Operator spent ~$25/scan via OpenRouter; Hermes ran a "SOUL - Red Team Operator" persona with 78 attack skills. (Source: The Register)

AI & Emerging Threats

  • Salesforce Agentforce "SalesBleed" flaws (3 CVEs) enable zero-click data exfiltration and Slack phishing via prompt injection in AI agents. Attackers can hijack trusted agents to steal CRM data and send malicious messages through internal channels. (Source: Dark Reading, SecurityWeek, The Register)

  • PamStealer macOS malware adds live C2 payload decryption and multi-layer persistence. New variants use server-side key derivation so payloads only decrypt on infected hosts, evading static analysis. Still uses JXA dropper but with modified lures. (Source: The Hacker News)

  • File-change notification APIs in Windows, Linux, Android leak keystroke timing, browsing activity, and WhatsApp media events via side channels. Microsoft considers this "by design." No patch expected; mitigate via application sandboxing. (Source: SecurityWeek, The Register)

  • Canonical moves Ubuntu to weekly kernel releases as AI-assisted bug hunting floods vendors with CVEs. Overlapping two-week SRU cycles replace monthly cadence; release candidates available after week one for orgs willing to self-test. (Source: The Register)

Cloud & Infrastructure

  • Cloudflare Containers flaw allowed cross-tenant data reads from leftover disk space on shared servers. Data was from prior container allocations, not live workloads; attacker couldn't target specific customers. Fixed; no customer action needed. (Source: The Hacker News)

  • Unpatched OnePlus/OPPO root vulnerabilities let any installed app gain root without permissions via chained flaws in OEM software. OnePlus acknowledges many devices affected; no fix timeline published. (Source: The Hacker News)

Policy & Operations

  • CISA releases Election Security Plan flagging patching barriers in election infrastructure and voter database targeting risks. Developed per DHS Secretary directive; focuses on resilience for 2026 midterms. (Source: SecurityWeek)

Brief compiled from The Hacker News, Dark Reading, Krebs on Security, BleepingComputer, SecurityWeek, The Register, and CISA Alerts. Deduplicated across sources.