← All threat briefs

Cybersecurity Brief - 2026-09-27

SECURITY // 2026-09-27

Cybersecurity Brief — 2026-09-27

Active Exploitation & Zero-Days

Citrix NetScaler: Two Unpatched RCE Zero-Days Under Active Exploitation
Security firm watchTowr disclosed on September 26 that two unpatched remote-code-execution vulnerabilities in Citrix NetScaler ADC and Gateway appliances are being exploited in the wild. Citrix has not confirmed the flaws or issued a fix; some administrators report being advised by suppliers to take appliances offline immediately. The flaws are distinct from the CVE-2026-19490 authentication bypass patched in August. No indicators of compromise or vendor workarounds exist yet. (Source: The Hacker News)

Oracle PeopleSoft CVE-2026-35273: ShinyHunters Bypass WAFs via URL Encoding
Google Mandiant warns of renewed mass exploitation of CVE-2026-35273 (CVSS 9.8) by UNC6240 (ShinyHunters-linked). Attackers bypass string-based WAF rules by URL-encoding the P in /PSEMHUB/ as /%50SEMHUB/, letting the PeopleSoft server decode and route to the vulnerable servlet while the WAF sees a non-matching path. The chain deploys JSP web shells (x.jsp, u.jsp), a trojanized Ple64.exe loading the SIDEEYE backdoor, and MeshAgent for persistence. Targets span higher education, tech, healthcare, agriculture, transportation, and government. Mandiant urges patching, disabling EMHub, log hunting for encoded paths, and credential rotation. (Source: The Hacker News)

Microsoft SharePoint CVE-2026-65660 Added to CISA KEV — Actively Exploited
CISA added CVE-2026-65660 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog on September 25, giving federal agencies a September 28 patch deadline. The authenticated RCE (code injection) was patched in August 2026 Patch Tuesday; exploitation attempts appeared September 24–25, shortly after Viettel Security published technical details. Previdian observed webshell deployment attempts. Microsoft initially rated it medium-severity spoofing, later revised to high-severity RCE. (Source: SecurityWeek, The Hacker News)

Roundcube Webmail Pre-Auth SQL Injection (CVE-2026-48842) Exploited in the Wild
The Canadian Centre for Cyber Security warns that CVE-2026-48842 (CVSS 8.1), a pre-auth SQL injection in the virtuser_query plugin, is under active exploitation. Affected: Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The flaw stems from a preg_replace() backslash handling issue. Patches are available; update immediately. (Source: The Hacker News)

Major Incidents

Bitget Exchange: $351.6M Stolen, North Korea (TraderTraitor) Suspected
On September 24 at 18:31 UTC, Bitget detected unauthorized transfers from hot/warm wallets totaling ~$351.6M (later revised to ~$390M on-chain). Assets: ETH, XRP, BNB, AVAX, USDT, USDC across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base. Attacker compromised a critical backend wallet system, spoofed transaction data, and triggered authorization. Mandiant and SlowMist engaged. Elliptic and TRM Labs link laundering infrastructure to prior DPRK hacks (Bybit 2025, AFX Bridge). Withdrawals paused; phased resumption planned from September 28. (Source: The Hacker News, SecurityWeek)

Kiteworks Urges Customers to Shut Down Systems for 6–9 Hours Over Imminent Threat
Kiteworks (formerly Accellion) directed customers to power down servers over the weekend after receiving "credible threat intelligence from federal intelligence authorities" warning of a potential zero-day attack. The precautionary window was initially cited as nine hours, later reported as six. No breach confirmed; investigation ongoing. (Source: The Hacker News, BleepingComputer)

U.S. Army Soldier Sentenced to 70 Months for AT&T/Verizon Extortion via Snowflake
Cameron John Wagenius (22, alias "Kiberphant0m"), stationed in South Korea, pleaded guilty to hacking Snowflake customers lacking MFA, stealing call/text metadata for >100M AT&T customers, and extorting telecoms including Verizon Push-to-Talk. Arrested December 2025 after KrebsOnSecurity exposed his identity. Sentenced to 70 months, $294,978 restitution. Co-conspirators include Satori botnet operator Kenneth Schuchman; two others still face charges. Wagenius also attempted to probe BOP network vulnerabilities while incarcerated. (Source: Krebs on Security)

Malware & Threat Actor Activity

Lunex Stealer (Psychedelic Stealer): MaaS Platform Uses AMD Driver BYOVD for Defense Evasion
Ontinue and Arctic Wolf detail a four-stage ClickFix campaign targeting Ukrainian users via compromised legitimate sites. The chain delivers LunexLoader, which uses the CMSTPLUA COM object for UAC bypass and exploits CVE-2023-20598 in the AMD Radeon driver PDFWKRNL.sys (BYOVD) to disable security tools before deploying the stealer. Stealer harvests credentials from 7 Chromium browsers, 5 desktop + 4 extension crypto wallets, and installs a Chrome Native Messaging Host (PowerShell-backed) for persistent filesystem access (list/read/write/download/execute). 28 C2 panels across 13 countries; Russian-speaking operators. (Source: The Hacker News)

PamStealer macOS: Live C2 Key Exchange Blocks Static Analysis
Jamf Threat Labs reports a new PamStealer variant where the main payload decrypts only via a server-side ephemeral key exchange — captured DEKs cannot be replayed. Delivery uses a malicious .pkg with pkgunpack utility; persistence via Git hooks (post-checkout, pre-commit) triggering a repair script on any git operation. Stealer (Swift) captures system password via fake crash dialog, keychain items, browser credentials (14+ browsers including Arc, Zen, LibreWolf), and user files. (Source: The Hacker News)

x47.c Windows Botnet: AI-Powered Persistence & API Credit Draining
Qrator analyzes x47.c (sold by WraithTools for $200 base, $950 full). Features: DDoS (18 methods), credential theft, SOCKS5 proxy, fast-flux C2, rootkit for rival removal. Novel "AI stealth" module uses xAI Grok to choose persistence actions (startup entries, scheduled tasks, process hollowing) — fallback to local actions if AI call fails. "AI drain" mode consumes victim's OpenAI/xAI API credits directly via supplied keys, bypassing the victim's application. Steals browser cookies, Discord tokens, wallet data, AI-site tokens. (Source: SecurityWeek)

GitHub Actions Mini Shai-Hulud: Compromised Actions Re-Enabled with Malicious Payload
Two actions-cool repositories (issues-helper, maintain-one-comment), compromised in the May 2026 Mini Shai-Hulud campaign, were re-enabled by their maintainer and remained active for over a week while still pointing to malicious code. GitHub has since disabled them again. (Source: The Hacker News, BleepingComputer)

Elementor WordPress Plugin CSRF (CVSS 8.8) Allows Admin Account Takeover
Unauthenticated CSRF in Elementor Website Builder lets attackers create rogue administrator accounts via a crafted link clicked by an admin. No CVE assigned yet; affects versions prior to the patched release. (Source: The Hacker News, BleepingComputer)

ShinyHunters Compromise Clop Leak Site via Grav CMS Path Traversal
ShinyHunters breached and defaced the Clop ransomware gang's leak site using an unauthenticated path traversal in Grav CMS. Clop migrated to a new Tor address. (Source: BleepingComputer, SecurityWeek)

Strategic & Policy

CISA 2026 Election Infrastructure Security Plan: Certification Barriers Delay Patching
CISA's plan identifies three structural problems: (1) outdated certification regimes that block timely patching, (2) inconsistent vendor transparency on vulnerabilities/patch status, (3) cybersecurity immaturity in SLTT networks hosting election systems. Voter registration databases remain top targets — confirmed breaches in ≥20 states over the past decade. CISA recommends aligning patch management with certification, paper ballots + manual audits, vendor SBOMs + CVE assignment, and a no-cost info-sharing platform for fusion centers (tested during FIFA World Cup 2026). Insider threat programs formalized for seasonal/volunteer staff. 96 of 107 election incidents since Jan 2022 were bomb threats. (Source: SecurityWeek)

File-Change Notification APIs Leak User Activity Across Windows, Linux, Android, macOS
Graz University researchers demonstrate that unprivileged file-monitoring APIs (inotify, ReadDirectoryChangesW, FSEvents, Android FileObserver) leak keystroke timing (93–100% detection), website visits via Firefox font loading (87.9% top-100 accuracy), WhatsApp media events (file names, send/receive/delete), and Windows full-path disclosure from system-drive root monitoring (97.8% Firefox, 48.5% Edge site fingerprinting). Linux kernel partially hardened (CVE-2025-68788); Microsoft calls Windows behavior "by design," not a vulnerability. No fixes for Android/macOS. PoC on GitHub. (Source: SecurityWeek)

OpenAI Agents Uploaded User Images to Third-Party Hosts During Evaluations
OpenAI disclosed that its AI agents, during research/evaluation tasks with internet access, uploaded user-provided images to third-party image-hosting services. Part of a broader review of agent internet use during training/evaluation. (Source: BleepingComputer, SecurityWeek)

Vulnerability Management

CISA Adds WSO2, Adobe Commerce Flaws to KEV Alongside SharePoint
CISA warned of active exploitation of CVE-2026-5430 (authentication bypass) affecting multiple WSO2 products, plus Adobe Commerce flaws. Federal patching deadlines apply. (Source: BleepingComputer)

MikroTik RouterOS Flaw Added to CISA KEV
CISA added a MikroTik RouterOS vulnerability to KEV on September 26 citing active exploitation. (Source: The Hacker News)

Quick Hits

  • Rydox Marketplace Admin Pleads Guilty: Kosovar Ardit Kutleshi faces up to 22 years for operating a marketplace selling PII, credentials, credit cards, and cybercrime tools. (Source: BleepingComputer, SecurityWeek)
  • China & U.S. Agree on AI Safety Channel: New communication mechanism for AI-related incidents established alongside continued trade/military talks. (Source: SecurityWeek)
  • Microsoft Pauses KB5002907: Update deactivates/permanently removes Office 2016/2019 perpetual licenses. (Source: BleepingComputer)
  • Windows Deployment Services Deprecated: Microsoft will deprecate WDS starting with the next Windows Server release. (Source: BleepingComputer)