CVE-2018-13379, CVE-2020-0688, CVE-2021-22986, CVE-2022-1388, CVE-2022-42475, CVE-2023-27997, CVE-2023-46747, CVE-2024-21762, CVE-2026-27540, CVE-2026-5430, CVE-2026-58113, CVE-2026-73807, CVE-2026-76461, CVE-2026-78006, CVE-2026-78159, CVE-2026-78225, CVE-2026-80465, CVE-2026-81855, CVE-2026-81861, CVE-2026-82567, CVE-2026-87886
Domains:
volmira[.]site, zaviro[.]online., chat5188[.]tk.
IP Addresses:
92.241.13.213, 31.59.129.150, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209, 2.0.3.1, 6.17.3.1, 6.17.4.1
Get tomorrow's brief in your inbox
Today: Cisco discloses a critical zero-day in Secure Email Gateway already exploited in the wild with root-level command execution. Microsoft issues emergency patches after September's 974-CVE update broke Remote Desktop Services and Hyper-V. WSO2 API Manager JWT bypass vulnerability now under active exploitation with forged admin tokens targeting enterprise APIs.
Cisco Secure Email Gateway Zero-Day (CVE-2026-76461)
Cisco confirmed active exploitation of a critical zero-day in Secure Email Gateway affecting cloud and on-premises deployments. The vulnerability allows unauthenticated remote attackers to execute commands with root privileges. CISA added CVE-2026-76461 to the KEV catalog on September 15 with a September 17 remediation deadline. EPSS score is 0.022 (81st percentile). Cisco's incident response team identified multiple compromised customers and deployed cloud-side mitigations for Secure Email Cloud users. Exploitation requires no authentication and can be triggered by simply sending an email through the appliance.
WSO2 API Manager JWT Bypass Under Active Exploitation (CVE-2026-5430)
WatchTowr observed active exploitation of CVE-2026-5430 (CVSS 9.8) targeting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway. The flaw allows unauthenticated attackers to bypass JWT authentication by signing tokens with unsupported algorithms, leading to full account takeover including administrative accounts. Attackers captured on September 13 used forged JWT tokens with admin privileges to access API backend endpoints, credentials, consumer keys, and secrets for registered applications. The service's role as an API gateway provides lateral movement opportunities to internal systems.
Acronis Backup Plugin for cPanel Exploited (CVE-2026-87886)
Acronis confirmed limited, targeted attacks exploiting CVE-2026-87886 (CVSS 7.8) in the Backup plugin for cPanel and WHM. Insecure file permissions allow privilege escalation. All Linux versions before build 1.9.3.1021 are affected. The Backup extension for Plesk (before 1.8.11.638) is also vulnerable but not yet exploited.
Thai ISP Compromised via Fortinet Vulnerabilities
Hunt.io discovered a multi-stage intrusion targeting Thai broadband provider 3BB (Triple T Broadband) using Fortinet and F5 vulnerabilities. Attackers left their toolkit exposed in an open directory containing 298 files across 30 subdirectories. Initial access came through FortiGate SSL-VPN endpoint fingerprinting and exploitation of CVE-2024-21762 for remote code execution. Simultaneously, attackers probed F5 BIG-IP for CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747. Post-exploitation included PwnKit and Dirty COW for privilege escalation, MeshCentral deployment as persistent C2, credential harvesting from SSH keys, PHP configs, databases, SNMP strings, and Radius authentication. Cleanup scripts removed exploitation artifacts while verifying persistence mechanisms remained operational.
NightEagle APT Targets Russian Companies
Kaspersky GERT investigated NightEagle (APT-Q-95) incidents targeting Russian businesses using compromised VPN credentials for initial access. Attackers deployed GhostContainer backdoor on Microsoft Exchange servers, incorporating Neo-reGeorg tunnel, CVE-2020-0688 exploit, and GhostWebShell components. The backdoor processes C2 commands via x-owa-urlpostdata headers, evades AMSI and Windows Event Log mechanisms, and implements traffic proxying. For lateral movement, attackers used Microsoft dev tunnels and rdp2tcp to expose RDP over devtunnels.ms domains. Tools were hosted on GitHub repositories disguised as legitimate software.
Healthcare Ransomware Claims
Cedar County Memorial Hospital in Missouri shut down IT networks on August 14 after a disruption affecting EHR, patient portal, internet access, and diagnostic imaging. A ransomware group has claimed responsibility. Singapore's Islamic Religious Council (MUIS) payroll system SmartHRMS, supplied by Avelogic, was hit by ransomware with staff details potentially compromised.
September Patch Tuesday Emergency Fixes
Microsoft issued out-of-band updates on September 15 to fix issues caused by the record-setting September Patch Tuesday that addressed 974 CVEs. Emergency patches fix Remote Desktop Services instability (RDP connections failing, sign-in issues, servers hanging at "Please wait for the Remote Desktop Configuration"), Hyper-V host folder share unavailability in Linux VMs, USB audio device failures in multichannel mode, and Windows Update page unresponsiveness. September's massive update illustrates how AI-accelerated vulnerability reporting creates patch volume challenges and increases regression risk.
KREMLIN Banking Malware Indicators
Brazilian banking malware KREMLIN (tracked by Elastic as REF9334) uses malicious Chrome and Edge extensions to steal credentials and session tokens. Active since May 2025, KREMLIN employs multi-stage JavaScript loaders, custom C++ installers, and browser extensions that bypass Chromium integrity via Secure Preferences manipulation and HMAC regeneration. Attackers abuse SentinelOne's "SentinelMemoryScanner.exe" for DLL sideloading and use Ethereum smart contracts as dead drop resolvers to update C2 endpoints. Extension ID: ndpbidppejfanjbhfgjlohfanbfbklff. C2 domains: volmira[.]site, zaviro[.]online.
HEAVYGRAM/CHOSEN BRICK Telegram-Controlled Malware
FBI, UK NCSC, and Netherlands AIVD detailed Windows malware attributed to Iran's MOIS targeting dissidents, journalists, and activists worldwide since autumn 2023. The malware uses Telegram bots for C2, copies emails and chat messages, takes screenshots, and activates microphones. Delivered via fake software disguised as Pictory, KeePass, Telegram, RunwayML, Norton Antivirus, Adobe Flash Player, or MRI scan results. Persistence via registry Run key and Microsoft Defender folder exclusions.
BambooToken MQTT-Based Malware
Lumen Black Lotus Labs disclosed BambooToken, a multi-platform malware family using MQTT protocol for C2. Active since February 2023, targets organizations in Asia and South America through Tendyron OnKey software DLL sideloading. Targets OnKeyToken_KEB.dll to enumerate hosts and enter MQTT command loop. Expanded to Linux in December 2025. C2 server: chat5188[.]tk.
WooCommerce Wholesale Lead Capture Exploitation (CVE-2026-27540)
Wordfence blocked over 100,000 exploit attempts targeting CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture since June 2026, with 99 attempts in the last 24 hours. The flaw allows unauthenticated arbitrary file upload via wwlc_file_upload_handler AJAX action, leading to PHP web shell deployment. Attackers upload "shell.php" offering browser-based upload forms for additional malicious files. Attack source IPs include 92.241.13.213, 31.59.129.150, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209.
The Events Calendar Critical RCE Flaws (CVE-2026-78159, CVE-2026-78006)
Wordfence detailed two critical flaws (CVSS 9.8) in The Events Calendar WordPress plugin (600,000+ sites). CVE-2026-78159 (≤6.17.3) exploits insufficient validation in parse_array function. CVE-2026-78006 (≤6.17.4) bypasses is_safe_widget_instance protections. Both allow unauthenticated RCE via pending-comment preview without moderator approval. Attack chains enable PHP Object Injection for OS commands or password reset for admin takeover and malicious plugin upload.
ICS/OT Vulnerabilities
CISA published seven ICS advisories on September 15:
Wärtsilä FOS-Onboard: CVE-2026-78225 and CVE-2026-81855, hard-coded cryptographic keys in marine engine control systems
Source: CISA ICS Advisories
Apple's Record Patch Release
Apple addressed 200+ vulnerabilities in iOS 27 and macOS Golden Gate 27, marking a record-setting patch volume driven by AI-accelerated vulnerability discovery. The "vulnpocalypse" trend continues across vendors as automated code analysis uncovers decades of technical debt.
NIST/CISA Token Protection Guidance
NIST and CISA released an interagency report for federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms in hybrid/multi-cloud environments. Addresses token forgery, theft, and misuse for lateral movement. Supports EO 14306 on secure software development and emphasizes Secure by Design principles.
CDM Program Evolution
CISA's Continuous Diagnostics and Mitigation program is prioritizing velocity, unification, and data-driven risk management. Three-year roadmap for expanding SIEM-as-a-Service with focus on aggregating demand, buying outcomes not products, and continuous improvement acquisition models. Post-SolarWinds evolution toward common operating picture for government-wide operational visibility.
AI-driven vulnerability discovery is fundamentally changing patch cadence and regression risk. Microsoft's 974-CVE September update and Apple's 200-CVE release both represent record volumes that stress organizational testing capacity. The immediate need for emergency patches to fix Patch Tuesday regressions validates concerns about deployment speed versus quality trade-offs. Organizations must adopt risk-based staging, representative test environments, and rollback capabilities as patch volumes continue to scale. The challenge is balancing security urgency against operational disruption when vendors cannot eliminate all side effects before release.