CISA confirmed ransomware gangs have joined the exploitation of a critical VMware vCenter bug, a compromised WordPress plugin update backdoored about 1,500 sites through the vendor's own download channel, and two China-nexus groups ran the same Chrome and Windows zero-day chain against NGOs.
🔴 CRITICAL (2)
CISA: ransomware gangs now exploiting critical VMware vCenter RCE CVE-2026-59310 Confirmed
CISA updated its Known Exploited Vulnerabilities catalog over the weekend to flag CVE-2026-59310 as abused by ransomware gangs, adding criminal operators to the state linked activity already seen against the flaw. It is a critical directory traversal in the vCenter Syslog server that lets an unauthenticated attacker with network access execute arbitrary code, patched by Broadcom on July 29. An earlier campaign tied to a suspected APT compromised more than 361 IP addresses across 47 countries with a reverse SSH tool, and Shadowserver still tracks over 450 internet exposed vCenter servers. If you run vCenter 7.0, 8.0 or 9.0.x, confirm you are on the fixed builds and hunt for unexpected SSH tunnels, new accounts and unusual Syslog service activity.
Sources BleepingComputer|CISA KEV
Malicious Admin Menu Editor Pro updates backdoored around 1,500 WordPress sites Confirmed
An attacker who took control of the plugin vendor’s download site pushed a trojanised version 2.35 of Admin Menu Editor Pro, the premium edition of a plugin whose free version runs on more than 300,000 sites. The malicious build was available for roughly seven hours on September 14, installed a web shell through includes/wp-user-consent.php and created a hidden administrator account, and the clean 2.36 release issued later the same day was compromised as well, suggesting the attacker held root access to the update server. The developer says about 230 customers installed the malicious build across at least 1,500 sites. Anyone who installed 2.35 or 2.36 should treat the site as compromised, restore from a backup taken before September 14 where possible, check for the object-cache directory and hidden wp_ user accounts, then rotate every credential stored on the site.
🟠 HIGH (5)
Acronis warns of exploited privilege escalation in its cPanel and Plesk backup plugins Confirmed
Acronis disclosed CVE-2026-87886, a high severity local privilege escalation in its backup plugin for cPanel and WHM and its backup extension for Plesk, and says exploitation has been detected in the wild in limited, targeted attacks. A low privileged attacker can raise their privileges on the server without user interaction, which on shared hosting means one compromised account can reach neighbouring tenants and the host itself. Fixed builds are 1.9.3 HF3 for cPanel and WHM and 1.8.11 for Plesk, covering anything older than 1.9.3.1021 and 1.8.11.638 respectively. Hosting providers and resellers should patch now and review recent account and privilege changes.
Sources BleepingComputer
Two China-nexus groups used the same Chrome and Windows zero-day chain against NGOs Confirmed
Volexity reports that UTA0560 and JungleBamboo, also tracked as APT31, ran an identical exploit chain against non-governmental organisations from September 1, chaining CVE-2026-85046 and CVE-2026-87491 in Chrome with CVE-2026-85880 in Windows to escape the browser sandbox and inject code into the Chrome browser process. UTA0560 delivered the GRIMWEDGE JavaScript backdoor, while APT31 installed LONGTALE, a credential stealing extension disguised as a Google Gemini assistant. Because the Chrome fixes had landed in the open source Chromium code but not yet in a stable Chrome release, the bugs were effectively zero-days against Chrome users, and byte identical shellcode across the two campaigns suggests a common exploit source. All three CVEs sit in CISA’s KEV catalog with federal remediation due September 18, so verify your Chrome version instead of assuming auto-update worked.
Sources The Hacker News|Security Affairs
CenterPoint Energy confirms customer data stolen in cyberattack Confirmed
CenterPoint Energy, the Houston utility that supplies electricity and gas to roughly 7 million customers across Texas, Indiana, Minnesota and Ohio, told the SEC that an unauthorised third party obtained personal information from one of its external facing systems. The filing followed a September 12 cybercrime forum post offering a 2.5 GB archive and claiming nearly 7.5 million customer records, with the poster threatening to move from data theft to attacking critical infrastructure. The company says service delivery was unaffected and it does not expect a material impact, and the scope of affected customers is still being established. Customers should be alert to utility themed phishing, and operators of external facing systems should review the same exposure class.
Sources SecurityWeek|BleepingComputer
LiteSpeed Enterprise flaw could give one hosting account root on a shared server Confirmed
cPanel warned on September 14 that a critical vulnerability in LiteSpeed Web Server Enterprise before 6.3.7 lets a low privileged user of a single hosting account gain root access on a shared server, bypassing the controls that keep accounts apart, including CloudLinux CageFS. Shared hosting rests on the assumption that one customer cannot see or reach another, so a single compromised website account would expose every site on the machine and the server configuration itself. LiteSpeed published 6.3.7 on September 11, and no CVE identifier or severity score has been published for the issue. Hosting operators should upgrade immediately and review recent logins, scheduled tasks and file changes for cross account access.
Sources The Hacker News
US, UK and Dutch agencies detail Iranian spyware aimed at dissidents and journalists Confirmed
A joint advisory published on September 15 by the FBI, the UK NCSC and the Dutch AIVD describes Windows malware that Iran’s Ministry of Intelligence and Security uses to spy on dissidents, journalists and activists: the FBI calls it HEAVYGRAM and the NCSC calls it CHOSEN BRICK. It is controlled through Telegram and can copy email and chat messages, take screenshots and record audio from the microphone, with the wider campaign dated to autumn 2023 and use against people in the UK, US, Netherlands and elsewhere since at least 2025. The agencies released updated indicators of compromise alongside the advisory. Media, human rights and diaspora organisations should hunt for those indicators and review Telegram use on managed endpoints.
Sources The Hacker News
🟡 MEDIUM (8)
Wordfence blocked over 100,000 attacks exploiting a WooCommerce plugin file upload flaw Confirmed
Attackers are exploiting CVE-2026-27540, an unauthenticated arbitrary file upload in the WooCommerce Wholesale Lead Capture premium plugin for WordPress in versions 2.0.3.1 and older, to plant PHP web shells. The bug is caused by an AJAX handler that builds its list of permitted file types from a user supplied parameter, so an attacker can add php to the allowlist and upload executable code. Wordfence says its firewall blocked more than 100,000 attempts linked to the flaw, with activity spikes in June, July and August, even though the plugin was fixed in version 2.0.3.2 in February. Sites still running the older release should update and scan for uploaded shells and unexpected admin accounts.
Sources BleepingComputer
A hand written toolkit took an attacker from Marimo RCE to an SSH bastion in eight seconds Confirmed
Sysdig documented an intrusion that began with CVE-2026-39987, a pre-authentication remote code execution flaw rated 9.3 in the Marimo Python notebook, which was exploited within hours of public disclosure. The operator used a Python toolkit they wrote and debugged by hand rather than an AI agent, yet went from the initial shell to an SSH bastion host in eight seconds and then on to cloud credentials and further hosts. The speed undercuts the assumption that only AI assisted attackers move that fast. Notebook and data science tooling should not be publicly reachable, and bastion hosts should alert on logins originating from internal development systems.
Sources The Hacker News
BambooToken malware uses MQTT to control Windows and Linux systems Confirmed
Researchers disclosed BambooToken, a malware framework assessed to be active since at least February 2023 that uses the MQTT messaging protocol as its command and control channel, blending traffic with legitimate IoT messaging. The campaigns described so far target organisations across Asia and South America, with builds for both Windows and Linux. Because MQTT is a normal protocol in many industrial and IoT environments, defenders should baseline outbound MQTT traffic from servers and workstations and treat connections to unfamiliar brokers as a hunting lead.
Sources The Hacker News|BleepingComputer
KREMLIN banking malware hijacks Chrome and Edge to steal credentials and session tokens Confirmed
Elastic Security Labs detailed KREMLIN, a Brazilian banking malware toolkit tracked as REF9334 and active since at least May 2025. Lures impersonate about a dozen Brazilian banks and the toolkit installs a malicious extension in Google Chrome and Microsoft Edge that captures credentials and session tokens, bypassing protections that assume the browser itself is trusted. Banks and their customers in Brazil should treat unexpected browser extension installs as an incident, and fraud teams elsewhere can use the extension behaviour as a detection pattern for banking trojans generally.
Sources The Hacker News
Symbiosis bridge bug turned a 25 cent deposit into 46 billion unbacked BTC tokens Confirmed
Two software flaws in the Symbiosis Bitcoin Bridge let an attacker mint about 46.1 billion syBTC tokens, more than 2,000 times bitcoin’s 21 million supply cap, from an initial deposit of 330 satoshi worth roughly 25 cents. One bug caused the bridge to read the wrong part of a bitcoin transaction and treat the attacker as both approved depositor and bridge administrator; the second treated a negative fee as an addition, so the deposit value became whatever number the attacker supplied, across 12 bogus deposits in about four minutes. Symbiosis puts preliminary losses at 9.97 BTC, has taken the bridge offline for a rewrite and independent audit, and pledged compensation. Users of cross chain bridges should confirm protocol status before depositing and treat inflated token balances as unbacked.
Sources CoinDesk
A custom Safe module let an attacker drain $7.8 million of rsETH from a wallet Confirmed
Security firms traced a $7.8 million loss from an Ethereum wallet to a helper contract the wallet owner had authorised, not to a flaw in Safe itself or in Kelp DAO’s core rsETH contracts. The wallet held leveraged rsETH through a custom module linked to a Uniswap v4 liquidity pool, and the attacker used the permissions that module held to move the funds. The lesson generalises beyond this incident: custom modules and one time approvals inherit none of the assurance of the audited base contract, so they should be reviewed before use and revoked when their purpose ends.
CISA issues ICS advisories for SCADA, surveillance and industrial products Confirmed
CISA published a batch of industrial control system advisories on September 15 covering mySCADA myPRO Manager (CVSS 9.8, allowing access to privileged management functions and arbitrary SMS through a connected GSM modem), Wärtsilä FOS-Onboard (9.1, allowing unauthorised updates, code execution and credential theft), the Digital Watchdog VMAX DVR and NVR lineups (full administrative control of recorders and use as a network pivot), Siemens Teamcenter (reflected cross site scripting in the authentication redirect flow) and Siemens Mendix SAML (account hijacking in some single sign on configurations). Vendors have released fixes or mitigations in each case and no exploitation has been reported. Operators should schedule the updates and keep these devices off the public internet.
Sources CISA mySCADA myPRO Manager|CISA Wärtsilä FOS-Onboard|CISA Digital Watchdog VMAX|CISA Siemens Teamcenter
VectraRAT rents out full service Windows implants for $250 a month Confirmed
SOCRadar’s threat research unit documented VectraRAT, a malware-as-a-service platform offering a Windows implant, its own command and control infrastructure and an operator panel for about $250 per month. It was written from scratch rather than forked from leaked RAT code, and includes hidden desktop control, keylogging, clipboard hijacking, browser credential theft and a user account control bypass, with delivery observed through Amadey and ClickFix lures. A low subscription price plus a full service model widens the pool of attackers able to run targeted intrusions. Detection should focus on Amadey and ClickFix delivery chains and on alerting for user account control bypass behaviour on endpoints.
Sources DarkReading|SOCRadar
⚪ WATCH (6)
OpenAI investigates a report linking AI agents to abuse of the RubyGems registry Under investigation
OpenAI says it is investigating a report that AI agents were involved in activity against the RubyGems package registry that led maintainers to suspend new account registrations in May. If confirmed, it would be an early concrete case of agentic tooling being pointed at a software supply chain rather than at a single target. No findings have been published and the report is unconfirmed, so treat it as under investigation while watching for abnormal package publication patterns in the language ecosystems you depend on.
Sources SecurityWeek
CISA and NIST publish guidance on protecting tokens and identity assertions Confirmed
CISA and NIST released an interagency report with implementation recommendations for federal agencies and cloud service providers on protecting the identity assertions, access tokens and cryptographic mechanisms that underpin modern authentication. The focus is forgery, theft and misuse of tokens as agencies adopt hybrid and multi cloud single sign on and federation. The advice travels well outside government: short token lifetimes, strict audience and issuer validation, sender constrained tokens and strong key custody are the controls to verify in your own federated identity setup.
Sources CISA
Crypto market structure bill fails in the US Senate Confirmed
The Clarity Act, the crypto market structure legislation the industry spent years and hundreds of millions of dollars supporting, failed to clear the Senate’s 60 vote procedural hurdle on September 15, effectively ending the main US market structure effort for 2026. Crypto assets and crypto related equities fell as the vote count came in, and the Coinbase backed group Stand With Crypto said it will add senators’ votes to its scorecards ahead of the midterms. For security teams the practical consequence is that US regulatory expectations for exchanges, custodians and brokers remain unsettled for now.
US seeks forfeiture of $61 million tied to Iran linked crypto oil sales Confirmed
US prosecutors filed a civil forfeiture complaint against about $61 million in crypto they say was laundered for Iran’s government and military, alleging two Chinese companies used Binance accounts to move oil proceeds. The action continues a pattern of sanctions and enforcement work aimed at crypto rails used to move state linked funds. Exchanges, payment processors and their compliance teams should expect continued scrutiny of transaction monitoring for sanctioned jurisdictions and commodity trade related flows.
Hong Kong exchange CoinEx to shut down after nine years, citing security and compliance risk Confirmed
CoinEx, the Hong Kong based crypto exchange, said it will cease operations after nine years, with founder and CEO Haipo Yang citing mounting security and compliance risks and saying he rejected a sale in favour of a clean ending. Exchange closures create their own security problem: users face a limited window to withdraw funds and secure account data, and attackers routinely target customers of closing services with phishing and fake migration support. Users should withdraw only through the official site, verify notices independently and never share seed phrases or codes during a migration.
Sources CoinDesk
Vercel's $1 million sandbox challenge surfaced Linux kernel flaws Confirmed
Vercel ran a $1 million sandbox escape challenge that produced a flood of AI assisted vulnerability reports, mostly against Linux kernel sandboxing, and forced the company to automate its triage pipeline. The pattern is becoming familiar across disclosure programmes: AI tooling makes research cheap, so volume rather than depth becomes the bottleneck and triage capacity matters as much as researcher incentives. The reported issues concern sandbox escapes, so teams relying on containers or virtual machines for untrusted code should track the resulting fixes.
Sources SecurityWeek
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.