CISA added three exploited Linux kernel flaws to its KEV catalog, Check Point and WordPress shipped critical fixes, Microsoft closed a maximum severity Azure AI Foundry bug, and a crypto technology provider lost client funds in a breach.
🔴 CRITICAL (2)
CISA adds three exploited Linux kernel flaws to KEV catalog as public root exploits circulate Confirmed
CISA added three Linux kernel privilege escalation flaws to its Known Exploited Vulnerabilities catalog on 18 September on evidence of active exploitation: CVE-2025-39964 (race condition), CVE-2026-53266 (out of bounds write) and CVE-2025-39682 (improper check for unusual or exceptional conditions). In parallel, a researcher published working exploit code for four kernel flaws that each let a local user gain root, and maintainers have already fixed all four. Apply current kernel updates, prioritising multi tenant and internet facing hosts, and note that US federal agencies have until 21 September to remediate.
Sources CISA|CISA|The Hacker News
Critical unauthenticated remote code execution in Orkes Conductor exploited in attacks Confirmed
Attackers are exploiting CVE-2026-58138, a critical unauthenticated remote code execution flaw in the Orkes Conductor workflow orchestration platform. Reporting says the flaw is reachable through inline workflow definitions, so an attacker who can submit a workflow may run code on the orchestrator without any credentials. Conductor deployments typically hold credentials and connections for downstream systems, so exposed instances should be patched immediately and treated as compromised while logs are reviewed.
Sources SecurityWeek
🟠 HIGH (4)
Check Point patches critical CVE-2026-91843 giving unauthenticated root on management and log servers Confirmed
Check Point released updates and a LivePatch for CVE-2026-91843, a critical stack based buffer overflow rated 9.8 in the login process of Security Management, Multi Domain Security Management, Log Server and Multi Domain Log Server. An unauthenticated attacker with network access can execute code as root on the appliance, which is enough to take control of the management plane for every gateway it manages. Apply the update or LivePatch, restrict management interfaces to administrative networks, and verify the fix is active.
Sources BleepingComputer|SecurityWeek
WordPress 7.1.1 patches Click2Shell chain that forces theme installs and can reach code execution Confirmed
WordPress 7.1.1, released on 17 September, fixes a flaw where a crafted link makes a logged in administrator’s site install an attacker chosen theme from the official directory without anyone pressing Install. Researchers at pwn.ai, who named the chain Click2Shell, rated the forced install alone as high (CVSS 7.1) and the full chain to server side code execution, which depends on a second flaw in the theme installed, as critical (CVSS 9.6). There is no sign of real world exploitation, but the fix reaches supported branches back to 4.7, so update core or confirm automatic updates have run.
Sources The Hacker News|pwn.ai
Microsoft patches CVSS 10.0 Azure AI Foundry flaw among 18 fixes for AI and cloud services Confirmed
Microsoft fixed CVE-2026-85889, a maximum severity missing authentication for critical function bug in Azure AI Foundry that let an unauthenticated attacker elevate privileges over the network, as part of a batch of 18 fixes across Azure and AI branded products, most of them privilege escalation issues. Because the fix is server side, Microsoft says no customer action is required. Organisations should still confirm that AI workloads holding sensitive data run under least privilege and review activity around those resources for the exposure window.
Sources The Hacker News|SecurityWeek
Crypto technology provider Haruko hit by cyberattack affecting 15 clients, with some funds lost Under investigation
Haruko, which supplies portfolio and risk technology to digital asset funds, suffered a cyberattack that affected about 15 of its clients, with reporting indicating that some smaller hedge funds with weaker controls lost funds. The company has not published a full account of the intrusion and details remain limited. Funds using the platform should rotate API credentials and keys shared with the provider, reconcile positions and withdrawals, and treat unexpected outbound transactions as suspicious.
Sources CoinDesk
🟡 MEDIUM (8)
Plugin4Shell lets repository owners swap pinned plugin code in four AI coding agents Confirmed
Air Security found a flaw in four widely used AI coding agents that lets whoever controls a plugin’s repository swap the plugin an agent installs, even when the agent pinned that plugin to a specific reviewed version. Anthropic patched the issue in Claude Code 2.1.179 and OpenAI patched Codex 0.146.0, while GitHub Copilot had no fix at the time of the report. Teams using agent plugins should update the clients, pin plugins to immutable commits where the registry allows it, and review which credentials agents can reach.
Sources The Hacker News|SecurityWeek
WeaselBiscuit stealer spread through 13 npm packages to harvest browser extension storage Confirmed
OpenSourceMalware found a cluster of 13 npm packages delivering a previously undocumented JavaScript stealer named WeaselBiscuit, which targets data held by Chrome extensions and shares functional overlap with BeaverTail and other strains tied to North Korea’s Contagious Interview campaign. The packages were published to the public npm registry, so any developer machine that installed them should be treated as exposed. Remove the packages, rotate credentials and wallet material on affected machines, and prefer lockfiles with scoped registry access.
Sources The Hacker News
Fake LastPass Authenticator GitHub repositories push new Rapuncel infostealer Confirmed
An ongoing campaign uses SEO optimised GitHub repositories impersonating well known software vendors, including a fake LastPass Authenticator, to push a previously undocumented information stealer called Rapuncel. Victims are led to hosted download pages inside the repositories rather than the vendor’s own site. Verify installers against the official vendor domain, report lookalike repositories through GitHub abuse channels, and reset credentials for anyone who ran the fake downloads.
Sources BleepingComputer
Transparent Tribe targets Indian and Afghan government and defence bodies with new Rust tooling Confirmed
Zscaler ThreatLabz attributes a fresh set of attacks on government and defence entities in India and Afghanistan to the Pakistan aligned group Transparent Tribe, using previously undocumented tools tracked as RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH, with private GitHub repositories used for command and control. Coverage describes sustained espionage rather than broad opportunism. Government, defence and education defenders should hunt for the published indicators, review GitHub and API egress from endpoints, and restrict execution of unsigned binaries from user directories.
Sources The Hacker News
Critical Docker Sandboxes flaw CVE-2026-77179 lets guest code reach macOS host files Confirmed
Docker warned that malicious code running inside a Docker Sandboxes virtual machine on macOS can escape the project directory shared into it and read or modify files anywhere else on the host, with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated critical and fixed in newer releases. Update Docker Desktop and Sandboxes, and treat untrusted code already run in a sandbox as having had host read and write access until the update is applied.
Sources The Hacker News
Iran aligned Handala Hack tied to HEAVYGRAM Telegram backdoor that can steal passwords Confirmed
Researchers attribute the Iran linked hacktivist persona Handala Hack to HEAVYGRAM, a Telegram based surveillance backdoor with built in commands for remote command execution, system and network discovery, file and Telegram session exfiltration, screenshot capture and DLL sideloading, alongside a Delphi utility called CRUDEEXCLUDE. The tooling supports the group’s espionage and leak activity. Monitor or block Telegram API traffic where it has no business purpose, and hunt for the documented filenames and sideloading paths.
Sources The Hacker News
Unit 42: default AWS AgentCore settings let prompt injection leak agent credentials Confirmed
Unit 42 analysed how default configurations in the AWS AgentCore harness let a prompt injection attack exfiltrate credentials an agent holds, describing the awkward gap between the agent harness and the identity it runs as. The research sets out hardening steps, chiefly narrowing the credentials an agent can reach and constraining its outbound network access. Teams deploying agents on AgentCore should follow the guidance and remove broad standing permissions from agent identities.
Sources Unit 42
AI built exploit and a sign-in flaw opened a path into OpenAI internal code, researchers say Confirmed
Hacktron researchers earned a bug bounty after demonstrating that an AI built exploit combined with a weakness in the sign-in flow gave them access to OpenAI employee accounts and, from there, internal code. OpenAI has fixed the issue and the work was disclosed responsibly. The case is a reminder to test authentication and federation flows as hard as product code, and to require additional verification for employee sessions that reach internal repositories.
Sources SecurityWeek
⚪ WATCH (6)
Re-registered CDN domain still referenced by thousands of sites, repositories and docs Confirmed
A domain that once served assets for a content delivery network was left to expire and was registered by someone else in July 2025, while thousands of websites, code repositories and documentation pages still load assets from hostnames beneath it. Anything served from those hostnames now comes from the new owner, which is a live supply chain risk for anyone who copied snippet code and forgot about it. Inventory third party references in templates and configs, and point them at domains you control.
Sources The Hacker News
US Treasury sanctions Tehran exchange BitBank over Iran's bitcoin tolls in the Strait of Hormuz Confirmed
OFAC sanctioned BitBank, a Tehran based exchange it says moved hundreds of millions of dollars in bitcoin to the Revolutionary Guards over two months and handled payments collected from ships buying passage through the Strait of Hormuz. The designation targets an exchange and its payment flows rather than a technical exploit. Compliance and investigations teams should screen for the named entities and addresses, and exchanges should expect follow up requests on related transactions.
Seven arrested in UAE and Sweden over a 7.1 million dollar crypto laundering ring linked to contract killings Confirmed
Investigators in the UAE and Sweden arrested seven people over a crypto laundering network that moved roughly 7.1 million dollars, saying tracing of the transactions exposed links to organised crime and murder for hire. The case shows how on chain analysis now feeds conventional criminal investigations. There is no direct defender action here, though it is a useful example when explaining tracing and attribution capability to stakeholders.
Sources Decrypt
Dark Reading: MFA does not cover OAuth consent abuse Confirmed
An analysis argues that MFA, however well deployed, cannot substitute for OAuth governance, namely least privilege scopes, consent monitoring and fast revocation of third party applications. Over permissioned or unmonitored app grants remain a common path around otherwise strong authentication. Review which applications hold tenant wide scopes, remove unused grants, and alert on new consent grants that request mail or file reading permissions.
Sources Dark Reading
SANS ISC examines the HTTP QUERY method and the grey zone between GET and POST Confirmed
SANS ISC discussed RFC 10008, published in June 2026, which defines QUERY, the first new standard HTTP verb since PATCH. QUERY carries a request body like POST but is defined as safe and idempotent like GET, which creates room for confusion in proxies, WAFs and caching layers that classify methods simply. Teams with custom request filtering or caching rules should test how their stack handles QUERY before client libraries adopt it widely.
Sources SANS ISC
Check Point Research publishes its July to August 2026 AI threat landscape digest Confirmed
Check Point Research collected the AI related attacks and defences it observed through July and August 2026, covering prompt injection against production assistants, abuse of agent tooling and the changing economics of AI assisted crime. It is a reading item rather than an incident report. Security leads building an AI risk register can use it to check which scenarios are actually being seen in the field.
Sources Check Point Research
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.