CISA added a maximum severity WSO2 authentication bypass and an Adobe Commerce flaw to its exploited list, a hot wallet drain at Bitget topped $351 million in the largest crypto hack of 2026, and a US military personnel data breach was disclosed as researchers showed AI agents being used both as attack tooling and as the target.
🔴 CRITICAL (3)
CISA adds exploited WSO2 flaw rated CVSS 10.0 and an Adobe Commerce authorization flaw to KEV Confirmed
CISA added CVE-2026-5430, a path traversal and JWT validation bypass in WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway, to its Known Exploited Vulnerabilities catalog on 24 September, citing evidence of active exploitation. WatchTowr and other exposure management firms have confirmed attacks against internet facing WSO2 deployments, with CVSS scored at 10.0. CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento, was added in the same update. Apply the vendor fixes, or take affected management and admin interfaces off the public internet if you cannot patch immediately.
Sources CISA|SecurityWeek
Bitget confirms $351.6 million hot wallet theft and suspends withdrawals Under investigation
Bitget detected unauthorized transfers from its hot wallets at 18:31 UTC on 24 September and confirmed roughly $351.6 million in affected funds, with withdrawals paused while the exchange investigates. Blockchain security researchers had flagged the unusual movements first, and on chain tracing shows funds moved across multiple chains into newly created wallets. Bitget says user funds are covered by its protection fund; this is the largest exchange theft recorded in 2026 and follows a $320 million loss at Liquid Network earlier in the month. If you hold assets on a centralised exchange, treat withdrawal freezes as a signal to review counterparty exposure.
Sources CoinDesk|Decrypt|Forbes|Bitcoin Magazine
Arista VeloCloud Orchestrator zero-day CVE-2026-93952 exploited against on-prem SD-WAN controllers Confirmed
Arista disclosed on 22 September that CVE-2026-93952, an improper input validation flaw in on-premises VeloCloud Orchestrator scored 10.0, is being actively exploited to reach privileged internal functionality on the controller that manages SD-WAN Edge devices. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Affected organisations should upgrade to a fixed release and run forensic triage on the orchestrator, since compromise gives access to the data and configuration of the whole SD-WAN estate.
Sources Arista|The Hacker News|CISA
🟠 HIGH (6)
F5 patches BIG-IP APM zero-day CVE-2026-94127 exploited for unauthenticated code execution Confirmed
F5 released engineering hotfixes for CVE-2026-94127, a heap based buffer overflow in BIG-IP Access Policy Manager that lets an unauthenticated attacker run code on the appliance. Only deployments where APM acts as an OAuth authorization server are affected, which places SSO and token issuing infrastructure in scope. F5 confirmed exploitation and CISA added the flaw to KEV. Patch the affected APM versions, or restrict management and OAuth endpoints while you stage the upgrade.
Sources The Hacker News|CISA
Check Point confirms exploitation of pre-authentication RCE CVE-2026-85102 in Security Gateway VPN Confirmed
Check Point warned customers that CVE-2026-85102, a pre-authentication remote code execution flaw in the certificate handling path of Security Gateway, is being exploited in the wild. The company has published fixes and mitigation guidance, and CISA added the flaw to KEV on 22 September. Internet facing VPN gateways are the entry point of choice for many ransomware crews, so treat exposed Security Gateway deployments as urgent and review logs for certificate handling anomalies.
Sources BleepingComputer|CISA
CISA warns ransomware crews are exploiting the critical JetBrains TeamCity flaw Confirmed
CISA told federal agencies that ransomware groups have joined the exploitation of a critical JetBrains TeamCity vulnerability that was patched in July. TeamCity sits inside build pipelines, so a foothold there gives attackers access to source code, deployment credentials and the ability to inject artifacts into shipped software. Apply the JetBrains fix, rotate secrets that the build server could reach, and check build agents for unexpected jobs.
Sources BleepingComputer
Roundcube Webmail flaw patched in May is now exploited for code injection Confirmed
The Canadian Centre for Cyber Security reports active exploitation of a high severity Roundcube Webmail vulnerability that was fixed in May. Attacks focus on code injection, which on a webmail server can lead to mailbox theft and further compromise of the hosting environment. Upgrade Roundcube to the current release and hunt for injected PHP in webmail directories and for unexpected outbound mail activity.
Sources BleepingComputer
US military personnel records exposed in breach, reports point to roughly four million people affected Under investigation
A breach notification letter warns that unauthorized users accessed files containing personal information of US military personnel, and two people familiar with the incident told Military Times that approximately four million Department of Defense personnel may be affected. The scope and the data elements are still being established. Personnel affected in these cases should watch for identity and payroll themed phishing that reuses genuine service details.
Sources Military Times
ShinyHunters claims it breached the FBI and holds agent and applicant data Unconfirmed report
The extortion group ShinyHunters posted a claim that it compromised the FBI and holds sensitive data on agents and on people who applied for FBI jobs. No sample data or independent verification has been published, and the bureau has not confirmed the claim. Treat extortion claims like this as unverified until a sample is validated; if it holds up, the data is more likely to appear in credential stuffing and targeted phishing first.
Sources The Hacker News
🟡 MEDIUM (12)
SalesBleed flaws in Salesforce Agentforce allow zero-click CRM data theft and agent-identity phishing Confirmed
Zenity Labs disclosed three flaws in Salesforce Agentforce, collectively named SalesBleed: two let a poisoned web-to-lead form inject instructions that make an agent exfiltrate CRM records without any user click and bypass Trusted URL redaction, and a third lets an attacker send phishing through a Slack reply action that is not attributed to a person and needs no confirmation. Salesforce has addressed the issues. The pattern matters beyond Salesforce: any agent wired to inbound public data and outbound internal messaging has the same shape of exposure.
Sources DarkReading|The Register|Zenity Labs
Unpatched OnePlus flaws let an installed app gain root on OxygenOS devices Confirmed
A researcher chained two flaws in OnePlus system software to gain root on a OnePlus 15 running current OxygenOS, using an app that requests no special permissions. OnePlus told him the same issues affect many more of its own devices and some OPPO models, and has not shipped a fix. Until a patch lands, treat sideloaded apps and unknown APKs on OnePlus and OPPO handsets as higher risk.
Sources The Hacker News
Carbonato botnet hijacks exposed Docker hosts and installs an AI agent for Telegram control Confirmed
ThreatDown researchers documented Carbonato, a botnet that scans for Docker daemon APIs exposed without authentication, then installs the open source Hermes Agent AI framework configured with an operator persona and a Telegram control channel. It spreads to other reachable hosts and gives the operator a post-compromise toolkit. Audit for Docker sockets or APIs bound to public interfaces and require authentication on them.
Sources BleepingComputer|ThreatDown
MacSync malware uses public iCloud calendar events to deliver new macOS payloads Confirmed
A new MacSync variant uses public iCloud calendar events as its delivery channel, pointing infected Macs at native payloads and making the traffic look like ordinary calendar sync. Delivery through a trusted Apple service complicates domain and proxy based blocking. Security teams managing Macs should check calendar subscriptions and recent launch agent changes on affected endpoints.
Sources BleepingComputer
Corp MDM Android spyware targets logistics firms through fake Google Play pages Confirmed
A campaign distributing Android spyware tracked as Corp MDM uses fake Google Play listing pages branded as CEVA and TKW Logistics to push an APK disguised as a system service. Once installed it captures new SMS messages and redirects calls, which defeats SMS based one time codes. Logistics and freight staff should install nothing from links in shipping or recruitment messages, and enterprises should require Play Protect and app allowlisting.
Sources The Hacker News
ClickFix scales up: 17,000 URLs and compromised Ukrainian sites push new stealers Confirmed
A CTM360 report tracing 17,000 URLs describes how ClickFix, which tricks users into pasting a clipboard command that downloads malware, has grown from a 2023 novelty into a subscription product with on-chain infrastructure and state aligned users. A separate campaign observed by The Hacker News hacked legitimate Ukrainian business sites to show fake Cloudflare verification pages delivering an undocumented infostealer called Psychedelic. Blocking single domains no longer works; user education plus restricting script execution and clipboard driven installs does.
Sources The Hacker News|The Hacker News
SolarWinds patches two critical unauthenticated RCE flaws in Observability Self-Hosted Confirmed
SolarWinds fixed CVE-2026-28324 and CVE-2026-28325 in Observability Self-Hosted, both exploitable without authentication and rated critical. The product is typically deployed with broad read access to infrastructure telemetry, so a foothold there maps the estate. Patch promptly and review the server for unexpected accounts or outbound connections.
Sources SecurityWeek
TeamFiltration password spraying campaign hits 5,700 M365 accounts across Latin America Confirmed
Proofpoint tracked UNK_CondorFiltration spraying more than 5,700 accounts across 28 Microsoft 365 tenants from 1,487 AWS EC2 source addresses, focused on Chilean retail and financial organisations. Seven accounts were compromised, all unmanaged or forgotten service accounts with default credentials, which let the actor reach mail and files after employees had stopped using them. Inventory and disable dormant service accounts, enforce MFA everywhere including non-human identities, and alert on authentication from cloud hosting ranges.
Sources Proofpoint|The Hacker News|DarkReading
Duelbits crypto casino loses about $7 million in hot wallet hack Confirmed
Duelbits took its platform offline after attackers drained hot wallets across four blockchains, with around $6 million of the funds consolidated in a single Ethereum address. The incident follows the same pattern as the larger Bitget theft: hot wallets with too much float and weak segregation from treasury. Trackers are following the flows; users should assume withdrawals will be delayed.
Sources CoinDesk
Microsoft disrupts EvilTokens phishing-as-a-service for device code attacks on M365 Confirmed
Microsoft seized 50 websites and disabled more than 150 domains used by EvilTokens, a phishing-as-a-service platform that abused the OAuth device code flow to take over Microsoft 365 accounts without stealing a password. Device code phishing works because the victim approves a legitimate looking code prompt, so MFA does not stop it. Restrict or monitor device code flow in your tenant and block the seeded domains.
Sources DarkReading
SectopRAT returns, hidden inside a legitimate signed application Confirmed
Researchers report renewed activity from the SectopRAT remote access trojan, which this time hides inside a legitimate application so users and allowlisting tools see trusted software. Detection depends on watching process behaviour and network egress rather than file reputation. Review endpoint rules that trust specific executables outright.
Sources DarkReading
CISA advisory: command injection and hardcoded credentials in Eufy robot vacuums, CVSS 9.4 Confirmed
CISA published an ICS advisory for Eufy Omni C20 and Omni X10 Pro robot vacuums below firmware 1.6.4 covering OS command injection, hardcoded credentials and improper certificate validation, with the worst flaw scored 9.4. Devices with cameras and microphones inside homes and small offices are the concern, not just the vacuum function. Update to 1.6.4 or later and keep the devices on a segmented network.
Sources CISA
⚪ WATCH (8)
Microsoft profiles Storm-2570, a ransomware affiliate that reuses one toolkit across four families Confirmed
Microsoft published detection guidance for Storm-2570, an affiliate that deploys Qilin, DragonForce, Anubis and BERT ransomware but keeps the same post-compromise tooling and tradecraft in each case. That consistency is the defensive opportunity: detections built on the shared behaviour can catch the affiliate before encryption starts.
Sources Microsoft Security Blog
Prompt injection bug found in Manus, the agentic AI app valued at $4 billion Confirmed
Researchers disclosed a prompt injection flaw in Manus that let external content steer the agent. The lesson generalises: any agent that reads external data and then acts with the user’s privileges needs strict filtering and confirmation for sensitive actions. No evidence of exploitation in the wild has been published.
Sources DarkReading
CLOSEDQUORUM: Windows malware that lets up to four AI models vote on its next action Under investigation
Cisco Talos described a Windows malware sample, CLOSEDQUORUM, designed to take instructions from a vote among up to four AI models instead of a fixed command server, choosing between credential, browser password and crypto wallet theft. Talos has not observed the full chain working and the public sample does not run as shipped, so treat it as a research signal rather than an active campaign.
Sources The Hacker News
EU watchdogs warn quantum computing threatens blockchain and payment encryption sooner than expected Confirmed
European supervisory authorities warned that Q-Day, the point at which quantum computers break current public key cryptography, could arrive before the machines are commercially useful, and gave member states until the end of 2026 to plan. The crypto angle is legacy addresses whose public keys are already exposed on chain. Financial firms should be mapping cryptographic dependencies and harvesting risk now.
Class action claims OpenAI routed ChatGPT conversations to outside contractors Under investigation
A proposed class action accuses OpenAI of sending real user conversations to external contractors through a program called Project Lily without informing users first. The case is a reminder that consumer AI prompts are frequently reviewed by humans, so regulated data should not be pasted into general purpose chatbots.
Sources Decrypt
NIST drafts updated OT security guide as CISA and FBI issue ICS integrator advice Confirmed
NIST published a draft revision of its operational technology security guidance and CISA with the FBI released considerations for critical infrastructure operators working with third party ICS integrators. Both documents push the same point: third party access into OT networks is the weak link, and contractual and architectural controls need to cover it.
Sources SecurityWeek|CISA
Legal accountability for autonomous AI attacks remains unresolved Confirmed
Following the AI agent incidents this month, lawyers and researchers are debating who answers for damage caused by an autonomous system: the operator, the model provider or the attacker who seeded the instructions. Criminal cases would face a high evidentiary bar, and civil suits are seen as the more likely route. Expect this to shape incident response and disclosure decisions.
Sources SecurityWeek
CISA advisory: 13 flaws in Botslab G980H dashcams allow authentication bypass Confirmed
CISA published an ICS advisory covering thirteen vulnerabilities in the Botslab G980H dashcam series, allowing attackers to bypass authentication, reach privileged device functions and alter configuration. Dashcams commonly connect to home and depot Wi-Fi alongside business systems. Apply the vendor update where available and isolate the devices from corporate networks.
Sources CISA
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.