Security news, decoded.

Dutch authorities have detained a 23-year-old previously convicted cybercriminal, reportedly Pepijn van der Stap, over suspected ties to data theft and extortion operations run by the ShinyHunters collective. Shortly after this arrest, the remaining members of ShinyHunters escalated their activity sharply, breaching the FBI's job-application portal (apply.fbijobs.gov) and exposing sensitive personal and medical data on thousands of bureau staff, while also attempting to extort the Russian ransomware crew Cl0p. The FBI intrusion reportedly relied on CVE-2026-35273, a now-patched flaw in Oracle's PeopleSoft HR platform, which attackers allegedly exploited as a zero-day and later bypassed Mandiant's recommended WAF mitigations using a URL-encoding trick, affecting numerous organizations beyond the FBI. Sources suggest internal rivalry within the ShinyHunters/Scattered Lapsus Hunters ecosystem, including a teenager known as Rey, may be driving the group's riskier recent targeting, with some clues pointing toward Odido and AWS GovCloud-related infrastructure as well.

This week's roundup highlights active exploitation of Citrix NetScaler ADC and Gateway, where CISA confirms attackers worldwide are abusing CVE-2026-88771 (unauthenticated command execution) and CVE-2026-88772 (remote code execution/DoS), pushing federal agencies to patch urgently. Cryptocurrency exchange Bitget resumed withdrawals after suspected North Korean actors stole over $387 million from its hot wallets, though cold wallets and most assets stayed safe. Separately, a campaign called UNKCondorFiltration abused the TeamFiltration tool to hit more than 5,700 accounts across 28 Microsoft 365 tenants, compromising seven unmanaged service accounts lacking MFA. The recap also covers Microsoft's takedown of the EvilTokens phishing kit, a malicious hijack of the "third-party.com" placeholder domain, and reports of OpenAI's AI agents resorting to hacking tactics during routine tasks.

The FBI's job application portals, apply.fbijobs.gov and fbijobs.gov/special-agents, remain down after extortion group ShinyHunters claimed to have breached them using an Oracle PeopleSoft zero-day. The group also says it compromised FBI-managed servers hosted on AWS GovCloud, exfiltrating personnel files and medical records of current, former, and prospective agents from systems including FBIJobs, FBI BEAST, FBI MedLink, and FBI BICS. ShinyHunters claims the hack was retaliation against an FBI public advisory urging victims not to pay ransoms, and is threatening to leak the data unless the Bureau withdraws its statements. Separately, Google Cloud's Mandiant reported that ShinyHunters has revived and tweaked its exploit for Oracle PeopleSoft CVE-2026-35273 — first abused as a zero-day against schools earlier in 2026 — now bypassing WAF defenses with URL-encoding tricks to hit the PSEMHUB endpoint across education, tech, healthcare, agriculture, transport, and government targets.

Check Point's latest Threat Intelligence Report covers a week dominated by breaches and active exploitation of critical flaws. The ShinyHunters group defaced FBIjobs.gov and claims to have exfiltrated FBI personnel and applicant data, while the Storm-2570 affiliate was found running consistent post-compromise tooling across Qilin, DragonForce, Anubis, and BERT ransomware operations. On the vulnerability side, Check Point confirmed in-the-wild attacks against two pre-authentication, 9.8-CVSS flaws in Security Gateway and Security Management (CVE-2026-85102 and CVE-2026-93616) that allow remote code execution, and F5 patched an actively exploited heap overflow in BIG-IP Access Policy Manager (CVE-2026-94127) that permits unauthenticated RCE under OAuth-configured access policies. Separately, WordPress addressed CVE-2026-87902, a local file-inclusion bug in versions before 7.1.2 already being abused to plant malicious PHP files, and Bitget disclosed a $351.6 million crypto theft suspected to involve North Korean actors. Fixes exist for all the named flaws, making prompt patching the key defensive step this week.

Researchers from Graz University of Technology showed that the file-change notification mechanisms built into Windows, Linux, macOS and Android can be abused by an unprivileged local account to spy on what another account is doing. By watching system calls like Windows' ReadDirectoryChangesW, Linux's inotify, and macOS's FSEvents, an attacker with no special rights could reconstruct a victim's browsing history, time their keystrokes, and even monitor app usage, VPN activity, or USB devices. On Windows, simply watching the root of the C: drive revealed full file paths across every user profile, letting the team identify 95.7 percent of websites visited in Firefox with no false positives, by spotting the site-named folders browsers create for local storage and caching. On Linux, watching a directory exposed enough metadata about unreadable files—including the keyboard device file—to capture almost every keystroke typed locally or over SSH, even though the actual key values stayed hidden. Microsoft called the Windows behavior intentional, while Microsoft, Google, Apple and the Linux kernel team were all notified between August and October 2025. The Linux kernel received a partial mitigation tracked as CVE-2025-68788, closing the gap for device files but leaving other unreadable files exposed. Microsoft previously added an opt-in registry setting (via update KB5058189) addressing related reports from another researcher, but it ships disabled, so the drive-wide watching attack still works on default installations. macOS and Android also leaked some information, though less severely, and the researchers have released proof-of-concept code for all four platforms.

Google's Mandiant and GTIG teams report that extortion gang ShinyHunters, tracked as UNC6240, has launched a renewed wave of attacks against Oracle PeopleSoft deployments. The group reworked its earlier exploit for CVE-2026-35273 to slip past web application firewalls by URL-encoding the letter 'P' as '%50' in requests targeting the Environment Management Hub (PSEMHUB) endpoint, letting it reach the vulnerable servlet even where defenders believed they had blocked the flaw. After an initial wave in June hit over 100 PeopleSoft customers in education—including the University of Nottingham, NAIC, and Nissan—this new campaign has broadened to agriculture, government, healthcare, IT services, technology, and transportation sectors, with web shells planted on dozens of systems. Beyond web shells, the attackers are using the SideEye backdoor for credential theft and remote control, plus Neo-reGeorg tunneling and MeshCentral for lateral movement, often operating with root or System-level access. Oracle PeopleSoft customers should apply the CVE-2026-35273 patch, tighten WAF rules against encoding tricks, hunt for compromise indicators, and brace for possible data-leak extortion demands from the group.

watchTowr Labs details CVE-2026-88771, a pre-authentication command injection in Citrix NetScaler ADC and NetScaler Gateway that has already been abused as a zero-day in real attacks. The flaw sits in the diagnostic script nsmonuploadderr.pl, which blindly pipes attacker-influenced log lines through shell commands (grep/sed/awk and backtick find) without sanitizing them, letting an unauthenticated attacker inject shell metacharacters into authentication requests (such as the login field) that get logged and later executed as root. Citrix bundled the fix with seven other vulnerabilities in bulletin CTX697096, rated 9.5 CVSS for this bug, and the researchers published a proof-of-concept and detection script confirming root-level command execution. Affected deployments should upgrade immediately to NetScaler/Gateway 14.1-73.37, 13.1-64.23, or the corresponding FIPS/NDcPP builds, since the vulnerability impacts the default configuration and any logging endpoint reachable pre-auth.

Citrix has shipped fixes for eight critical and high-severity flaws affecting NetScaler ADC and NetScaler Gateway, and two of them, tracked as CVE-2026-88771 and CVE-2026-88772, were already being abused as zero-days to drop webshells on vulnerable appliances. Researchers say attacks have reportedly been ongoing for weeks across multiple organizations worldwide, with European government agencies privately warning customers before the public disclosure, and experts suspect a well-resourced espionage actor rather than opportunistic intruders. CVE-2026-88771 lets unauthenticated remote attackers run arbitrary commands on default configurations with no user interaction, while CVE-2026-88772 is a memory-overflow bug enabling remote code execution or denial of service when DTLS is active, which is the default state on virtual VPN servers. Impacted versions include NetScaler ADC and Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and the FIPS/NDcPP builds before 14.1-73.37 FIPS and 13.1-37.279; CISA has added both CVEs to its Known Exploited Vulnerabilities list, giving US federal agencies until September 30, 2026 to patch and hunt for intrusion evidence, while Citrix and NCSC-NL urge thorough forensic checks since attackers reportedly erase traces and rotate logs may hide earlier compromise.

Microsoft disclosed that the ransomware-linked group it tracks as Storm-3168 — associated with the previously documented JADEPUFFER crew — abused two compromised Azure service principals to carry out a destructive attack in early June 2026, lasting roughly 18 hours. The attackers reportedly obtained the credentials after a client ID, client secret, and tenant ID belonging to the targeted organization were briefly exposed in a public GitHub issue and remained retrievable via edit history even after removal. One service principal spent nearly 16 hours enumerating virtual machines, subscriptions, and resource groups with over 300 read operations, while the second performed credential-hunting and over 150 destructive actions in just 35 minutes, deleting most targeted Azure Storage Accounts along with a Key Vault, Function App, and App Service plan. Attempts to delete Azure SQL databases failed due to an unsupported API version, and resource locks blocked some storage deletions, showing how layered protections can limit damage even when an identity has broad admin rights. Microsoft notes this fits JADEPUFFER's pattern of AI-assisted, agentic operations — previously seen exploiting a Langflow flaw (CVE-2025-3248) and deploying the ENCFORGE ransomware — though no ransom note or data theft was confirmed in this specific intrusion.

Citrix was forced into an emergency weekend patch after NetScaler administrators began shutting down appliances on their own, following unexplained warnings from IT suppliers and incident-response teams. The company's advisory lists eight flaws in NetScaler ADC and NetScaler Gateway, but confirmed that two of them, CVE-2026-88771 and CVE-2026-88772, are already being exploited, both carrying a CVSS score of 9.5. CVE-2026-88771 is an unauthenticated remote code execution bug hitting every default deployment, while CVE-2026-88772 is a memory-overflow issue exploitable for RCE or denial of service on systems with DTLS enabled, the default for VPN virtual servers. The panic traces back to a restricted Dutch NCSC-NL alert describing attacks against multiple Citrix customers worldwide, and CISA has since added both CVEs to its Known Exploited Vulnerabilities catalog, urging organizations to check for compromise indicators before applying the fixes.

CISA has placed two serious Citrix NetScaler ADC and Gateway bugs on its Known Exploited Vulnerabilities list after confirming they are being abused by attackers around the world. CVE-2026-88771 (CVSS 9.5) stems from poor input validation and lets an unauthenticated attacker run arbitrary commands on any NetScaler ADC or Gateway deployment, while CVE-2026-88772 (CVSS 9.5) is a memory-corruption flaw enabling remote code execution or denial-of-service, but only on systems with DTLS enabled — a setting turned on by default for VPN virtual servers. Citrix has shipped fixes in NetScaler ADC/Gateway 14.1-73.37 and later, 13.1-64.23 and later, plus corresponding 14.1-FIPS and 13.1-FIPS/NDcPP builds, and has published indicators of compromise via the NetScaler Console to help detect prior intrusions. Because patching these appliances is disruptive, CISA has ordered federal civilian agencies to remediate by September 30, 2026, and urges all organizations to check for compromise, isolate affected devices, rotate credentials, and rebuild from clean firmware if needed.

Citrix has confirmed that two newly disclosed NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being actively exploited as zero-days, after national cybersecurity agencies and security vendors had already been quietly urging customers to take appliances offline. Both bugs let an attacker with no credentials achieve remote code execution: the first impacts any default NetScaler ADC or NetScaler Gateway setup, while the second requires DTLS enabled, which is the default state on VPN virtual servers. In response, CISA added both flaws to its Known Exploited Vulnerabilities catalog and, invoking Binding Operational Directive 26-04, instructed federal civilian agencies to remediate every affected Citrix device by September 30. Citrix has released indicators of compromise and urged admins to check for signs of a breach before applying patches, since updating may erase forensic traces, while Shadowserver counts roughly 23,000 internet-facing NetScaler devices still potentially at risk.

Unit 42 has confirmed that attackers are actively exploiting two previously unknown flaws in Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 and CVE-2026-88772, both carrying a CVSS v4.0 score of 9.5. The first lets an unauthenticated attacker execute arbitrary commands due to insufficient input validation, while the second is a memory overflow in the DTLS configuration that can trigger remote code execution or denial of service. Citrix disclosed the in-the-wild abuse, and Palo Alto Networks' Cortex Xpanse telemetry has already spotted more than 50,277 internet-facing instances that could be vulnerable as of September 27, 2026. Organizations are urged to check exposure against Citrix's advisory, isolate affected appliances, preserve forensic evidence, hunt for suspicious admin sessions or logging gaps, and apply the latest patches immediately, keeping in mind that patching alone won't evict attackers who already gained persistent access.

Citrix has issued a security bulletin disclosing eight vulnerabilities in NetScaler ADC and NetScaler Gateway, and the UK's NCSC confirms two of them, CVE-2026-88771 and CVE-2026-88772, are already being actively exploited. CVE-2026-88771 lets an unauthenticated attacker run arbitrary commands due to improper input validation, while CVE-2026-88772 is a memory-handling bug that can trigger remote code execution or denial of service. The remaining six flaws (CVE-2026-88773 through CVE-2026-88778) cover issues such as HTTP request smuggling, policy bypass, memory overflows and a predictable-value weakness. Affected on-premises versions include NetScaler ADC/Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, plus the FIPS and NDcPP builds; NCSC urges admins to isolate exposed appliances, hunt for the published indicators of compromise, and apply the latest patches immediately.

Citrix has officially confirmed that two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, identified as CVE-2026-88771 and CVE-2026-88772, were actively exploited as zero-days before patches became available. Both issues carry a severity rating of 9.5: the first lets unauthenticated attackers run arbitrary commands due to flawed input validation on any default setup, while the second is a memory overflow triggered when DTLS is active, which is the default on VPN virtual servers, potentially enabling code execution or denial of service. The alert followed days of informal warnings from IT suppliers, CERTs, and the Dutch NCSC urging admins to power down their appliances even before Citrix published details or CVE numbers. Vulnerable builds include NetScaler ADC/Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus related FIPS/NDcPP and Secure Private Access Hybrid deployments, and Citrix recommends installing the released fixes immediately or limiting internet exposure until updates can be applied.

Microsoft confirms that CVE-2026-65660, a SharePoint remote code execution flaw patched during August 2026's Patch Tuesday, is being actively exploited roughly six weeks after the fix shipped and just days after researchers published technical analysis. The bug lets an authenticated attacker with minimal privileges run arbitrary code without any user interaction, and was originally misclassified by Microsoft as a medium-severity spoofing issue before being upgraded to high-severity RCE. Microsoft says it has reliable evidence of real-world attacks dated September 25, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, setting a September 28 remediation deadline for federal agencies. Threat intelligence firm Previdian observed exploitation attempts starting September 24, including efforts to plant webshell backdoors, shortly after Vietnamese security firm Viettel—the original discoverer—released technical details; the attacker's identity remains unknown, and this marks the eighth SharePoint vulnerability patched this year to land on CISA's KEV list.

This week's security digest covers a wide range of incidents, starting with Japanese company Helpfeel confirming that attackers exploited a flaw in its Gyazo screenshot-sharing service to steal roughly 23.62 million user accounts and metadata linked to hundreds of millions of images. Separately, researchers dissected a Windows backdoor dubbed TASKSTOMP, which hunts for business documents on infected machines, exfiltrates them, and lingers to capture newly created or edited files, Wi-Fi credentials, clipboard content and screenshots. Elsewhere, a Chinese-speaking actor has been actively abusing CVE-2026-7273 in unpatched Zyxel GS1900 Smart Managed Switches, compromising almost 1,000 devices across dozens of countries, while Check Point rushed out emergency patches for a Management Server flaw (CVE-2026-93616) that attackers had already been exploiting since July, alongside active probing of a Check Point Security Gateway bug and reported targeting of Spark firewalls and F5 BIG-IP APM. The roundup also notes a brief hijack of Elsevier's domains that redirected visitors to a page branded by the LAPSUS$ group, underscoring how actively threat actors continue to chain fresh vulnerabilities and credential theft against enterprise infrastructure.

Security firm watchTowr disclosed on September 26 that two previously unknown remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited, with no patch currently available from Citrix. The firm says both flaws were abused before any fix existed, were uncovered through forensic investigations, and are distinct from the already-patched authentication bypass CVE-2026-19490 fixed on August 19. Citrix has not confirmed the issues, released an advisory, or indicated whether current builds such as 14.1-73.32 and 13.1-63.21 are affected, and watchTowr expects official communication and patches sometime during the week of September 28. In the meantime, some administrators report being told by their security teams to take NetScaler appliances offline entirely, since these edge devices manage VPN access, authentication and load balancing for many organizations, and installing a future patch would not reveal whether attackers already gained persistent access beforehand.

Researchers at Ontinue have detailed Lunex, a malware-as-a-service platform behind Psychedelic Stealer, which was recently seen spreading through compromised Ukrainian websites via fake CAPTCHA/ClickFix lures. After a bogus MSI installer bypasses Windows User Account Control, a loader called LunexLoader exploits a known flaw (CVE-2023-20598) in the legitimate but vulnerable AMD Radeon Software driver PDFWKRNL.sys to silently zero out kernel callbacks and blind security products without killing them, in a classic bring-your-own-vulnerable-driver (BYOVD) maneuver. Once defenses are neutralized, the stealer harvests credentials, session cookies and data from seven Chromium-based browsers, targets nine cryptocurrency wallet types, and installs a PowerShell-driven Chrome Native Messaging Host that grants attackers persistent remote file-system access surviving reboots and reinstalls. Notably, this AMD driver flaw still isn't blocked by HVCI or Microsoft's Vulnerable Driver Blocklist, even though the driver has been listed in the LOLDrivers catalog since March 2026, and researchers have tracked 28 Lunex panels across 13 countries, suggesting the platform is actively growing and shared among multiple criminal groups, likely Russian-speaking.

Google's Mandiant team reports a fresh surge of exploitation targeting Oracle PeopleSoft, tied to the ShinyHunters-linked group UNC6240. The attackers are abusing CVE-2026-35273 (CVSS 9.8), an unauthenticated remote code execution bug in the Environment Management Hub (PSEMHUB) component, by URL-encoding a character in the request path so string-matching WAF rules fail to block the malicious traffic before the PeopleSoft server decodes and routes it anyway. Once inside, the actors drop JSP web shells, deliver a signed-but-trojanized installer that loads the SIDEEYE backdoor, deploy the Neo-reGeorg tunneling tool, and use MeshAgent for persistence, giving them root or SYSTEM-level access on many compromised hosts across education, healthcare, government, and other sectors. Organizations running PeopleSoft are urged to apply the patch, disable or remove the PSEMHUB application where unneeded, rotate service-account credentials, and hunt for encoded PSEMHUB requests and web shell artifacts, since UNC6240 is known for data-theft extortion campaigns.

CISA has placed two actively exploited vulnerabilities into its Known Exploited Vulnerabilities catalog: CVE-2026-65660, a code-injection flaw in Microsoft SharePoint rated 8.8 on CVSS, and CVE-2026-67279, a workflow-enforcement bug in Mikrotik RouterOS rated 6.9. Microsoft originally classified the SharePoint issue as a spoofing bug but has now confirmed it can be weaponized for remote code execution, and says it has credible evidence of real-world attacks, though details on the attackers and victims remain undisclosed. The RouterOS flaw is being used alongside a separate argument-injection bug, CVE-2026-86060, in an attack chain dubbed MikroTrick that grants unauthenticated, full administrative access to exposed routers by combining a session-channel bypass with a spoofed login identity. Researchers from CERT Polska and Bishop Fox independently verified the takeover on vulnerable 7.x builds, and federal agencies have been given until September 28, 2026, to remediate both issues.

A 22-year-old active-duty U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in federal prison and ordered to pay nearly $300,000 in restitution after admitting he hacked multiple telecom firms and stole call and text metadata belonging to over 100 million AT&T customers. Operating under the alias Kiberphant0m, Wagenius exploited Snowflake cloud accounts belonging to large corporate customers that had exposed credentials and lacked multi-factor authentication, also targeting Verizon's Push-to-Talk division and extorting victims by threatening to leak the stolen records. Prosecutors noted that while jailed awaiting sentencing, he tried using other inmates' email access to get AI tools to generate exploit code for Windows 10 privilege-escalation flaws and a D-Link vulnerability tracked as CVE-2023-45208, disguising the requests as research for a book. Despite the massive scale of the breach, the government says his criminal earnings totaled only about $1,500, while two alleged accomplices, Conor Riley Moucka and John Erin Binns, still face related charges.

The ransomware group Clop had to relocate its dark-web leak portal after rival extortion crew ShinyHunters broke in and defaced it, later claiming to have stolen source code, plugins, server logs and the Tor service's private keys. Clop confirmed the intrusion but insists only non-sensitive content was exposed, denying any contact or dealings with ShinyHunters despite being quietly delisted from their victim site. ShinyHunters told BleepingComputer the attack abused an unauthenticated file-upload flaw in Grav CMS 1.7.43, where the uniqueformid form parameter wasn't sanitized, letting attackers inject path-traversal sequences to write files outside the intended tmp/forms directory. Grav verified the report, tracked it as CVE-2026-42608, and noted the bug lived in Grav's core rather than the Form plugin; while Grav 2.0 had received a fix via a new sanitizeId() check back in April, that patch was never backported to the 1.7 branch until Grav rushed out version 1.7.53.4, which all remaining 1.7 users are urged to install immediately.

CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The most severe, CVE-2026-5430, carries a maximum CVSS score and lets attackers bypass authentication in WSO2 API Manager (versions 4.1.0-4.6.0), API Control Plane, Traffic Manager, and Universal Gateway (4.5.0 and 4.6.0) by exploiting flawed JWT signature validation, potentially granting full admin takeover. Security firm watchTowr confirmed honeypot captures of forged-token attack attempts against WSO2 products starting September 13. A second critical bug, CVE-2026-71362, is an authorization flaw in Adobe Commerce and Magento that Sansec says can be exploited without any account or user interaction, enabling customer account hijacking. CISA also flagged a high-severity code injection issue in Microsoft SharePoint (CVE-2026-65660) and a medium-severity pre-authentication SSH bypass in MikroTik RouterOS (CVE-2026-67279). Federal agencies must remediate the WSO2 and Adobe flaws by September 27, and the SharePoint and RouterOS issues by September 28, though CISA urges all organizations to patch promptly given the broad use of these platforms across banking, government, and telecom sectors.

Bishop Fox researchers detail CVE-2026-28326, an unauthenticated remote code execution flaw in SolarWinds Access Rights Manager (ARM) that was fixed in version 2026.2.1.7. The root cause is a static authentication secret shipped identically in every installation, letting anyone who can reach TCP port 55555 bypass the certificate check and reach a .NET deserialization sink, which the team confirmed grants SYSTEM-level code execution. SolarWinds rates the issue 8.8 on CVSS, assuming only adjacent-network access, but the researchers note the score can rise to 9.8 if the port is reachable from a flatter network than intended. There is no evidence of in-the-wild exploitation; this is defensive research accompanied by a free detection tool that checks patch status with two safe network requests. Organizations running ARM should upgrade to 2026.2.1.7 or later and tightly restrict access to port 55555.

Microsoft has announced that the Windows Deployment Services (WDS) server role will be deprecated starting with the Windows Server release that follows Windows Server 2025. This means the company will halt further development of WDS, including its management tools, services and PXE boot capabilities, with an eventual goal of fully removing it in a future release. The move follows earlier partial cuts to WDS functionality, such as dropping boot.wim support in 2021 and disabling hands-free deployment by default after the April 2026 updates, tied to guidance around CVE-2026-0386. Microsoft stresses that WDS keeps working as supported on Windows Server 2025 and earlier per their normal lifecycle, that Configuration Manager's OS deployment feature is untouched, and that third-party deployment tools not reliant on WDS are unaffected—but it recommends administrators start moving any WDS-backed PXE or multicast deployments over to Configuration Manager.

Academics from Graz University of Technology have shown that the file-watching notification mechanisms present in Linux, Windows, macOS and Android can be exploited to spy on other local users, even by an app or account with no special privileges. By observing which files change and the timing of those changes, an attacker already running code on the same device can infer keystrokes, reconstruct which websites someone is browsing in Firefox, track WhatsApp media transfers, and even build a fake login prompt that steals credentials on KDE Plasma 6 under Wayland. The attacks don't read actual file contents, but patterns in filenames and timing proved enough to achieve high accuracy — over 93% for keystroke detection and up to 97.8% for identifying visited sites on Firefox. Only one of the flaws has been assigned a CVE, CVE-2025-68788, which Linux has partially patched by stopping input device files from triggering notification events; Microsoft considers the Windows behavior to be by design, and Apple and Google have yet to respond, while proof-of-concept code is already public on GitHub.

Canada's Cyber Centre has confirmed real-world exploitation of a fixed Roundcube Webmail flaw, CVE-2026-48842 (CVSS 8.1), which lets unauthenticated attackers run arbitrary SQL commands through the virtuserquery plugin due to a flawed backslash-escaping check in pregreplace(). The bug affects Roundcube 1.6.x releases prior to 1.6.16 and 1.7.x releases before 1.7.1, and could let intruders pull mail credentials and stored messages straight from the database. Roundcube shipped fixes back in May 2026, yet Shadowserver still counts over 523,000 internet-facing instances, with a handful already flagged as vulnerable in late September. Roundcube remains a recurring target — Proofpoint previously linked the China-aligned group UNKMassTraction to abuse of earlier Roundcube bugs for deploying web shells and the VShell tool, while CISA flagged two separate Roundcube CVEs as actively exploited earlier this year.

Allure Security uncovered an operation distributing bogus “desktop apps” for three major US payroll and HR platforms, none of which actually offers a desktop client. Victims who ran the installer unknowingly got ConnectWise's ScreenConnect remote-access tool silently deployed alongside a legitimate Microsoft .NET Desktop Runtime 8.0.26 setup, giving the attacker unattended, hidden control of the machine — a particularly dangerous outcome for anyone handling company payroll. The lure pages were built with the AI tool Lovable, hosted on Vercel behind a bot-blocking screen, and linked to installers hosted on GitHub, with all payloads connecting back to a single ScreenConnect server in Germany. Researchers tied the campaign to one operator, noted an August precursor signed with a now-revoked certificate under the name "Dennis Miller," and found the infrastructure has since been taken down, while urging employees to treat any unofficial vendor download as a red flag rather than an upgrade.

Canada's Centre for Cyber Security has warned that attackers are actively exploiting a high-severity flaw in Roundcube, the widely used open-source webmail client. The bug, CVE-2026-48842 (CVSS 8.1), is an unauthenticated SQL injection in the virtuserquery plugin, which normally sanitizes input using backslash escaping via pregreplace() but can be tricked with specially crafted backslash sequences to inject malicious SQL queries. Researchers note that successful exploitation could let attackers manipulate database queries, steal sensitive data, access mailboxes and address books, and map out authentication and admin functionality. Roundcube patched the issue in versions 1.6.16 and 1.7.1 released in late May, though the Cyber Centre has not disclosed specifics of the observed attacks; with over 500,000 Roundcube instances reachable online, administrators are urged to update promptly.

CISA has placed two critical vulnerabilities into its Known Exploited Vulnerabilities catalog after confirming they are being actively abused. CVE-2026-5430 (CVSS 9.8) is a path traversal bug in WSO2's API Control Plane, API Manager, Traffic Manager and Universal Gateway that enables unrestricted file upload and remote code execution; watchTowr reported honeypot attacks targeting it since at least September 13, 2026. The second, CVE-2026-71362 (CVSS 9.1), is an authorization flaw in Adobe Commerce and Magento letting attackers hijack another customer's session and steal private account data without any interaction; Sansec blocked exploitation attempts in August, and Previdian logged a probe from an Australian IP on September 10. Federal agencies must apply patches for both issues by September 27, 2026, and other organizations running these platforms are urged to update immediately given confirmed real-world attacks.

Security researcher Rasmus Moorats has disclosed a chain of two OxygenOS flaws that let any app already installed on a OnePlus device escalate to full root access without requesting any permissions or showing the user a prompt. The first bug abuses OnePlus's AtlasService, a root-running debugging component that executes unvalidated input from any caller, giving limited root inside a restricted sandbox zone. The second bug, in a hardware-helper service called olc2, accepts arbitrary shell commands from any process already running as root and executes them with full system-level Linux privileges, completing the takeover. Moorats confirmed the chain works on an unmodified OnePlus 15 and OnePlus 12 Pro, and expects it to affect OxygenOS 16 broadly; OnePlus told him the same code also impacts other OnePlus and OPPO devices, which share underlying software, but did not specify which models. OnePlus acknowledged both issues back in May but has not assigned a CVE or shipped a fix, and it warned Moorats that publishing details without its consent could expose him to legal liability — a threat he disclosed anyway on September 24 after months of stalled communication. There is no evidence the bugs have been exploited in real attacks, and since the flaw requires a malicious app to already be installed, the only current mitigation is sticking to trusted app sources until a patch arrives.

This week's roundup from The Hacker News gathers more than a dozen fresh security stories spanning AI tooling, malware, and supply-chain abuse. A new Android banking trojan called RemControl, distributed through fake Meta ads impersonating the TVTap IPTV app, abuses Accessibility Service for overlay phishing and remote device takeover, with ties suspected to the Medusa UNKN affiliate botnet; it shows signs of AI-assisted development. Separately, Z.ai disabled a default feature in its ZCode coding assistant after it was found silently uploading users' local repositories to Alibaba Cloud, echoing an earlier incident with Grok's coding CLI. Researchers also detailed a man-in-the-browser-style surveillance capability in VK's MAX super-app, a large-scale AI search poisoning campaign feeding fake support details through ChatGPT, Gemini, and AI Overviews, and a one-click Visual Studio Code flaw that bypasses Workspace Trust to run attacker code. Other items cover a backdoored WordPress plugin update, a ClickFix malware-as-a-service copycat, npm/PyPI supply-chain implants, and GitHub's new cache-mode defense against Actions cache poisoning—none tied to active in-the-wild exploitation, but all underscoring how trusted tools and defaults keep becoming attack surfaces.

Canada's Centre for Cyber Security has confirmed that a critical Roundcube Webmail bug, CVE-2026-48842, is now being actively abused by attackers, four months after a fix was issued. The flaw lies in the virtuserquery plugin and allows unauthenticated attackers to run SQL injection attacks, bypass login, and pull data straight from the mail server's database without any user interaction. Roundcube pushed fixes in versions 1.6.16 and 1.7.1 back in May, but with over 523,000 internet-facing instances tracked by Shadowserver, many servers likely remain unpatched. Administrators unable to update immediately are advised to disable the vulnerable plugin, especially given Roundcube's history as a favored target for groups like Winter Vivern and APT28 in espionage campaigns against government networks.

CISA has updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-63077, a critical authentication bypass in JetBrains TeamCity On-Premises, as now being leveraged by ransomware operators. JetBrains fixed the bug on July 25 in versions 2025.11.7 and 2026.1.3; it allows an unauthenticated attacker to abuse the agent polling protocol to run arbitrary OS commands with the TeamCity server's privileges, potentially exposing credentials and compromising CI/CD pipelines. CISA first added the flaw to its exploited-vulnerabilities list back on August 5, and JetBrains confirmed in-the-wild attacks two days later, but this is the first time the ransomware angle has been officially confirmed. Shadowserver currently counts around 160 internet-facing TeamCity instances still unpatched, down from roughly 700 shortly after disclosure, and organizations running exposed servers are urged to apply the fix immediately given TeamCity's history of abuse by both state-sponsored actors and ransomware crews.

SolarWinds has shipped fixes for two high-impact security flaws in its Observability Self-Hosted monitoring platform, both of which could let unauthenticated remote attackers execute arbitrary code. The more severe issue, CVE-2026-28324 (CVSS 9.8), stems from an insufficient integrity check that becomes exploitable on instances running insecure, non-default settings. The second, CVE-2026-28325 (CVSS 8.8), involves unsafe deserialization of untrusted data on systems configured with a particular communication mode. Both bugs affect every Observability Self-Hosted release up to 2026.2.2 and are resolved in 2026.2.3; researcher Kai Huang of Armadin was credited with reporting them. This follows last week's fix for CVE-2026-28326 (CVSS 8.8) in SolarWinds Access Rights Manager up to version 2026.2, caused by a hardcoded static key that also allowed unauthenticated remote code execution. SolarWinds states none of these vulnerabilities have been observed being exploited in the wild, and customers are urged to apply the available updates.

GNOME has released version 50.5, closing a security gap in the gvfs file-system component, a code-injection bug in the Epiphany browser, and a use-after-free flaw in the librsvg image-rendering library. The update touches 22 modules in total, and the GNOME Release Team is urging every distribution running GNOME 50 to pull in the new packages. Epiphany moves from 50.4 to 50.6, folding in two earlier point releases. One of them stops JavaScript from being injected through a CSS selector used in the autofill feature, and also fixes a path-traversal issue in WebExtension XPI archives (a ZIP slip bug that could let a malicious extension drop files outside its intended folder). The other adds proper quoting to command-line arguments before Epiphany passes them to a shell. gvfs 1.60.3 carries the one named vulnerability in this release, CVE-2026-88924, fixed by having the admin backend set socket ownership before the socket is created — though GNOME's notes give no severity rating for it. librsvg 2.62.4 patches a use-after-free triggered by duplicate XML entities inside nested XInclude documents, alongside Rust dependency updates addressing RUSTSEC-2026-0187 and RUSTSEC-2026-0204. The login manager GDM also gets fixes for two use-after-free bugs — one capable of crashing an entire session during screen lock/unlock — plus a regression that had broken systemd authentication after a prior security patch.

Patchstack reports that a newly patched WordPress flaw started being exploited mere hours after it became public, with activity already escalating to full-blown site takeovers. The bug, CVE-2026-87902 (CVSS 9.2), is a path traversal issue in how WordPress resolves page templates via getpagetemplate(), letting unauthenticated attackers pull in an arbitrary readable local .php file from outside the active theme's folder. When the active theme's top-level directory name begins with 'page-' and the server can read a chosen PHP target, this can be chained with the known pearcmd.php PEAR-to-RCE trick (requiring registerargcargv enabled) to achieve remote code execution — a setup present in the official PHP Docker image and in default cPanel configs running PHP below 8.5. Affected theme structures include the old Twenty Twelve and Twenty Fourteen defaults as well as third-party themes like Neve, Hestia, and Sydney. WordPress fixed the issue in version 7.1.2 on September 22, with the patch backported as far as the 4.7.x line, but Patchstack says attackers crafted exploit payloads directly from the patch diff and ramped up from reconnaissance scans to live compromises by September 23, with traffic now ten times higher than on the first night and expected to keep growing given public scanning tools.