WatchGuard PSIRT (published 28 September 2026; Cyber Security News amplify 29 Sep) discloses three flaws in WatchGuard access-point firmware. CVE-2026-86102 (CVSS v4 9.3) — OS command injection in the internal management API: unauthenticated attacker with network reach to the AP can run arbitrary shell commands. CVE-2026-101891 (CVSS v4 9.3) — improper access control on an internal API service allowing unauthenticated access to protected functionality. CVE-2026-87969 (CVSS v4 8.6) — authenticated administrator command injection via the diagnostic CLI. Affected: WatchGuard AP 1.0 through 3.4.7. Fixed: 3.4.8. Vendor/CSN: no public evidence of active exploitation at disclosure. Distinct from desk watchguard-fireware-iked-20260827 (Fireware OS iked / Dimension cluster). Primary: WatchGuard PSIRT advisory list; wire: CSN 29 Sep.
GitHub advisory GHSA-qx49-fqc8-xw99 (published 28 September 2026; Cycode write-up same day; The Hacker News 29 Sep) covers the official Model Context Protocol Python SDK (PyPI package mcp): in affected versions the OAuth client support (mcp.client.auth) let the MCP server decide where the client’s OAuth credentials were sent — authorization-server metadata issuer was not validated on every discovery path, and stored/pre-provisioned client credentials were not bound to their authorization server. A malicious or compromised MCP server could therefore receive the client_secret, authorization code and PKCE code_verifier (or a signed client assertion under PrivateKeyJWTOAuthProvider) meant for the real login service. Affected: 1.9.1 through 1.29.1 (no issuer check / binding on any path); 2.0.0 through 2.1.1 (missing on legacy metadata fallback and 403 insufficient_scope paths); on both lines ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider had no way to name their issuer. Not affected: MCP servers built with the SDK, stdio clients, clients that attach their own tokens/headers. GHSA rates High 7.5 for unattended providers; interactive OAuthClientProvider scored 6.5 (UI:R). No CVE ID assigned on the advisory as of 29 Sep 2026. No in-the-wild exploitation stated. Distinct from desk google-mcp-toolbox-ssrf-14540-20260731 (Google mcp-toolbox SSRF) and GHSA-jpw9-pfvf-9f58 (session principal bypass). Primary: GitHub GHSA-qx49-fqc8-xw99; researcher: Cycode; wire: THN 29 Sep.
Apple security content for iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (published 28 September 2026; The Hacker News amplified same day) patches CVE-2026-86950 in CoreGraphics: an out-of-bounds write addressed with improved bounds checking. Impact: processing a maliciously crafted file may lead to arbitrary code execution. Apple states it is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27 — no public detail on volume, success, or first-seen date. Credited to Meta Product Security. No Apple-published CVSS on the HT pages. Distinct from earlier February 2026 dyld CVE-2026-20700 (also noted as weaponised in sophisticated attacks). Primary: Apple HT149226 / HT149228 / HT149229; wire: The Hacker News 28–29 Sep. UPDATE 1 Oct 2026 (desk 16:00 Perth): Calif research “The Great Glyph Grift” (Dion Blazakis, Josh Maine, Anna Groza; 30 Sep) publishes patch-diff analysis and a public crash-trigger sample (TrueType/PDF via ImageIO thumbnail path) showing a controlled out-of-bounds write from glyph fixed-point conversion — crash demonstrated on macOS/iOS; authors state turning that into reliable code execution is separate work and they did not obtain the in-the-wild sample. Calif also notes WhatsApp Kaleidoscope (versions 26.37.73→26.38.74) added stricter PDF embedded-font checks, hinting a possible messaging attachment delivery path consistent with Meta Product Security credit — not confirmed as the in-the-wild vector. CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog on 29 Sep (due 2 Oct 2026). Wire: The Hacker News 1 Oct. UPDATE 2 Oct 2026 (desk 19:00 Perth): WA SOC advisory 20261002001 (TLP:CLEAR) restates CVE-2026-86950 as an out-of-bounds write in CoreGraphics on Apple iOS/iPadOS 26.x prior to 26.7.1 and macOS 15.x prior to 15.8.1 / 26.x prior to 26.7.1, scores CVSS 8.8 High, notes CISA KEV listing, states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing, and recommends Apple HT149226 / HT149228 / HT149229 within expected patch timeframes.
Apple — About the security content of iOS 26.7.1 and iPadOS 26.7.1 (28 Sep 2026)
Citrix Security Bulletin CTX697096 (27 September 2026) confirms exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler ADC/Gateway. CVE-2026-88771 (CVSS 4.0 9.5) — improper input validation enabling unauthenticated arbitrary command execution on all ADC/Gateway deployments including default configuration (CWE-20). CVE-2026-88772 (CVSS 4.0 9.5) — memory overflow RCE/DoS when DTLS is enabled (default on VPN vServer; CWE-119). Bulletin also ships CVE-2026-88773–88778 (smuggling / policy bypass / memory overflow / TCP ISN). Affected: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; FIPS/NDcPP trains as in bulletin; SPA Hybrid NetScaler instances likewise. Customer-managed only. UPDATE 27–28 Sep 2026: CISA Alert (27 Sep) and CISA KEV (dateAdded 2026-09-27) list CVE-2026-88771 and CVE-2026-88772 with FCEB due 30 Sep 2026 and forensic-triage required under BOD 26-04 — preserve evidence before patching (updates can erase forensic visibility); use NetScaler Console IoC checks as supporting telemetry. UPDATE 28 Sep 2026: ASD’s ACSC Critical alert (first published / last updated 28 Sep 2026) covers the eight CVEs, states at least CVE-2026-88771 and CVE-2026-88772 were under active exploitation globally before a patch was available, and notes ACSC has not yet received reports of confirmed exploitation in Australia. UPDATE 29 Sep 2026: WA SOC advisory 20260929001 (TLP:CLEAR) restates Citrix NetScaler ADC/Gateway/FIPS CVEs including CVE-2026-88771/88772 (CVSS 9.5) through CVE-2026-88778, notes CISA KEV listing, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. Primary: Citrix CTX697096; AU: ACSC Critical 28 Sep + WASOC 20260929001; KEV/alert: CISA. UPDATE 29 Sep 2026 — BleepingComputer citing Mandiant and GreyNoise post-exploitation: attackers exploited the zero-day window (Mandiant: began at least early September; NA/EU victims across government, financials, education, legal, professional services) to deploy custom web shells and tunneling malware, gain root, steal credentials and move internally. GreyNoise observed 149.104.78.141 attempting exploitation on 24 Sep (pre-disclosure): setuid/setgid on /bin/sh, password-protected PHP webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, httpd aliases mapping receiver.min.css / receiver.min.[hex].css to the hidden PHP handler; webshell SHA-256 published in GreyNoise “Swarming Against Citrix 0-Day Exploitation”. Mandiant CTO (LinkedIn via Cybersecurity Dive): hunt compromise before/while patching — webshells can survive upgrade/HA sync. Hunt IoCs on both HA nodes; preserve evidence per CISA BOD 26-04. UPDATE 29–30 Sep 2026: watchTowr (29 Sep) published a technical analysis of CVE-2026-88772 as a DTLS handshake-reassembly / scratch-buffer memory overflow on NetScaler Packet Processing Engine paths; reiterates DTLS is enabled by default on VPN virtual servers unless administrators set -dtls OFF. Same write-up restates Citrix guidance that CVE-2026-88778 (predictable TCP ISN) is addressed by enabling Enhanced ISN Generation — not by the firmware upgrade alone. Desk does not reproduce exploit construction; use vendor bulletin + watchTowr for defender context. UPDATE 30 Sep 2026: Mandiant/Google TI (via BleepingComputer 29 Sep and The Register 29 Sep) name the post-exploit toolkit as WHIPSHOT (PHP web shell disguised as a Debian package in the NetScaler VPN scripts directory; HTTP transport bridge hiding Base64 C2 in native HTTP headers) and SLAPSHOT (Python TCP tunneling tool that accepts WHIPSHOT commands and forwards arbitrary TCP streams to internal hosts — used in at least one intrusion for manual recon and credential theft). Sector impact restated: government, financial services, education, legal and professional services in North America and Europe. Mandiant CTO: examine for compromise before/while patching — patching alone may not eradicate the actor. UPDATE 30 Sep 2026 (desk 1 Oct 10:00 Perth): ASD’s ACSC Critical alert (first published 28 Sep; last updated 30 Sep 2026) now states that since the 28 Sep publication it has received reports from Australian organisations confirming exploitation. ACSC recommends reviewing for evidence of compromise since at least 4 September 2026; Citrix IoCs via NetScaler Console and Security Bulletin for CVE-2026-88771 through CVE-2026-88778. UPDATE 1 Oct 2026 (desk 13:00 Perth): LevelBlue THOR (via The Hacker News 1 Oct) documents post-exploitation across customer NetScaler environments weaponizing CVE-2026-88771 with attacker-controlled authentication usernames containing pitboss / NSPPE strings. Observed follow-ons: curl/wget payload fetch from 64.94.85[.]67:443/update_c08937.pl and 31.56.197[.]72:9090/lula; Python reverse shell main.py to 45.141.21[.]130:443 that kills /var/python/bin/customsnmpd; Perl update_c08937.pl creates local superuser sec_monitor, archives /flash/nsconfig to /tmp/update_result_3567cs.tgz for exfil, chmod 6555 on /bin/sh, deploys PHP webshell at /var/netscaler/logon/LogonPoint/.local_journal, and maps it via httpd.conf to CSS-like URLs (aligns with GreyNoise receiver.min.css-style mapping already on this card). Hunt these paths/accounts/IoCs alongside WHIPSHOT/SLAPSHOT. Lead paragraph supersedes the still-present Background sentence that said ACSC had not yet received AU confirmation. Wire: Cyber Daily 1 Oct. exploited_au flipped to yes on this pass. UPDATE 3 Oct 2026: ACSC Critical alert last updated 3 October 2026 adds a newly identified NetScaler SAML authentication issue (crashes/DoS/potential exploitation; AU organisations impacted) that ACSC says is separate from CVE-2026-88771/88772 — see desk card citrix-netscaler-saml-acsc-20261003. CVE-2026-88771/88772 patch/hunt guidance unchanged (hunt since ≥4 Sep; IoCs via NetScaler Console). UPDATE 13 Oct 2026 (desk 19:00 Perth): Binary Defense (blog 'Platypwned', published 12 Oct US time) describes an incident-response case on two NetScaler appliances that a triage collection flagged while the customer was upgrading. One showed exploitation but no dropped files; on the other, attackers who had abused CVE-2026-88771/88772 delivered a private, modified fork of the open-source Go remote-admin tool Platypus, compiled for FreeBSD and disguised as a Perl file (one sample named .ns_09343.pl, actually an ELF binary). It was installed with a one-shot curl | sh script carrying a single-use enrolment token, which Binary Defense found in ns.log; paths included /var/tmp/, /netscaler.local/ and a .ns-cache folder under /var/core/. Binary Defense believes registration with the attacker's server failed on that appliance. The fork adds privilege-escalation, persistence disguised as a health monitor, and anti-forensic timestamp/cleanup modules that are not in the public project; agents were built on 28 Sep 2026 and the C2 ingress certificate issued the same evening. C2/staging domain: entretiensol[.]com (agent path /v1/artifacts/<os>/<arch>/latest); related infrastructure named: white-guard[.]pro, gurerasfalt[.]com, garyvard[.]com, hickoryusedauto[.]com. SHA-256 hashes are in the Binary Defense post. eSentire separately reported Platypus enrolment against three customers on 28 Sep from the same C2. Cyber Security News wire 13 Oct. No new Citrix or ACSC guidance; patch builds unchanged.
CI-ISAC Australia has published an advisory (GCVE-123-2026-0001, coordinated disclosure 25 September 2026) for Best Practice Software's Bp Premier, the clinical and practice-management system used by Australian general practices. Affected versions use a hardcoded Microsoft SQL Server administrative password that is the same on every installation and, in those versions, could not be changed without breaking the application. Anyone who can reach the practice's Bp Premier SQL Server instance over the network can log in with it, bypass the application's own authentication, gain sysadmin rights over the database (patient records included) and run operating-system commands, typically as SYSTEM. CI-ISAC rates it CVSS 3.1 9.6 (adjacent-network vector) and notes exploitability depends entirely on how exposed the database listener is. CI-ISAC lists Bp Premier 1.12.1.1023, 1.12.3.1042, 1.13.1.1080, 1.13.1.1096 and 1.14.0.1114 as affected and 1.14.1.1129 (Oxford SP1) as fixed. Best Practice Software's Oxford SP1 release notes (released 4 September 2026) describe a 'Security Update: Best Practice Database Connector' — a new Windows service that gives every practice a unique database access password stored within the practice environment — plus a Database Password Access Manager that controls which workstations may retrieve database credentials; the vendor says sites already on 1.14.1.1128 do not need 1.14.1.1129, and warns that medical devices such as ECG, spirometry and blood-pressure integrations may need reconnecting after the update. The flaw was reported to CI-ISAC by an anonymous researcher on 26 May 2026 and independently verified by CI-ISAC's Andrew Tunnecliffe in June. A CVE identifier, CVE-2026-114119, was added to the CVE list on 21 October 2026. No exploitation has been reported. Primary: CI-ISAC Australia advisory GCVE-123-2026-0001; vendor: Bp Premier Oxford SP1 release notes.
CI-ISAC Australia — GCVE-123-2026-0001: Bp Premier ships a hardcoded, shared SQL Server administrative credential (25 Sep 2026)
wolfSSL release 5.9.4 (25 September 2026; security-vulnerabilities page listing the fixed CVEs amplified ~28–29 Sep including Cyber Security News 29 Sep) ships eleven security fixes. Highest-profile High issues include CVE-2026-89102 (client RFC 6961 multiple-OCSP stapling path can enable certificate forgery when HAVE_CERTIFICATE_STATUS_REQUEST_V2 / wolfSSL_UseOCSPStaplingV2 is used; 5.7.2–5.9.2), CVE-2026-89136 (TLS/DTLS client accepts unsolicited server_cert_type=RawPublicKey and may bypass authentication — RPK off by default; needs --enable-rpk / --enable-all / --enable-distro; 5.6.0–5.9.2), CVE-2026-93302 (MatchTrustedPeer / WOLFSSL_TRUST_PEER_CERT forged CA clones), and CVE-2026-11310 (OpenSSL-compat X.509 trust-chain bypass under --enable-opensslextra). Also Medium name-constraint / CertManager issues (CVE-2026-89133/89134/89135, CVE-2026-93304) and Low DoS/UAF/revocation/session-cache items (CVE-2026-15442, 94417–94419). No Critical in this 5.9.4 set on the vendor page. No in-the-wild exploitation stated. Primary: wolfSSL security vulnerabilities page; release: GitHub wolfSSL 5.9.4.
wolfSSL — Security Vulnerabilities (fixes in 5.9.4)
Patchstack (Dave Jong, published 25 September 2026; reporter Saggre via Patchstack 22 Sep) details an unauthenticated cross-site request forgery in Elementor Website Builder 4.3.0 and 4.3.1 only. The Editor Events module checked the raw request URI for the elementor/v1/events/ path and skipped WordPress REST nonce validation when present, so attacker-controlled query parameters could append that path to other REST endpoints. A logged-in administrator opening a single link (email/chat/comment — no JavaScript or attacker page required) performs any REST action their role allows; on default installs that includes creating a new administrator. ~2 million sites on 4.3.0/4.3.1 per WordPress.org stats cited by BleepingComputer (25 Sep). Releases before 4.3.0 lack the Editor Events proxy (not this bug). Fixed in Elementor 4.3.2 (24 Sep) by validating the resolved REST route. No CVE ID assigned as of the Patchstack/BleepingComputer reports. Primary: Patchstack; wire: BleepingComputer.
Oracle Security Alert CVE-2026-35273 (10 June 2026; NVD CVSS 3.1 9.8 CRITICAL AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is an unauthenticated HTTP takeover of PeopleSoft Enterprise PeopleTools Updates Environment Management (PSEMHUB / Environment Management Hub) on supported versions 8.61 and 8.62. CISA added it to KEV on 12 June 2026 (Known ransomware use). UPDATE 25–26 Sep 2026: Mandiant / Google Threat Intelligence Group report renewed UNC6240 (ShinyHunters) mass exploitation: actors bypass literal WAF path blocks by requesting /%50SEMHUB/ (percent-encoded P) so proxies miss /PSEMHUB/ while WebLogic still routes to the vulnerable servlet; web shells (x.jsp / u.jsp and variants) and fileless command execution observed on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation, and government. On Windows hosts, trojanized Ple64.exe (masquerading as signed Light Alloy media-player installer; EV cert later revoked) loads in-memory SIDEEYE C++ backdoor (C2 162.219.30.165 TCP/3333–3334); MeshCentral agents also used for persistence. June campaign hit education as a zero-day (27 May–9 June); this wave targets orgs that WAF-mitigated but did not patch or disable EMHub. Cybernews (26 Sep) cites Google notifying 100+ organisations. Distinct from desk shinyhunters-fbi-peoplesoft-20260922 (FBI claim of a “new” PeopleSoft zero-day — unconfirmed relation). Primary: Google Cloud / Mandiant GTIG; vendor: Oracle Security Alert; wire: Cybernews.
Google Cloud / Mandiant GTIG — ShinyHunters renewed PeopleSoft mass exploitation (25 Sep 2026)
Researcher Faav (blog.faav.net, published 25 September 2026) details an authentication flaw in Microsoft’s internal Titan analytics API: the service checked JWT claims (tenant, audience, app ID, user) but never verified the token signature, so a forged token with upn set to admin enabled administrator-level SQL without real credentials. Controlled testing reached 30 live routing targets → 17 ClickHouse analytics databases (~9,863 table names) with metadata totaling an estimated 17.3 trillion stored rows (Bing search analytics among them); Faav states only metadata and bounded one-row samples were accessed and no customer PII was taken. Reported to MSRC (case 144051); MSRC asked testing to stop 6–8 Sep and locked the API endpoint on 9 September 2026. Microsoft statement in the write-up: coordinated disclosure helped harden services under the Bug Bounty program. Impact described as hypothetical for a malicious actor; no public CVE assigned in the write-up. Primary: Faav blog; wire: Cyber Security News 26 Sep.
Faav — How I Could’ve Accessed 17 Trillion Microsoft Records (25 Sep 2026)
BleepingComputer (25 September 2026) reports ShinyHunters compromised and defaced the Clop ransomware data-leak site by exploiting an unauthenticated path-traversal / arbitrary file-write flaw in Grav CMS core FormFlash. Grav told BleepingComputer that the vulnerability and exploitation details shared with it were accurate and tracks the issue as CVE-2026-42608 (GHSA-hmcx-ch82-3fv2; advisory 27 Apr 2026): unauthenticated manipulation of form identifiers (e.g. __unique_form_id__ / __form-flash-id) lets attackers traverse out of tmp/forms and write under the Grav install. Fixed in Grav 2.0.0-beta.2 earlier; the 1.7 line lacked the backport until Grav released 1.7.53.4 after BC shared exploitation details (BC: “yesterday” relative to 25 Sep). Bug is in Grav core, not the Form plugin. CVE.report / GitHub CNA: CVSS 4.0 8.8 HIGH (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/…). Primary wire: BleepingComputer; vendor: Grav GHSA + 1.7.53.4 release; metadata: CVE.report. Correction (26 Oct 2026): removed statements made only by the Clop and ShinyHunters gangs (the Grav version on Clop's server, the move to a new Tor address, what was or was not stolen, and contact between the groups); this desk does not publish gang statements. Grav's confirmation to BleepingComputer that the exploitation details were accurate is kept. (source: BleepingComputer)
BleepingComputer — ShinyHunters hacked Clop leak site via Grav path traversal (25 Sep 2026)
Patchstack (public 25 September 2026; reported by Saggre 22 Sep; fixed 24 Sep) documents CVE-2026-62062 in Elementor Website Builder 4.3.0 and 4.3.1 only: the Editor Events module disabled WordPress REST CSRF/nonce protection whenever the literal string elementor/v1/events/ appeared anywhere in the raw request URI (including attacker-controlled query string). A one-click link opened by a logged-in administrator can force any REST action that account may perform — on a stock install, creation of an attacker-controlled administrator. No JavaScript or attacker-hosted form required. Patchstack CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); ~2M sites on the two affected versions per WordPress.org stats cited by Patchstack/BleepingComputer. Fix 4.3.2 checks resolved rest_route instead of raw URI. Distinct from Elementor Pro form-upload CVE-2026-32475 (desk card). Primary: Patchstack advisory + database; wire: BleepingComputer 25 Sep 2026.
SecurityWeek (Eduard Kovacs, 25 September 2026) and project site inoti.fyi summarise Graz University of Technology research (“File Notification Attacks”) showing that OS file-change notification APIs — Linux inotify, Windows ReadDirectoryChangesW, macOS FSEvents, Android FileObserver — can be abused by an unprivileged local account (or a no-permission Android app) to reconstruct other users’ activity from event names and timing without reading file contents. Demonstrated: Linux inter-keystroke timing (93.1–100% F1), Firefox website fingerprinting (87.9% top-100), KDE Plasma 6 Wayland fake-password-prompt overlay; Windows full-path leakage under drive-root watches including other users’ homes (Firefox top-1000 97.8%); Android WhatsApp media send/receive/delete metadata; macOS least leakage but still app launch / settings / connectivity signals. Linux partially mitigated Dec 2025 (no access/modify events on special/device files) as CVE-2025-68788 in kernels 5.10.248 / 5.15.198 / 6.1.160 / 6.6.120 / 6.12.65 / 6.18+. Microsoft optional registry EnforceDirectoryChangeNotificationPermissionCheck; researchers list no Android/macOS patches. PoC on GitHub (isec-tugraz/file-notification-attacks). No known in-the-wild exploitation per researchers. Primary: inoti.fyi + paper PDF; wire: SecurityWeek 25 Sep.
