Socket (23 September 2026; corroborated by Aikido, SafeDep, StepSecurity; THN amplify same day) reports compromise of MemTensor MemOS packaging: npm @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25 (0.1.25 tagged latest; 0.1.22/0.1.24 match last-good 0.1.20 aside from version strings; last known-good 0.1.20) and PyPI MemoryOS 2.0.34 (latest; last pre-compromise 2.0.33). Malicious builds bundle cross-platform Go implant sckit (linux/macOS/Windows x64+arm64) that launches on OpenClaw gateway start / memory-recall (npm) or on import memos (PyPI), harvests developer/CI secrets (npm/PyPI/GitHub/GitLab/AWS/Vault/SSH and related env tokens), and phones home to skyleen[.]fr. Initial access via malicious GitHub commits altering release tooling; Socket could not yet confirm how registry publish access was obtained. Treat any host that loaded the bad versions as compromised; worm-like republish strings noted but broader package impact unconfirmed. Primary: Socket analysis; secondary: The Hacker News 23 Sep 2026.
Hewlett Packard Enterprise advisory HPESBNW05137 (rev.1, 22 September 2026) covers multiple flaws in HPE Networking Analytics and Location Engine (ALE) ≤ 5.0.0.0, fixed in ALE 5.1.0.0. Lead criticals: CVE-2026-76708 (CVSS 9.8) — default hard-coded credentials on administrative/system accounts enabling unauthenticated remote login to the ALE management interface and underlying OS (CWE-798); CVE-2026-76709 (CVSS 9.8) — unauthenticated remote arbitrary file write with elevated privileges via an internal administrative component. Additional highs include info disclosure, data injection, auth’d root filesystem/command execution, MitM RCE, and API password-hash disclosure (CVE-2026-76710 through CVE-2026-76717). HPE said it was not aware of any public discussion or exploit code targeting the flaws as of the advisory's release date. Primary: HPE HPESBNW05137; secondary: CVE.report / Tenable CVE pages; wire: Cyber Security News 25 Sep. Correction (27 Oct 2026): HPE's bulletin says it is not aware of public discussion or exploit code; it does not address active exploitation, so the card no longer says it did. (source: HPE HPESBNW05137)
Have I Been Squatted (published 22 September 2026; researcher Ben Folland) documents Corp MDM, a compact Android surveillance implant distributed via fake Google Play pages branded as CEVA and TKW Logistics (playgoogle.logisticstkwcargo[.]com / playgoogle.ceva-app[.]help) delivering package com.corp.mdm. Once sideloaded it requests SMS/telephony/notification permissions, removes its launcher icon, runs a hidden foreground service, registers a device id with C2, heartbeats ~30s, and polls for commands (intercept new inbound SMS only — not the historical inbox — enable/disable call forwarding, self-destroy). C2 and phishing/Windows-malware hosting share VPS 69.55.61[.]82; operator panel on TCP/3456. HIBS assesses Armenian/Russian nexus from panel/UI artefacts and places the implant inside a broader logistics-sector credential-phishing + Windows malware campaign aimed at cargo theft (distinct from prior Diesel Vortex cluster; no evidence same group). Suspected AI-assisted development (capability-limiting bugs). No CVE. Wire: The Hacker News 24 Sep 2026. Primary: HIBS research post.
Have I Been Squatted — Inside Corp MDM (22 Sep 2026; note vendor URL spelling)
Proofpoint Threat Insight (22 September 2026) details active TeamFiltration campaign UNK_CondorFiltration targeting over 5,700 accounts across 28 Microsoft 365 tenants in Latin America (focus Chile; major retailer + financial institutions). Late July–August 2026 waves; 78.3% of observed auth events against one unnamed Chilean retailer. All seven confirmed compromises were unmanaged functional/service accounts with no prior legitimate login baseline — default/predictable passwords never rotated, no MFA. Six of seven broken within ~7 minutes (shared/default password set). Post-access: German VPN pivot, corporate VPN SAML probe, Azure Portal / OfficeHome / SharePoint Online / Microsoft Graph token activity (sign-ins alone are not proof of exfiltration). TeamFiltration (Joakim Kandefelt / TrustedSec; DEF CON 30) automates Entra ID enumerate/spray/exfil/backdoor. Prior related cluster UNK_SneakyStrike (Proofpoint Jun 2025) hit 80k+ accounts. Primary: Proofpoint. Updated 24 Sep 2026: The Hacker News reported the campaign on 24 September (2:32 pm Perth). (source: The Hacker News)
Proofpoint — Spraying in the Andes: TeamFiltration Returns (22 Sep 2026)
Astrana Health, Inc. Form 8-K Item 1.05 (date of earliest event 22 September 2026) reports a material cybersecurity incident at subsidiary Astrana Health Management, Inc. Threat actors used social engineering — impersonating company personnel and spoofing the main corporate telephone number — to contact employees and obtain unauthorized access. The company detected and responded, engaged a third-party cybersecurity/forensics firm, notified law enforcement, and is notifying state/federal regulators and payer partners. Remediation includes resetting affected credentials, restricting remote-access tools, rebuilding certain systems from clean backups, and improving monitoring/logging/detection. Investigation determined threat actors accessed and exfiltrated certain private and confidential information; assessment continues on whether patient, employee, credentialed-provider, business/financial, IP, or other data was involved; patient notifications to follow findings. Incident judged material as of 22 Sep 2026 due to potential sensitivity of data; company states it does not currently expect material impact on financial condition or operations. Primary: SEC 8-K.
SEC EDGAR — Astrana Health Form 8-K Item 1.05 (22 Sep 2026)
Jamf Threat Labs (22 September 2026) documents a third PamStealer macOS infostealer variant distributed as a fake multichain crypto wallet “Wavel”. Lure site wavel[.]app serves Wavel.dmg from y32me8[.]com; the DMG drops a nameless .scpt that opens in Script Editor and runs compiled JXA (JsOsaDAS1.001.00 magic) which only base64-decodes a carrier into /bin/zsh. The zsh dropper downloads a purpose-built pkgunpack Mach-O, completes a live X25519/ECIES key exchange with wavel.apple03cloudstore[.]com, and decrypts CoreUpdate.pkg.enc — without server cooperation the payload cannot be recovered statically. Stage 2 is rewritten from Rust to Swift while retaining PAM-based credential validation that names the family. Distinct from desk Rapuncel LastPass SEO lure. Primary: Jamf Threat Labs; wire: Cyber Security News 23 Sep 2026.
Jamf Threat Labs — PamStealer adapts again (Wavel / Swift / server-side decrypt, 22 Sep 2026)
Aikido (published 22 September 2026; THN 23 Sep) reports Graphalgo-linked Go malware distributed via two Terraform providers (gocommunity-io/dockerd and typosquat kreuzwenker/docker of popular kreuzwerker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex) — described as the first use of HashiCorp’s centralized Terraform Registry as a malware distribution vector in this campaign. Providers hide an encrypted ZIP (examples/resources/docker_container/import-resource.sqlite3) decrypted with a SHA-256-derived AES key then executed via detached go run. Implant is a Go port sharing Slack bot + Arbitrum Sepolia smart-contract dead-drop C2 (contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C) with prior npm Graphalgo (ReversingLabs Feb 2026; also Checkmarx/JFrog/SafeDep). Aikido observed plaintext Slack check-ins from 18 unique hostnames (mix of macOS/Linux/Windows). Primary: Aikido; wire: The Hacker News 23 Sep 2026.
Aikido — Graphalgo malware spreads to Terraform and Go (22 Sep 2026)
AWS Security Bulletin 2026-115-AWS (Publication 22 September 2026 10:00 AM PDT) documents CVE-2026-94384: missing authorization in Amazon Connect Salesforce Lambda (AmazonConnectSalesforceLambda) sfExecuteAWSService before 5.26. Any IAM principal with lambda:InvokeFunction on the function can escalate and call AWS APIs allowed by the function's privileged execution role even when their own IAM policy denies those actions — the Lambda becomes a privileged parameter-dispatch proxy. Amazon CVSS 3.1 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); CVSS 4.0 6.4 Medium. Affected SAR app versions 5.15 through <5.26 (CSN also cites through 5.24.16). Remediation: upgrade to 5.26 or later; after setup delete or disable sfExecuteAWSService, or restrict InvokeFunction to the intended CTI Adapter IAM user only. Credit: Chang Li (Xidian University) via CVD. Primary: AWS bulletin 2026-115-AWS; metadata: CVE.report; wire: Cyber Security News 23 Sep 2026.
cPanel support advisory (22 September 2026) documents CVE-2026-87899: an authenticated cPanel account holder can escalate through CalDAV/CardDAV functionality to code execution as root and full server control. Affects cPanel/WHM v120 or later; patched in 11.134.0.57+, 11.136.0.41+, 11.138.0.8+, and WP Squared 11.138.1.11+. Same-day related advisories (not separate desk cards): CVE-2026-87900 (WP Toolkit ≤6.11.2-10794 — authenticated cPanel user can modify other accounts' databases; fix WP Toolkit 6.11.3+) and CVE-2026-68490 (CalDAV/CardDAV — local user can read other accounts' calendar/contacts; same cPanel/WHM patched trains; no root). Vendor advisories do not publish CVSS and do not state exploitation. Credited to Ali Mustafa (rz1027). Primary: cPanel support CVE-2026-87899; secondary: The Hacker News 23 Sep 2026. UPDATE (24 Oct 2026): The CVE record (HackerOne as CNA) scores CVE-2026-87899 at 9.4 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). (source: CVE record CVE-2026-87899)
Swedish Authority for Privacy Protection (IMY) press release (22 September 2026) imposes an administrative fine of SEK 1.8 million (~US$183k) on system supplier Miljödata i Karlskrona AB for inadequate technical/organisational security (GDPR Art. 32.1) after an August 2025 intrusion. Per IMY/Miljödata: ~2.2 million people affected; stolen data included personal identity numbers, contact details and sensitive fields (sickness absence, rehabilitation, school incidents involving minors) later published on darknet; customers included a majority of Sweden’s municipalities plus regions, agencies and private firms. IMY finds insufficient checks when installing new software and no automated real-time monitoring for intrusions/suspicious activity; agency also opened related reviews of two municipalities and one region (ongoing). Wire: BleepingComputer 22 Sep 2026. Primary: IMY pressmeddelande.
IMY — Sanktionsavgift mot Miljödata för bristande säkerhet (22 Sep 2026)
Vercel GitHub advisory GHSA-vcvr-r3jv-pc5j (published 22 September 2026; CVE-2026-94545) documents remote code execution in the Node.js ImageResponse implementation from next/og when apps pass attacker-controlled values into SVG content, attributes, or styles during Open Graph / social-preview image generation (upstream Satori path). Vercel rates Critical with CVSS 4.0 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Affected: Next.js >=16.2.0 <16.3.6 on the Node.js runtime (default). Not affected per advisory/industry coverage: Edge ImageResponse and Next.js 15. Patched: 16.3.6 (22 Sep). Inventory routes importing ImageResponse from next/og that echo request/URL input into SVG; prefer not placing untrusted input in SVG title/attrs/styles until patched. No in-the-wild exploitation claimed in the 22–23 Sep Vercel/THN materials. Primary: GHSA-vcvr-r3jv-pc5j; wire: The Hacker News 23 Sep 2026.
