UPDATE 23–24 Sep 2026: BleepingComputer reports threat actors moved from probing to exploiting CVE-2026-87902 to write files that execute shell commands when accessed. Patchstack saw first malicious requests at 17:44 UTC on 22 September 2026 (under five hours after WordPress 7.1.2 shipped), then ~10× traffic increase delivering payloads. Flaw: unauthenticated get_page_template() path traversal to include a chosen readable local .php outside active theme dirs; RCE needs theme top-level page-* dir plus a readable include target (e.g. pearcmd.php with register_argc_argv). WordPress/GHSA rate Critical (~9.2 CVSS 4.0 UI; NVD/CISA secondary CVSS 3.1 8.1 High). Official PHP Docker image and default cPanel on PHP <8.5 called out. Fix: 7.1.2 with backports through eligible branches to 4.7 (pre-4.6 unfixed). Distinct from click2shell/comment2shell (7.1.1). UPDATE 25 Sep 2026: CISA added CVE-2026-87902 to KEV (dateAdded 2026-09-25). Primary: WordPress 7.1.2 + GHSA; exploitation wire: BleepingComputer 23 Sep 2026; KEV: CISA.
Gambit Security Threat Intelligence (blog dated 22 September 2026; interim report) reconstructed an ongoing financially motivated campaign from an exposed staging server: three open-source AI harnesses — Strix (autonomous vuln discovery), Cairn (end-to-end exploitation until shell/admin), and Hermes (orchestration / tactical guidance) — attacked hundreds of online retailers with human operators limited to brief Chinese-language prompts. Marginal cost cited at mean ~US$25.46 across 101 completed scans (range ~US$3–US$79); OpenRouter model spend estimated ~US$12k–US$18k over the observed window. Impact Gambit accounts for includes >600,000 unexpired card records from two victims (Overwatch Data: ~79% US issuers), skimmer scripts ordered against ≥27 named shops and confirmed on 19, and in some cases agent cleanup wiping Magento payment fields or dropping staging/backup tables. Example chain: unauth SQLi → plaintext OTP MFA bypass → web shell → sudo → NFS → AWS Secrets Manager → Magento card DB. Still running as of report; Shadowserver and partners helped notify victims and take down infrastructure. Distinct from desk closedquorum-talos-20260922 (Windows LLM-quorum implant) and Talos CAIRN hunting toolkit. Primary: Gambit Security; wire: Cyber Security News 22 Sep 2026.
F5 (CVE published 22 September 2026; advisory K000162605) documents CVE-2026-94127: when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server and BIG-IP APM is configured as an OAuth Authorization Server, specific malicious traffic can lead to unauthenticated remote code execution. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization-server profiles) are not affected. Data-plane issue (no control-plane exposure); Appliance mode is also vulnerable. F5 CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 Critical. CISA added CVE-2026-94127 to KEV on 22 September 2026 (due 25 September 2026; forensic triage under BOD 26-04); known ransomware campaign use Unknown. Temporary mitigation: vendor-provided iRule, then install final vendor hotfixes. Distinct from desk cards on BIG-IP APM PoisonedRefresh / in-memory PHP webshell malware (Sophos/ESET). Primary: F5 K000162605; metadata: NVD; KEV confirmation: CISA 22 Sep 2026.
Twilio says it has not been breached: a Twilio spokesperson told The Hacker News that 'Twilio has not experienced a security incident, and our systems and customer data remain secure and uncompromised' and that 'the npm packages have been removed.' ReversingLabs (report covered 22 September 2026) details the malicious npm package tw-pkgprobe-7731 (publisher twdepprobe7731; 11 different versions published back to back on 14 August 2026; account later removed). Early versions claimed to be an “Authorized bug-bounty research probe (Twilio HackerOne program)” running only in Twilio’s serverless packager sandbox; behaviour instead fingerprints Twilio developer environments, exfiltrates host/process context and environment variables via webhook, later versions specifically target Twilio ACCOUNT_SID/AUTH_TOKEN and inject into node_modules, and some builds probe Twilio-related hosts plus AWS instance metadata. Not affiliated with Twilio; RL assesses it almost certainly violates Twilio HackerOne rules of engagement (no customer/employee data exfiltration). Package no longer present under that publisher as of RL write-up. Primary: ReversingLabs blog; wire: The Hacker News 22 Sep 2026. Correction (24 Oct 2026): an earlier version said the 11 versions were published over about 45 minutes; neither ReversingLabs nor The Hacker News gives that figure. ReversingLabs says they were published back to back on 14 August. (source: ReversingLabs)
ShinyHunters (22 September 2026) claims it breached FBI systems using an alleged Oracle PeopleSoft remote-code-execution zero-day and stole employee and applicant data. The group shared a screenshot of apply.fbijobs.gov allegedly defaced with its Umbreon logo; the jobs/special-agent portals later showed maintenance. 404 Media reports receiving a sample of agent names, home addresses, and phone numbers (including spouses) and verifying a portion against public records; TechCrunch and BleepingComputer relay the claim. BleepingComputer states it has not independently verified the alleged zero-day, lateral movement, or volume of stolen data. UPDATE 26 Sep 2026: BleepingComputer reports the FBI confirmed it is investigating the claims without confirming a breach or data theft. Separate Google Mandiant/GTIG report the same week documents renewed UNC6240 mass exploitation of already-patched CVE-2026-35273 (PeopleSoft PeopleTools PSEMHUB) with WAF-bypass encoding and SIDEEYE — desk tracks that campaign on card cve-2026-35273; unclear if the FBI claim is that CVE or a distinct flaw. Primary wire: BleepingComputer; corroboration: 404 Media / TechCrunch. Switch primary_url if FBI or Oracle publishes a confirmed notice. CORRECTION (21 Oct 2026): we removed two later updates, a 30 September update quoting ShinyHunters' statements to the media and a 6 October update saying the FBI removed an Accenture contractor, because the stories they relied on were not linked or could not be read. They will return only with readable linked sources. Correction (23 Oct 2026): removed ShinyHunters' own claims about data volume, systems reached and other targets; BleepingComputer says it has not verified them. (source: https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/)
Cisco Talos (22 September 2026), via its CAIRN AI-malware research toolkit, documents CLOSEDQUORUM: a Go-based Windows implant that after deployment queries up to four commercial LLMs (DeepSeek, Qwen, Mistral, Google Gemini), tallies votes, and executes the winning tactical action without a human operator or attacker-run C2 server. Constrained actions include steal (LSASS dump; Chrome/Edge/Firefox credentials; MetaMask/Exodus/Ethereum wallets), inject (shellcode via process hollowing or Early Bird APC), persist, and move (lateral-movement option present but handler absent in analysed build). Stolen material is forwarded via Discord webhook. Talos states it does not have confirmation of in-the-wild deployment; binary artifacts linked a developer to carding-forum activity from 2025. Talos frames this as effort displacement in AI-enabled offence and the first publicly documented Windows implant to delegate tactical C2 decisions to an LLM panel. Primary: Cisco Talos blog; wire: BleepingComputer 22 Sep 2026.
Cisco Talos — The Closed Quorum / CLOSEDQUORUM (22 Sep 2026)
Microsoft On the Issues / Digital Crimes Unit (22 September 2026) and Microsoft Threat Intelligence (“Unmasking EvilTokens”) detail disruption of EvilTokens, a phishing-as-a-service platform Microsoft tracks as Storm-2992. The service abused OAuth 2.0 device-code authentication against Microsoft’s legitimate sign-in flow (MFA-bypass style session/token theft without password capture) and centred an AI-style chatbot that analysed compromised mailboxes to pick BEC targets, impersonation paths, and fraud plays. Microsoft links >12,000 compromised inboxes across >10,000 organisations since the Feb 2026 launch; highest victim concentrations include the United States, Canada, the United Kingdom, Australia, India, and France. Partners helped seize ~50 operator sites and disable 150+ related domains; UK Metropolitan Police arrested two suspected administrators. Sold via Telegram (~US$1,500 init + US$500/month). Primary: Microsoft On the Issues; TI: aka.ms/EvilTokens-PhaaS; wire: BleepingComputer 22 Sep 2026.
Microsoft On the Issues — Disrupting EvilTokens (22 Sep 2026)
Check Point sk1000171 (approved/created 20 September 2026; last modified 22 September 2026; CVE published 22 Sep) documents CVE-2026-93616: directory traversal plus file upload lets an unauthenticated attacker upload and execute arbitrary scripts on Quantum Security Management / Multi-Domain / Log Server / Multi-Domain Log Server / SmartEvent. Check Point CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-22. Vendor states the vulnerability is exploited in the wild and a handful of customers have been attacked. Smart-1 Cloud already patched; firewall appliances / Spark not affected. LivePatch Take 28/29 does not fix this issue (no LivePatch for this fix). Distinct from desk CVE-2026-91843 (login stack overflow; same Jumbo trains also pick that up). Primary: Check Point sk1000171; metadata: CVE.report; wire: BleepingComputer 22 Sep 2026.
Check Point sk1000171 — CVE-2026-93616 Management Server path traversal (22 Sep 2026)
Arista Security Advisory 0183 (CVE published 22 September 2026) documents CVE-2026-93952 in on-premises VeloCloud Orchestrator (VCO): a remote attacker with network access to the VCO web interface and the public part of an Edge authentication certificate may reach privileged internal functionality and impact the VCO host when certificate-based Edge→VCO authentication is configured. Arista/CNA CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 9.5; Arista states the issue was discovered externally and is known to be actively exploited. Hosted/Dedicated VCO already patched. On-prem trains: 5.2.3.15 and earlier → fix 5.2.3.16+; 6.4.2.7 and earlier → fix 6.4.2.8+; 6.1.3.7 and earlier and 7.0.0.2 and earlier — no fix listed as of 22 Sep 2026 (Arista says supported-train fixes forthcoming). Distinct from July exploited VCO CVE-2026-16812. Primary: Arista SA-0183 URL; metadata: CVE.report; wire: The Hacker News 22 Sep 2026.
BleepingComputer (Sergiu Gatlan; coverage of weekend disclosure) reports security researcher Abdelhamid Naceri (MSNightmare / Nightmare Eclipse) released BigDiskBuster, a local proof-of-concept that prevents Microsoft Defender Antivirus from completing platform and security-intelligence updates while it runs. The tool watches Defender Platform/Definition Updates directories on the C: volume and starves the installer by creating a hidden delete-on-close temp file sized to remaining free space, with worker threads reclaiming capacity if files change; it may also open MRT.exe with restrictive sharing to interfere with staging. Distinct from desk cards ms-defender-shieldcrash-20260909 / CVE-2026-69414 (ShieldCrash SYSTEM file-read after ShieldBreak). No CVE assigned in the BleepingComputer write-up; Microsoft initially had not commented. PoC: github.com/MSNightmare/BigDiskBuster. Correction (24 Oct 2026): BleepingComputer's article, updated 26 September, carries a Microsoft statement that Microsoft Defender Antivirus detects BigDiskBuster and includes detection and prevention for observed activity; Microsoft did not say a CVE had been assigned and told customers to keep Defender security intelligence and platform updates current. (source: BleepingComputer) Correction (25 Oct 2026; revised 27 Oct 2026): the card date is 22 September 2026, the date BleepingComputer's report visibly shows (it describes the disclosure as happening over the weekend). A repository-creation time taken from GitHub API metadata has been removed because that page could not be read. A Cyber Security News link dated 21 September has been removed because we can no longer read that site, so its date could not be checked. (source: BleepingComputer)
BleepingComputer — New Windows Defender zero-day blocks antivirus updates (BigDiskBuster)
DriveWealth says the incident was contained on 5 September 2026 (DriveWealth notice of data breach, filed with the California Attorney General; see the DriveWealth update below). Stake, the Sydney-founded investing platform, told customers on 21 September 2026 that DriveWealth, the US broker that provides execution, custody and clearing for Stake Wall St accounts, had a cyber incident that affected some Stake customers' personal information. Stake says the information involved varies by person and may include name, email address, phone number and postal address; W-8 or W-9 tax status and country of taxation; the DriveWealth (Stake Wall St) account number; and aggregate snapshots of portfolio value, cash balance and buying power. It says Stake login credentials, tax file numbers and other government ID numbers, bank account details, identity documents, individual holdings and trading history were not accessed, that Stake's own systems were not affected, and that DriveWealth reported no unauthorised trading, transfers or withdrawals. People who opened a Stake Wall St account but no longer use it may also be affected. Stake is emailing affected customers. New Zealand's Hatch and the UK's Freetrade (for former Stake UK customers) have issued similar notices about the same DriveWealth incident. Stake has not said how many Australians are affected. Primary: Stake (21 Sep 2026); vendor: DriveWealth breach notice. Updated 25 Sep 2026 (Nine.com.au, 10:28 am Perth): Nine reported that Stake apologised to customers and said it was working with DriveWealth to understand the extent of the incident. Updated (DriveWealth notice of data breach, filed with the California Attorney General): DriveWealth's own breach notice says unauthorised access to its network took place on 4 and 5 September 2026, that it contained the compromise that day, and that its investigation and document review concluded on 28 September. Correction (26 Oct 2026): Nine.com.au's report and DriveWealth's notice, both later than Stake's 21 September statement, now carry Updated lines. (source: Stake; Nine.com.au; DriveWealth) Correction (26 Oct 2026): the card now leads with DriveWealth's statement, in its linked breach notice, that the incident was contained on 5 September 2026; no linked source gives a different date. (source: DriveWealth)
Stake — DriveWealth Data Security Incident (21 Sep 2026)
