Qantas is investigating a possible security breach after some Qantas Hotels customers were targeted by WhatsApp phishing messages, Australian Aviation reported on 21 September 2026. Qantas said it was investigating reports of phishing attempts targeting some Qantas Hotels customers, that anyone who receives a suspicious WhatsApp message claiming to be from a hotel should ignore it, that Qantas Hotels and its accommodation partners will never ask customers to verify a booking or provide personal details via WhatsApp, and that customers concerned about a booking should check Qantas.com or the Qantas app; it also said it never asks customers for passwords. Capella Sydney said it was aware of reports from guests who had received suspicious WhatsApp messages requesting payment and credit card details in relation to their reservations, and confirmed the messages did not come from the hotel. According to Australian Aviation, the Australian Financial Review broke the news the previous week, and neither Qantas nor Capella Sydney had any further update. No threat actor has been identified, and neither company has said how the senders knew who had a booking. The campaign follows the 2025 breach in which more than five million Qantas customers' data was compromised. Primary: Australian Aviation (21 Sep 2026). Correction (26 Oct 2026): the card date has moved from 17 to 21 September 2026, the date of Australian Aviation's report; the Financial Review report the card was first dated by is not linked. Qantas's scams page cannot be read by this desk, so details only it gave (a September 2026 entry for the campaign and its mention of countdowns and cancellation threats) have been removed, along with a description of the messages quoting hotel names and booking dates, which Australian Aviation does not give. (source: Australian Aviation)
MariaDB published advisory GHSA-m5gf-432r-g5jw, 'Insecure $HOME in MariaDB rpm packages' (CVE-2026-107814, High, CVSS 3.1 8.4, CWE-732), on 21 September 2026. MariaDB says its rpm packages created a dedicated mysql user to run mariadbd with its home directory set to the data directory, so a malicious user with FILE privilege could create dot-files in $HOME; for example a .bash_profile would run when someone does su - mysql -s /bin/bash. Deb packages are not vulnerable because the home there is /nonexistent. Affected: 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2 and 13.0.1; fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. No exploitation is reported in the advisory. Primary: MariaDB GitHub advisory. Correction (27 Oct 2026): this card covered a batch of MariaDB advisories and has been cut back to CVE-2026-107814, the one its id names. Removed: server CVE-2026-107815, CVE-2026-107818, CVE-2026-107821, CVE-2026-107823, CVE-2026-107816, CVE-2026-107822 and CVE-2026-107817; Connector/C CVE-2026-107819; Connector/Node.js CVE-2026-107384; plus the advisory-list and 11.8.9 release links. The card date has moved from 9 October to 21 September 2026, the date the advisory visibly shows. (source: MariaDB)
Patrick Wardle (Objective-See) disclosed a local zero-day against Meta’s new Muse macOS AI assistant (PoC “not-a-mused”; Ars Technica 21 Sep 2026; iTnews Australia 22 Sep 2026). An undocumented preference endo_voyager_dictation_endpoint can be changed by any local process without elevation, redirecting Muse dictation to an attacker endpoint for prompt capture/injection and theft of Muse auth material; because Muse holds broad delegated access (files, mic/camera, calendar, linked services/iPhone actions), hijacking amplifies ordinary local malware. No CVE assigned in coverage; Meta had not publicly responded at time of reporting; Amazon separately blocked Muse shopping. Local foothold required (e.g. ClickFix). Primary: Ars Technica; AU wire: iTnews; PoC: github.com/pwardle/not-a-mused.
Ars Technica — Muse Meta AI assistant 0-day (Wardle / not-a-mused)
Red Hat CVE-2026-75939 (published 21 September 2026): openshift/oc-mirror incorrectly verifies PGP release-image signatures by checking for signature errors before the entire signed body is processed, enabling a verification bypass. A remote attacker who can intercept/manipulate traffic to the signature endpoint can craft a PGP message with a valid Red Hat release key ID but a forged signature so oc-mirror accepts and mirrors a malicious release payload into a disconnected/air-gapped registry. Red Hat CVSS 3.1 7.4 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), CWE-347. Primary: Red Hat CVE page; metadata: CVE.report; wire: Cyber Security News 22 Sep 2026. UPDATE (26 Oct 2026): the CVE record (Red Hat, updated 15 October) now lists erratum RHSA-2026:79039, which fixes the oc-mirror-plugin-rhel9 container for OpenShift Container Platform 4.18. (source: CVE record CVE-2026-75939)
Red Hat — CVE-2026-75939 oc-mirror PGP verification bypass
GreyNoise (Andrew Thompson, Mark Mager; 21 September 2026) tracks a suspected Chinese-speaking malicious cyber actor (“Kapibala” tooling) that from ~20 July 2026 exploited the WordPress wp2shell chain CVE-2026-63030 and CVE-2026-60137 against ≥49 organisations in 29 countries (SMB and government). In the most serious observed intrusion against a western government victim, the actor deployed a custom webshell/plugin, created a hidden admin, harvested credentials, pivoted to an internal SQL server, and downloaded ≥18,566 records including accounts, plaintext passwords, and PII tied to law enforcement/government agencies (timeline on 22 July 2026). GreyNoise also observed the same actor targeting Zyxel GS1900 switches (996 devices / 48 countries compromised or had sensitive data exfiltrated) — related desk context: cve-2026-7273 KEV card. Distinct from wordpress-click2shell-20260918 / Comment2Shell (different flaw family). Primary: GreyNoise blog; wire: Cyber Security News 22 Sep 2026.
GreyNoise — Open Season on Kapibala / WordPress wp2shell gov theft (21 Sep 2026)
CloudSEK (Vikas Kundu; Adversary Intelligence; datePublished 21 September 2026, also dated 20 Sep on page) documents GHAPPIER, a previously unreported loader family spanning at least 65 public GitHub repositories, 73 infected files, and 22 accounts. The investigation began when an intruder used the maintainer account of legitimate npm package @dforge-core/dforge-mcp for ~105 minutes on 9 September 2026, inserted a remote loader, and abused the project’s GitHub Actions trusted-publishing workflow so malicious version 0.2.21 shipped with valid npm provenance/Sigstore attestation; it remained the latest release for ~35 minutes before the maintainer restored clean 0.2.22. CloudSEK maps wider infrastructure and links parts of the activity beside DPRK’s PolinRider campaign. Distinct from desk cards crowdsec-tanstack-source-20260917 and npm-indexed-btree-runtime-20260920. Primary: CloudSEK blog; wire: Cyber Security News 22 Sep 2026.
BleepingComputer (21 September 2026) reports BigCommerce alerted merchants after attackers compromised credentials for third-party Ribon and Ribon 1.5 applications (owned/operated by Be A Part Of, a Fastr company) and used them to inject malicious scripts into a small number of merchant storefronts. BigCommerce told BleepingComputer it confirmed the credential compromise on 17 September 2026, uninstalled the apps from affected stores to revoke attacker access, notified merchants, and is providing log data for the developer investigation; it stated BigCommerce platform systems were not breached. UK spirits retailer Master of Malt says shopper data (full names, email, phone, shipping postal addresses) in its BigCommerce environment was accessed between 13 and 17 September and that it reported to the UK ICO; it attributes access to a compromised BigCommerce application key held by Ribon. BigCommerce says account passwords and payment card data are stored separately and were not exposed in this pattern. Wire-primary pending a public Be A Part Of / Fastr advisory. Australia relevance: BigCommerce merchants and any store using Ribon-class experience apps — rotate app keys, review storefront script injections, and run NDB assessment if Australian personal information was in scope.
CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on 21 September 2026 (catalogVersion 2026.09.21; FCEB due 24 September 2026; forensic triage required under BOD 26-04). Zyxel’s security advisory (16 June 2026) documents a stack-based buffer overflow (CWE-121) in the CGI program of GS1900 series switch firmware: a LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute OS commands. NVD (Zyxel as CVSS source) scores CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NVD description cites GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0. Vendor patch table maps each GS1900 SKU from 2.90(.*).1)C0 and earlier to fixed 2.90(.*).2)C0 builds (e.g. GS1900-48HPv2 → 2.90(ABTQ.2)C0; GS1900-8 → 2.90(AAHH.2)C0). Known ransomware campaign use: Unknown per CISA. Australia relevance: GS1900 is a common SMB/managed-access switch line — patch LAN-management exposure.
Securonix Threat Research (Akshay Gaikwad, Aaron Beardslee; published 21 September 2026) details TASK#STOMP, a script-driven Windows backdoor that begins with a randomly named desktop VBScript executed via wscript.exe and stages under %LOCALAPPDATA%\WinDefendSvc. Persistence: four schtasks XML registrations with rotating OS-like names (e.g. Local Credential Manager / Network Audio Service) plus Startup-folder msdiag.vbs; fixed-date timestomp (2024-01-15 08:30:00) on core artifacts; dual hidden PowerShell branches (sys_loader.ps1 / win_conn.ps1) that mutually watchdog and compile C# helpers at runtime via csc.exe (TLS validation disabled). Payload: automated business-document harvest and live filesystem watch, Wi-Fi password and clipboard theft, screenshots, and arbitrary remote commands over two token-authenticated C2 hosts (corecloudfileshare[.]xyz / attachmentsharingdrive[.]xyz) with failover. Initial access path not confirmed (phishing/social engineering suspected). Orchestrator also opens an IranTenders Chrome page and runs purge.bat cleanup. Amplify: The Hacker News 21 September 2026. No CVE.
Microsoft Learn (Passkeys by default and retirement of Microsoft-provided SMS and voice authentication) sets Entra ID workforce tenants on a phishing-resistant path: from 1 September 2026, users still enabled for SMS or voice in Authentication Methods Policy (or legacy MFA) are auto-enabled for passkeys and nudged via Registration Campaign; from 1 February 2027 Microsoft-provided telecom SMS/voice delivery is retired for all users except Global Administrators and external users (those two populations retire 1 July 2027; internal guest users stay on the February date). Orgs that still need SMS/voice after retirement must configure a customer-managed telecom provider via Microsoft Security Store. Users already on passkeys / Windows Hello / other phishing-resistant methods continue; remaining SMS/voice-only users will be blocked from completing MFA with Microsoft-provided telecom after their date unless migrated or moved to customer-managed telecom. Australia-relevant given SIM-swap and SMS-OTP abuse history. Distinct from desk card ms-passkey-phishing-20260909 (helpdesk AiTM lures). Wire amplify: Cyber Security News 21 September 2026 (framed partly as SMS first-factor — primary here is Microsoft’s SMS/voice MFA telecom retirement + passkeys-default programme). FAQ: concept-sms-voice-retirement-faq.
Microsoft Learn — Passkeys by default; SMS/voice retirement (Entra ID)
Palo Alto Networks Unit 42 (published 21 September 2026) documents how AWS responds when long-term IAM access keys appear in public GitHub repositories via GitHub secret-scanning partner integration. In a controlled Dec 2025 exposure test, AWS attached the AWSCompromisedKeyQuarantineV3 managed policy to the affected IAM user about 10 seconds after the push (CloudTrail AttachUserPolicy), with GitHub email, AWS Health “Risk IAM quarantine” notice, AWS email, and a Support case following within a minute. Quarantine is an explicit Deny on high-risk actions (policy evolved since Aug 2020 through V2/V3 covering IAM/EC2/S3/ECS/ECR/Bedrock and more) — not key disablement or AWSDenyAll — so residual abuse of unlisted actions remains possible until operators rotate/deactivate the key. Monitoring tip: alert on AttachUserPolicy where policyArn contains AWSCompromisedKeyQuarantine{,V2,V3}; note CloudTrail may attribute the attach to the IAM user identity even though AWS automation performed it. Amplify: Cyber Security News 21 September 2026. No CVE.
Unit 42 — From Exposure to Lockdown: AWS Compromised IAM key quarantine (21 Sep 2026)
