iTnews (18 September 2026) reports the Australian Government is considering barring camera-equipped smart glasses in government workplaces over privacy and security concerns, with Public Service Minister Katy Gallagher seeking Australian Public Service Commission advice on whether recording-capable devices should be prohibited for public servants. Prime Minister Anthony Albanese framed the move alongside Australia's teen social-media ban and a separate roundtable with major employers (Microsoft, Commonwealth Bank, Telstra, AGL cited) on AI workplace guidelines. Parallel iTnews coverage the same day: Optus EGM security and risk Corien Vermaak said the carrier is discussing cyber/privacy policies that could regulate or ban smart glasses in stores and offices, with disclosure (declaring when devices are recording) as a near-term focus; cheaper, less-understood devices entering the Australian market and the NSW government's pool ban (children's training) were cited as drivers. Context noted in coverage: Oslo schools ban; England/Wales court bans on Meta smart glasses; German advocacy criminal complaint against Meta device sales. Not a product CVE — workplace/privacy policy signal for AU organisations. Primary: iTnews 18 Sep (gov + Optus).
iTnews — Australia considering smart-glasses ban in government buildings (18 Sep 2026)
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability. Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
BleepingComputer (18 September 2026), citing LastPass and Delphos Labs, reports an ongoing SEO/GitHub campaign that impersonates LastPass Authenticator and at least 39 other brands to deliver a previously undocumented infostealer they call Rapuncel. Victims searching for legitimate software land on fake GitHub repos; download buttons redirect to ZIP payloads (inflated up to ~148MB) containing a renamed legitimate Microsoft Visual Studio CoreCLR Debugger (vsdbg.exe) that sideloads malicious vsdbg.dll. The chain deploys Rapuncel plus Alinubx.sys, a Microsoft Hardware Compatibility Publisher-signed kernel driver (disguised as NVIDIA nvfsflt64.sys / NvFsFilter) that terminates a hardcoded list of 145 AV/EDR processes via ObOpenObjectByPointer(AccessMode=KernelMode), bypassing PPL. Rapuncel then steals credentials from 25 browsers (incl. Chrome app-bound encryption bypass via Elevation Service helper), 30 crypto wallets, Discord/Steam/Telegram sessions, Windows Credential Manager, password/seed/wallet-named documents, and screenshots; exfil to 2.26.126[.]50 over raw TCP; persists as a Windows service. LastPass/Delphos assess moderate confidence Rapuncel is a BoryptGrab variant; loader uses Cruciferra PUROSANGUE crypter. Driver not on Microsoft vulnerable-driver blocklist at time of report. Hygiene: download only from official sites; avoid promoted GitHub search results. Primary vendor write-up URL cited by BC (blog.lastpass.com …/lastpass-delphos-report-rapuncel-infostealer) returned HTTP 403 from fetchers this pass — wire used until vendor page reachable.
oss-security (18 September 2026) summarises four long-lived Linux kernel local privilege-escalation bugs nicknamed DirtyAH6 (CVE-2026-80844, xfrm/AH6 routing-header segments_left validation), PPPoEject (CVE-2026-68121, pppoe_sendmsg header pointer after dev_hard_header), TUNderflow (CVE-2026-81000, TUN/TAP oversized headroom underflow; CVSS 3.1 7.8), and DiagSpill (CVE-2026-74469, SCTP transport_count overflow; CVSS 3.1 8.8). First three LPEs generally need unprivileged user namespaces or specific capabilities; DiagSpill does not. Corruption in DirtyAH6 and DiagSpill can be remotely reachable only under very specific circumstances (oss-security). CVE records list stable-tree fixes and unaffected lines such as 5.10.269+/5.15.220+ (DirtyAH6), 5.10.270+/5.15.221+ (TUNderflow), 5.10.265+/5.15.216+ (PPPoEject/DiagSpill) among others — apply your distro’s kernel security updates rather than cherry-picking. No CVSS published yet in the CVE JSON for DirtyAH6 (CVE-2026-80844) at fetch time — do not invent. Primary: oss-security roundup; also MITRE CVE records / kernel stable commits.
Linux Kernel Out-of-Bounds Write Vulnerability. Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Linux Kernel Race Condition Vulnerability. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
The Hacker News (18 September 2026), citing OpenSourceMalware / Paul McCarty, reports a cluster of 13 npm packages delivering WeaselBiscuit, a previously undocumented JavaScript stealer. Triggered on npm import (not a full RAT): resolves C2 from an Npoint URL, profiles the host, and harvests Chrome extension storage across Windows, macOS, and Linux — financially relevant for wallet-extension state and other extension-held secrets, without the crypto-drainer / InvisibleFerret secondary-payload features of BeaverTail-class tooling. Researchers note meaningful overlap with DPRK Contagious Interview / BeaverTail tooling but state there is no definitive operator-infrastructure or victimology attribution to WaterPlum/DPRK yet — keep distinct from the ACSC WaterPlum joint advisory already on the desk. Wire-only until OpenSourceMalware primary URL confirmed; primary_url is THN for this pass. Developers: audit unexpected npm deps; revoke compromised extension sessions; align with Contagious Interview interview-tool hygiene.
ASD’s ACSC (18 September 2026) republishes a joint advisory with Japan’s NPA/NCO, US FBI and DC3, and Germany’s BND/BfV on the North Korean “WaterPlum” cyber actor group (commonly Contagious Interview). Actors pose as employers (often fake AI, cryptocurrency, or NFT companies / recruiters) to target software developers and IT professionals, then deliver loaders leading to RATs and infostealers including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle variants. Advisory cites ≥30,000 infected devices in 100+ countries and credentials/funds stolen from >7,000 cryptocurrency wallets; ~¥1.7 billion JPY (~USD 10.71M) in crypto assessed transferred to DPRK. WaterPlum actors and some DPRK IT workers assessed under the 313 General Bureau (Munitions Industry Department). Japan dismantled a domestic “laptop farm” enabler; FBI continues US facilitation prosecutions. Audience: IT professionals and organisations that outsource/crowdsource development. No CVE. Primary: ACSC advisory page (joint determination).
WordPress 7.1.1 (17 September 2026) fixes an unauthenticated stored XSS in core wpautop() that Patchstack tracks as CVE-2026-93485 (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and industry coverage dubs Comment2Shell. An anonymous visitor submits a comment with a line break inside an allowed HTML attribute; comment sanitisation (wp_kses) accepts it, then display-time reformatting turns the payload into a live event handler. When a logged-in administrator later opens the page, the script runs in their browser session and can upload a malicious plugin (web shell) — server RCE requires that admin session and a theme that renders comments in the vulnerable path (block themes / compatible classic themes). WordPress wording: exploitable “subject to comment approval”; Patchstack notes moderation is not a security control (default first-comment hold can be bypassed). No in-the-wild exploitation claimed; not on CISA KEV. Affected: WordPress 4.7 through 7.1 before the 17 Sep security builds. Fixed: 7.1.1, 7.0.5, 6.9.8, and matching backports through 4.7.36. Distinct from desk card wordpress-click2shell-20260918 (theme-preview forced install in the same 7.1.1 release). Primary: WordPress 7.1.1 release; Patchstack analysis; wire: The Hacker News 22 Sep 2026.
The crates.io team and Rust security response working group (blog.rust-lang.org; 17 September 2026) warn of an ongoing social-engineering campaign against rust-lang members and owners of popular crates aimed at compromising developer devices and accounts to publish malware. Lure: positive-sounding video calls (job / project / contract), then pressure to install a “missing audio codec” or run a clipboard-pasted command. Attackers stand up new but plausible company profiles including LinkedIn pages to pass cursory checks. Linked prior activity: similar targeting of prominent Rust developers in June 2026, and the brief August 2026 compromise of the arrayref crate via similar attacks (SecurityWeek previously tied arrayref to North Korean operators). The project notes the style is known DPRK tradecraft and has been seen outside the Rust community, without naming a specific actor for the current wave. Guidance: be suspicious of cold outreach; prefer calls on platforms you already trust (ideally self-scheduled); re-check MFA and unexpected logins; contact help@crates.io / security@rust-lang.org if concerned. Amplify: SecurityWeek 21 September 2026. No CVE.
Rust Blog — Be alert: targeted attacks on prominent Rustaceans (17 Sep 2026)
GuidePoint Security (blog 17 September 2026; Cyber Security News wire 21 September) documents a multi-month EtherHiding campaign on Polygon: at least 31 compromised legitimate websites and 15 smart contracts underpin C2 rotation so operators change backends with a low-cost chain transaction without updating earlier stages. Victims hit via Google/Bing land on injected fake-CAPTCHA ClickFix overlays (Windows+R → paste → Enter); a scheduled task named Enter retrieves next-stage scripts, Registry reboot persistence is set, and a script queries Polygon for the active control server. The backdoor later installs a fake browser extension that intercepts credentials and two-factor codes from roughly 479 financial and cryptocurrency sites. Distinct from desk card clickfix-etherhiding-bsc-20260905 (Netskope / BSC Testnet payload fetch) and from chainscript-clickfix-polygon-20260918 (Blackpoint Node.js RAT with Polygon WebSocket C2) — overlapping EtherHiding idea, different delivery/goals. Primary: GuidePoint; secondary: CSN.
Checkmarx Zero (report dated 17 September 2026; BleepingComputer amplify 20 September 2026) documents an ongoing npm malware campaign: package indexed-btree typosquats/mimics the legitimate sorted-btree B-tree library and does not use preinstall/install/postinstall lifecycle scripts. Instead a loader in BTree.prototype.set() fires at runtime when called with a specific key (key == 100), spawning obfuscated sharedLoad.min.js. Stage-1 fingerprints the host (arch, hostname, CPU/memory/uptime) and exfiltrates via hardcoded Slack and Telegram channels; C2 uses a Sepolia-testnet smart contract with X25519 ECDH → AES to decrypt a second-stage payload, plus self-clean capability. Checkmarx notes ~2 million weekly downloads and an attacker wallet holding ~109 ETH (does not claim those funds are from theft). Sidesteps npm v12 lifecycle-script approval controls that defenders may treat as a clean install signal. No CVE assigned in the primary. Developers: remove indexed-btree, pin/verify sorted-btree from the legitimate maintainer, audit lockfiles for unexpected btree deps, rotate any secrets on hosts that imported the package.
