Cyber Daily exclusive (15 September 2026) names Australian dealer-management software firm Auto-IT as the third-party IT supplier behind the recent Storm ransomware wave against Australian car dealerships and machinery suppliers. Auto-IT told Cyber Daily a small number of customer environments were affected via unauthorised use of a third-party remote monitoring and management (RMM) tool; customers were named on a dark-web listing site with claims of accessed business data. Company says the incident is contained, customer environments remain secure and fully operational, forensic specialists were engaged, and it is working with the Australian Cyber Security Centre and impacted customers. Cyber Daily links the wave (listings from about 18 August) to dealers including Westco Motors Cairns, Ramsey Bros, Penfold Motors, Sharp Motor Group, Agrimac, and Macquarrie — several of which already have desk cards noting an unnamed third-party supplier. Primary: Cyber Daily with Auto-IT quotes; related desk cards: penfold-motors-storm-20260914, macquarrie-storm-20260903. Correction (22 Oct 2026): the headline previously said Auto-IT confirmed Storm ransomware; Auto-IT's statement does not name Storm, and the Storm link is Cyber Daily's reporting. (source: https://www.cyberdaily.au/security/14188-exclusive-aussie-software-firm-auto-it-confirms-customers-compromised-by-storm-ransomware-attack)
Apple Security Engineering and Architecture (SEAR) with Camera & Photos (blog 15 September 2026) introduce Apple Reference Image, an opt-in camera mode that creates a securely timestamped reference image reflecting what the iPhone camera sensor captured, aimed at distinguishing real photographs from AI-generated or heavily altered images. Apple contrasts the approach with C2PA-style post-capture provenance metadata, arguing those chains can be compromised in editing and can create privacy risks by tying images to device or personal identity. The mode debuts on the main camera sensor of iPhone 18 Pro and iPhone 18 Pro Max, using dedicated secure hardware on device and Private Cloud Compute for verifiable algorithmic steps without Apple seeing the image content. Primary: Apple Security Research blog.
Apple Security Research — Apple Reference Image (15 Sep 2026)
Accomplish / Boundary-Bench researchers (public write-up dated 15 September 2026) disclosed two escapes from the OpenAI Codex agent sandbox, reported to OpenAI on 12 August 2026 and fixed within eight days. Overpatch (Codex CLI, open-source harness): the apply_patch tool grants write access to the parent of each path named in a patch; including a no-op path under /tmp widens the grant to /, so a crafted patch can append to ~/.zshrc (via symlink) without an approval prompt in normal agent/workspace-write mode, then run unsandboxed on the next shell. Heapjack (Codex Desktop): install writes an [mcp_servers.node_repl] block into ~/.codex/config.toml (no opt-out), spawning a Node REPL with trusted and untrusted V8 contexts sharing one heap; the trusted-context token was readable from the shared heap, enabling unsandboxed command execution even from read-only mode. Primary: Accomplish blog; no separate CVE IDs cited in the write-up. Operators running Codex CLI/Desktop should ensure they are on post-fix builds from OpenAI after mid-August 2026.
Zimperium (blog; wired by BleepingComputer 15 September 2026) documents Mantax Otax, an Android strain combining ransomware, spyware, remote control, and harassment. Distributed as sideloaded APKs off Google Play via phishing/social engineering (Indonesian operators). After install it seeks Accessibility (and device-admin in analysed samples), resolves C2 from GitHub (domain cited as apimantax[.]otax[.]fun), registers device telemetry, and takes commands over Firebase/WebSockets. Ransomware module: victim-specific AES key from C2, encrypts shared-storage files on Android 9 and older (Scoped Storage limits impact on Android 10+), deletes originals, .enc extension, ransom UI via Firebase-hosted chat. Spyware: lock-screen PIN, SMS/OTP, calls, contacts, browsing history, Google account, location, WhatsApp/Telegram via Accessibility, MediaProjection screen capture/stream, camera stills. v2 adds jumpscare overlays and remote TTS harassment. Play Protect detects current samples via App Defense Alliance partnership. Primary: Zimperium; wire: BleepingComputer.
Zimperium — Mantax Otax Indonesian mobile ransomware/spyware
Acronis security advisory SEC-10986 / update UPD-2609-3d72-20a7 (wired by BleepingComputer 15 September 2026) covers CVE-2026-87886, a high-severity Linux local privilege escalation in Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Acronis assigns severity 7.8. A low-privileged attacker can raise privileges on a vulnerable Linux host without user interaction; further exploit detail withheld while patches propagate. Acronis says exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM plugin deployments (assessment based on a single report from a potentially affected customer; no public IoCs released). Affected: cPanel & WHM plugin builds earlier than 1.9.3.1021 (fixed 1.9.3 HF3); Plesk extension builds earlier than 1.8.11.638 (fixed 1.8.11). Apply those updates immediately. Primary: Acronis SEC-10986; wire: BleepingComputer 15 Sep. UPDATE 16 September 2026: CISA added CVE-2026-87886 to KEV (same alert as Cisco ISE CVE-2026-76460). Distinct from desk card cve-2026-60004 (Gitea / Red Heron).
Developer Janis Elsts's incident notice for Admin Menu Editor Pro (published 14 September 2026, last updated 20 October) says a malicious admin-menu-editor-pro.zip was uploaded to adminmenueditor.com on 14 September 2026 and showed up as a version 2.35 update; it included a new file, includes/wp-user-consent.php, that installs a web shell. A clean 2.36 was released the same day, but later on 14 September 2.36 was also compromised; the developer says the attacker may have had root-level access to the server, which he took offline. He says anyone who installed 2.35 should treat the site as compromised and anyone who installed 2.36 as potentially compromised, particularly if downloaded after 19:00 UTC; 2.34 should be clean. He estimated that about 230 customers were affected in the initial compromise, often with multiple sites each, and identified about 300 more potentially affected customers from downloads in or near the window. Signs he lists from user reports: a new /wp-content/object-cache directory holding a hex-named web shell, wp_ocache or _wp_ocache_ options, a hidden user named wp_ followed by hex characters, hex-named MU-plugins and a _wp_cconsent_tick WP-Cron event. He advises restoring from a backup made before 14 September, or deleting the plugin and those artefacts, then changing all WordPress passwords, regenerating keys and salts and rotating other credentials stored on the site. According to BleepingComputer (15 September), Elsts said 2.35 was available from about 06:00 to 13:00 UTC, its code also created a hidden user account, the malicious build was installed on at least 1,500 sites, and the free Admin Menu Editor does not appear to be affected. Updated 25 Oct 2026: the developer says the update server has been rebuilt, downloads, licence activation and renewals are working again, and version 2.37.1 (based on the last known safe version, 2.34) adds optional checksum and signature verification for plugin updates. Primary: developer incident notice; wire: BleepingComputer. Correction (25 Oct 2026): the card now leads with the developer's incident notice, which says 2.36 was also compromised and gives about 230 customers in the initial compromise plus about 300 more potentially affected; the 06:00–13:00 UTC window, the 1,500-site count and the free-edition note are credited to BleepingComputer. (source: Admin Menu Editor Pro developer incident notice)
Admin Menu Editor Pro — Security Incident Affecting Customers 2026-09-14 (developer notice; last updated 20 Oct 2026)
Joint advisory published 15 September 2026 by the UK NCSC, US FBI, and Netherlands AIVD details Windows malware the FBI calls HEAVYGRAM and NCSC calls CHOSEN BRICK, attributed to Iran's Ministry of Intelligence and Security (MOIS). Operators build rapport on messaging apps, then deliver trojanised installers (lures include Pictory, KeePass, Telegram, RunwayML, Norton, Adobe Flash, and MRI-scan themed files), often starting on work devices before pivoting to personal ones. Malware is controlled via Telegram and can copy emails/chat messages, take screenshots, and activate the microphone; NCSC dates use from at least 2025 against people in the UK, US, Netherlands and elsewhere (FBI dates the wider campaign to autumn 2023). Victim details have appeared on pro-Iranian leak sites, raising personal-safety risk. FBI IC3 CSAs (260915 / 260915-2) expand a March 2026 alert with further TTPs and IoCs. Primary: NCSC advisory + FBI/IC3; wire: The Hacker News 15 Sep.
BleepingComputer (15 September 2026) relays Wordfence/Defiant telemetry that attackers are actively exploiting CVE-2026-27540 in the premium WooCommerce Wholesale Lead Capture WordPress plugin. Unauthenticated AJAX action wwlc_file_upload_handler accepts a user-controlled file_settings allowlist, letting attackers permit .php uploads and drop webshells (researcher: Teemu Saarentaus). Affected: versions 2.0.3.1 and older; fixed in 2.0.3.2 (released 20 February). Wordfence reports 100,000+ blocked attacks with spikes around 4–17 June, 1 July, and 30 August 2026; The Hacker News (16 September) cites CVSS 9.8 and lists recent attacker IPs (including 92.241.13.213, 31.59.129.150, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209 and IPv6 2a0f:85c1:840:5389::1). Hunt admin-ajax.php calls to wwlc_file_upload_handler, unexpected PHP under uploads (e.g. shell.php), and unknown admin accounts; upgrade to 2.0.3.2+. Primary wire: BleepingComputer; UPDATE 17 Sep: CVSS + IoCs from THN/Wordfence. Correction (26 Oct 2026): the CVE record for CVE-2026-27540, published by Patchstack as the assigning authority, scores it 9.0 under CVSS 3.1 (attack complexity high); the 9.8 shown before is the figure The Hacker News cited. (source: CVE record CVE-2026-27540)
BleepingComputer — WooCommerce Wholesale Lead Capture CVE-2026-27540 (15 Sep 2026)
In a Form 8-K filed with the US Securities and Exchange Commission on 14 September 2026 (accepted 5:15 pm US Eastern; 5:15 am 15 September Perth), Houston-based utility CenterPoint Energy said that an unauthorized third party obtained personal information relating to a portion of its customers through one of its external-facing systems; BleepingComputer reported the filing on 15 September. CenterPoint says electric and gas services were not impacted and does not expect a material business effect; it activated IR, engaged third-party experts, hardened systems, and notified law enforcement/regulators. Class-action complaints filed in US federal courts allege the incident window was about 17 August–1 September 2026. Primary: CenterPoint Form 8-K (SEC); wire: BleepingComputer. UPDATE (14 Oct 2026, US time): KPRC 2 Houston reports that a CenterPoint breach report published on the Texas Attorney General's website on Monday (12 October, US time) lists 1,062,060 Texans as affected, gives names, addresses, Social Security information and driver's licence numbers as the information involved, and indicates affected people had not yet been notified when it was submitted. A CenterPoint spokesperson told KPRC the company is still working with third-party experts to assess the scope of affected customer data and identify which customers will be notified. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General) Correction (26 Oct 2026): removed the threat actor's own claims about how many records it took and how, and its later data release; CenterPoint has not confirmed them and no outlet has independently verified them. (source: BleepingComputer) Correction (26 Oct 2026): removed every SecurityWeek credit, link and detail; the affected-Texans count, data types and notification status from the Texas Attorney General's breach database are now credited to KPRC 2 Houston (14 Oct), citing the Texas Attorney General. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General) Correction (27 Oct 2026): CenterPoint's SEC Form 8-K is now linked and the company's statements are credited to it directly rather than to BleepingComputer's account of it; the SEC accepted the filing at 5:15 pm US Eastern on 14 September 2026 (5:15 am 15 September Perth (AWST)), so the card date stays 15 September. (source: CenterPoint Energy Form 8-K, SEC)
SEC — CenterPoint Energy Form 8-K, Item 8.01 (filed 14 Sep 2026 US Eastern; 15 Sep Perth)
Lumen Black Lotus Labs (report titled “The Banana Stand…”, summarised by The Hacker News and BleepingComputer on 15 September 2026) documents BambooToken, a previously under-reported malware family active since at least February 2023, with activity seen through July 2026 against organisations in Asia and South America (mobile apps, legal/financial, software development). Operators abuse DLL sideloading via Tendyron OnKey-related binaries (OnKeyToken_KEB.dll) without evidence the vendor’s code-signing cert/build was compromised; later variants use MQTT brokers (including Cloudflare-routed paths) for C2 plugin load/stop and host control on Windows and, from late 2025, Linux. Initial access vector undetermined. Hunt for unexpected OnKey-related DLL sideloads, MQTT client beacons to unfamiliar brokers, and related IoCs in the Lumen write-up. Primary: Lumen Black Lotus Labs; wires: THN / BleepingComputer.
Lumen Black Lotus Labs — The Banana Stand / BambooToken MQTT C2
Microsoft AI published a draft “Humanist AI Code of Conduct” for MAI Models (primary: microsoft.ai/code-of-conduct; SecurityWeek 15 September 2026). Absolute Constraints block producing working exploit code, attack tooling, planning/targeting methodologies, intrusion/evasion procedures, or other assistance that would enable or improve a cyberattack — including when requests are reframed — and operators/users cannot override those limits. Defensive and lawful work remains in scope (vulnerability discovery, malware analysis, PoC exploit development/testing, educational attack material). Authority follows a Chain of Command (code of conduct → operator policies → user preferences); tool outputs, files, webpages, and other AI messages are not treated as authoritative instructions. SecurityWeek notes a dedicated review track for cybersecurity and specialised uses, and a six-week public consultation before a revised version; current MAI models are not yet trained on the draft document. Primary: Microsoft AI CoC; wire: SecurityWeek.
Microsoft AI — Humanist AI Code of Conduct (draft)
WA Cyber Security Unit advisory 20260915001 (15 September 2026, TLP:CLEAR) highlights CVE-2026-69829, a Critical remote code execution flaw in Microsoft Windows Shell with CVSS 9.8. WASOC states successful exploitation could allow an unauthenticated attacker to execute arbitrary code and potentially fully compromise affected systems. Affected products/versions are as listed by Microsoft on the MSRC update-guide entry for CVE-2026-69829 (JS-rendered; versions not mirrored here beyond vendor listing). WASOC reports no exploitation observed on Western Australian Government networks at time of writing and recommends applying Microsoft’s fixes per normal patch timeframes. Primary: Microsoft MSRC CVE-2026-69829; AU wire: WASOC 20260915001.
Microsoft MSRC — CVE-2026-69829 (Windows Shell RCE)
