Surfshark's 9 September 2026 incident report says unusual activity on an internal engineering test server was confirmed on 2 September 2026 after a human misconfiguration left the host reachable from the internet. The company contained the same day and finished remediation by 5 September. An unauthorised party accessed limited engineering material (parts of system binaries, internal service configurations, and some build-related credentials that had appeared in code history). Access was also gained to an isolated content-accessibility optimisation VPS used as a proxy with no user identities, IP addresses, encryption keys, or browsing traffic. Surfshark states no user data or production VPN services were affected, no customer action is required, and exposed secrets were rotated or retired. Primary: Surfshark blog incident report; wire: BleepingComputer (10 Sep 2026). Updated 10 Sep 2026 (BleepingComputer): BleepingComputer's report is dated 10 September 2026; details credited to BleepingComputer on this card come from that report.
Zimperium zLabs (9 September 2026) describes Mantax Otax, an Android strain linked to Indonesian operators that combines spyware with ransomware. Samples were distributed as sideloaded APKs on third-party file hosts via phishing and social engineering, outside Google Play. After install it seeks device-admin and Accessibility permissions, pulls C2 from GitHub, and can use Firebase or WebSockets. Spyware capabilities reported include screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, local file theft, and covert photos. On older Android versions it encrypts shared-storage files with a victim-specific AES key from C2, deletes originals, appends .enc, replaces images with ransom notices, and opens a full-screen Firebase-hosted chat for payment negotiation. Wire: BleepingComputer (10 Sep 2026). Primary: Zimperium blog.
UPDATE 23–24 Sep 2026: Check Point blog advisory and BleepingComputer confirm active exploitation of CVE-2026-85102 (pre-auth RCE in Security Gateway / Spark VPN certificate handling) beginning 12 September 2026 against Spark customers (anonymized VPN/proxy infra; observed cert subjects include CN=vpn / CN=vpn-user / CN=vpnuser under OU=users,O=global — list not exhaustive). CISA added CVE-2026-85102 to KEV on 22 Sep 2026 (due 25 Sep). Vendor disclosed + shipped fixes 9 Sep with no then-known exploitation; Dutch NCSC 12 Sep had assessed exploitation as imminent. Remediation: LivePatch Take 26 on supported R81.20/R82/R82.10 gateways, or Jumbo R81.20 Take 166 / R82 Take 126 / R82.10 Take 44 / R81.10 Take 190 or later; Spark R82.00.10 Build 2325 or R81.10.17 Build 4968+. Same advisory wave also covers Management CVE-2026-93616 (separate desk card; KEV 22 Sep). Primary: Check Point sk1000117; vendor blog 23 Sep; wire: BleepingComputer 23 Sep 2026.
Check Point sk1000117 — CVE-2026-85102 VPN certificate RCE
CERT/CC and BleepingComputer (9 September 2026) warn that Skullcandy Dime 3 earbuds (model S2DCW) on firmware 1.0.0.28 accept Bluetooth pairing from nearby unpaired devices without user interaction, PIN, or case access. Issue tracked as CVE-2025-20701 in the Airoha Bluetooth Audio SDK. Skullcandy says fixed in firmware 1.0.0.30, but end users have no supported update path via the Skullcandy app. Nearby attacker can hijack the audio link. Broader Airoha-based headset class affected per ERNW/TROOPERS research. Primary wire: BleepingComputer citing CERT/CC.
Wiz Research (Amitai Cohen & Yaara Shriki, 9 September 2026; also THN same day) scanned ~3,074 internet-facing LiteLLM AI gateways: 294 (9.6%) accepted the docs/Docker default master key sk-1234 or required no authentication (191 of those had no key at all). Default/missing master key grants admin and exposes every configured LLM provider API key (LLMjacking), and can chain to post-auth custom-code-guardrail RCE CVE-2026-59821 (fixed v1.82.0) for root-in-container when still on vulnerable builds. Same research covers MCP auth bypass CVE-2026-59822 (already on this desk; CISA KEV; Wiz honeypot exploitation). LiteLLM still ships sk-1234 as the example/default in common install paths. Mitigate: set a unique strong master key immediately; upgrade past 1.82.0/1.84.0; review custom guardrails and pass-through endpoints. Category tech (AI gateway stack). Primary: Wiz; wire: THN. Distinct card from cve-2026-59822.
US Treasury OFAC (press release sb0624) designated Xinbi Guarantee, a Chinese-language illicit marketplace supporting cyber scams, fraud, money laundering, and related crime targeting Americans, plus two supporting digital-currency entities — coordinated with DoJ Scam Center Strike Force infrastructure and wallet seizures. THN (9 September 2026) reports ~$52.8M in cryptocurrency frozen across 52 wallets and ~$12M held in two seized payment wallets; Telegram channels hosting the market dismantled. Xinbi acted as escrow between scam-center operators and vendors (pig-butchering sites, laundering, trafficking labour). Treasury notes reported use by North Korean hackers and OFAC-designated entities including Jin Bei Group and Prince Group TCO affiliates. Primary: Treasury OFAC; wire: THN.
Okta Threat Intelligence (Jeremy Kirk, Sydney; 9 September 2026): analysis of a free 7 GB Remus-style infostealer dump (5,871 machines, 162 countries, released on Telegram 2 August 2026) found thousands of unexpired authentication tokens for Google, Microsoft, Anthropic, Amazon, Gamma, Notion, Character.ai, Cursor, Poe, and Pika AI. Of 44,791 unique JWTs, 555 were likely AI-auth related; 2,937 auth-related JWEs (mostly OpenAI/NextAuth.js); 1,843 JWTs/JWEs still unexpired on release day; 17.7% of JWTs held plaintext PII. TruffleHog found 24 still-valid API keys across Gemini, OpenAI, Groq, and OpenRouter. Replay bypasses password+MFA; underground tooling includes anti-detect browsers. Recommendations: session-reuse detection, API key caps/IP allowlisting, OAuth short-lived tokens, Device-Bound Session Credentials where available. AU author; global dataset. Primary: Okta blog.
Okta Threat Intelligence — AI token replay (9 Sep 2026)
Proofpoint (9 September 2026) documents BlueMoon, chaining CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 sandbox escape; patch-gap 0-day), and CVE-2026-85880 (Windows ALPC heap overflow LPE / AppContainer escape; Microsoft September Patch Tuesday + CISA KEV). First in-the-wild use attributed to China-aligned APT31 (Proofpoint: TA412, aka JungleBamboo / Violet Typhoon) from 28 August 2026; other espionage clusters rapidly reused the kit. UPDATE 15 September 2026 desk (Volexity blog 9 Sep; THN wire 15 Sep): Volexity details two China-nexus clusters using the same byte-identical exploit chain against NGOs via spearphishing through reflected XSS on a legitimate US university site. UTA0560 deploys GRIMWEDGE (obfuscated JavaScript backdoor via MSI custom actions; C2 ocr.opusaccel[.]top). JungleBamboo/APT31 deploys SUPERSTOMP loader then LONGTALE (aka GemStone) credential-stealing Chrome extension. UPDATE 23 September 2026 desk (Volexity Part 2 blog 21 Sep; THN wire 23 Sep): third China-nexus cluster UTA0565 used the same BlueMoon chain on 3–4 Sep 2026 via multiple fake websites (chinadigitaltimes[.]top; americanprgoress[.]top typosquat of Center for American Progress) with hidden iframe loading config.html; final payload chrome_cleanup.exe is previously undocumented CLEANGULP (MSVC; control-flow flattening). CLEANGULP installs to %LOCALAPPDATA%/Microsoft/IME/MicrosoftIME.exe with scheduled task “MicrosoftIME”; commands shell/ps/upload/download/bof; C2 thecovnresation[.]com over HTTP (AES-256-GCM + custom Base64 alphabet). Targeting included Asian government entities (Hong Kong activist lure) and CAP-themed phishing. Distinct from desk cards cve-2026-85046 / cve-2026-87491 / ms-september-2026-patch-tuesday — this card is the shared kit and post-exploitation. Primary: Volexity Part 2; also Proofpoint; wire: THN 23 Sep 2026.
Volexity — Mind the (Patch) Gap, Part 2 / UTA0565 CLEANGULP (21 Sep 2026)
The Hacker News (9 September 2026) reports Alby warned of a critical flaw in self-hosted Alby Hub (Lightning bitcoin wallet) that could let an attacker take over a wallet and send funds — only where the Hub management interface was reachable from the internet. Affected: v1.7.0 through v1.18.5 (pre-August 2025 builds); fixed from v1.19.0 (first fixed release 29 August 2025); current recommended v1.24.0. Alby says one user affected so far; technical details withheld pending responsible disclosure. Guidance: remove external reachability first (e.g. bind 127.0.0.1), then upgrade; if exposed on an affected build, change unlock password after update and contact security@getalby.com. Primary wire: THN citing Alby; releases: GitHub getAlby/hub.
BleepingComputer (9 September 2026) covers Veradigm's SEC disclosure of a third-party vendor incident: an attacker obtained vendor credentials for a Veradigm customer-services API and copied patient personal details including some Social Security numbers; clinical/medical content and the broader Veradigm network were not accessed per the filing. Veradigm says a small number of customers were affected, notified law enforcement, and is offering credit monitoring where applicable. According to BleepingComputer, Veradigm's disclosure did not identify the attacker; The Gentlemen ransomware group claimed the intrusion on 5 September. Distinct from desk card sharp-office-thegentlemen-20260907 (AU Sharp Office listing). Primary: BleepingComputer (SEC filing). Updated 24 Oct 2026: the gang's claimed record count has been taken out of the headline and the unverified claimed leak deadline removed. (source: BleepingComputer) Correction (25 Oct 2026): removed the ransomware group's own claim to be holding 3.5 million patient records; no company, regulator or outlet has confirmed that figure. (source: BleepingComputer)
SecurityWeek (9 September 2026) summarises a joint NSA, CISA, and FBI warning that China-based AI companies — named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — extracted billions of tokens across millions of exchanges from US frontier models (Claude, GPT, Gemini, Grok variants) since at least late 2024, described as systematic distillation with likely Chinese government awareness. Coverage maps TTPs to MITRE ATLAS and notes additional techniques outside that framework. iTnews and BleepingComputer carried the same agency warning the same day. This is official AI guidance / strategic warning, not a product CVE. UPDATE 11–12 September 2026 (Anthropic September 2026 TI, illicit distillation section): Anthropic says that since its February disclosure it identified and disrupted additional industrial-scale illicit distillation attacks against Claude from seven labs based in China, targeting generally available models (not Mythos-class). Distillation itself is a legitimate teacher/student training method; illicit distillation here means covert, fraud-enabled capability extraction (fake accounts, stolen cards/API keys). Aligns with the US agency warning’s China-lab theme; still not a product CVE. Primary remains the agency warning; Anthropic TI is confirmatory vendor telemetry.
SecurityWeek — US agencies frontier AI distillation (9 Sep 2026)
BleepingComputer (9 September 2026) reports anonymous researcher Nightmare Eclipse released a ShieldCrash proof-of-concept against Microsoft Defender immediately after September 2026 Patch Tuesday. The researcher claims ShieldCrash bypasses the ShieldBreak elevation issue patched as CVE-2026-69414 and demonstrates arbitrary file read as SYSTEM on fully patched Windows 10, Windows 11, and Windows Server, without write access to the compromised system. ShieldBreak itself followed RoguePlanet (disclosed June, patched July). Microsoft had not commented to BleepingComputer at publish. Treat as a local privilege-escalation research drop / incomplete patch claim — not a remote wormable CVE. No Australian exploitation signal on this pass. Primary: BleepingComputer.
