Threat headlines · The Cyber Expert · 11 to 18 September 2026
Cyber threat headlines, week by week, translated into what your business should do.
Sam Khan has spent more than two decades assessing and defending the institutions that spend the most on security, from the Federal Reserve System to Guggenheim, and has walked the floors of banks, card issuers, health insurers and credit bureaus to see what billions actually buy. AccuSights exists to bring that standard to businesses that cannot spend billions. Every headline here ends the same way: what it means for you, which control answers it, and what to do this week.
15 verified headlines · every item links its primary source · updated as new advisories land from CISA, the FBI and the research community
Five picks from the week’s headlines. Four are tools your IT provider or your developers lean on every day, each listed as exploited before most teams had read the advisory: the Cisco email gateway that opens your mail first, the GitLab server that holds the build keys, the ScreenConnect client that fixes your laptop from across town, and an Artifactory chain built from two bugs nobody rushed because neither looked critical alone. The fifth is a phone call, not a patch: a caller from "IT" who walks an executive through registering a passkey on a page the attacker owns. The rest of the week, day by day. Tuesday: the July vCenter bug became ransomware territory, a WooCommerce wholesale form turned out to take PHP, and a Windows update broke Remote Desktop, which is a reason to roll forward, not back. Wednesday: the supply chain in miniature, with a paid WordPress plugin served from the developer’s own site with a web shell inside, a hosting-panel backup plugin used to climb to root, and a Pixel modem bug that went from targeted use to the exploited list in a day. Thursday: the second Cisco root-level zero-day in three days, this time in the ISE appliance that decides who gets on the network, and a first-hand account from the UAE cyber chief of a ransom call for more than $5 million after a company’s data was destroyed and leaked. Friday: an open-source PBX whose API key is the same on every install, abused since 9 September, and a fifth pre-login bug in the Check Point management server since July, not yet exploited, with the July one as the reason not to wait. The lesson is the same as every week: management interfaces off the internet, tokens rotated after a patch, and one sentence the front desk can repeat.
15 headlines · 5 act today · 6 act this week · 4 worth knowing
The week's headlines
Fifth pre-login hole in the Check Point management server since July, and the July one was exploited
Check Point told customers on 16 September to apply a LivePatch fix (advisory sk1000155) for CVE-2026-91843, a 9.8-rated stack overflow in the login process of its Security Management Server and Log Server that lets an unauthenticated attacker on the network run code as root; Censys says the trigger is a login request with a very long username. Affected branches are R82.10 at Jumbo Hotfix Take 44 or below, R82 at Take 126 or below, R81.20 at Take 166 or below, and R81.10 and every older R80 line, which are end of support and get no fix; Check Point later confirmed R82.20, standalone deployments, Log Servers and Multi-Domain servers are also affected, that the vulnerable path runs through the Trusted Clients setting, and that it has no indication of exploitation. Censys counted 3,836 hosts worldwide presenting the management server identity and no public proof of concept as of 16 September; by The Hacker News's count this is the fifth critical unauthenticated flaw in the management server since 22 July, when CVE-2026-16232 was exploited against customers who had management exposed to the internet without IP restrictions.
The Cyber Expert’s read. Nobody is using this one yet, and the reason to act this week is the July precedent: same product, same exposure, already being used against customers when the patch shipped. The management server is the one box that writes the firewall policy for everything behind it, so root on it is root on the network, and the good news is that the mitigation is the setting Check Point has recommended since July. If your firewall is run by a provider, the question for them is whether management is reachable only from named addresses and whether the LivePatch actually landed, because the automatic channel rolls out in stages and several customers found last week's fix had not arrived on the day.
Who this touches: Any organization with a Check Point Security Management Server, Log Server or Multi-Domain server, especially one reachable from outside the office network, and the managed providers who run them for smaller clients.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 12 Network Infrastructure Management
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 6 Access Control Management
Do this week
- Run cplp list on every management and log server and confirm the sk1000155 LivePatch shows as installed, rather than trusting the automatic-updates checkbox; anything on R81.10 or older needs an upgrade to a supported release, not a patch.
- In SmartConsole, under Manage and Settings, Permissions and Administrators, Trusted Clients, restrict management access to your named internal admin addresses and remove any entry that amounts to "anywhere"; management should never face the internet directly.
- If the server was reachable from the internet at any point this year, review the login and audit logs back to July for connections from addresses you do not recognize, and plan the move to a current branch so the next LivePatch is a formality.
Sources: Check Point sk1000155 · Check Point CheckMates notice, 16 September · The Hacker News, 17 September (updated 18 September)
Every Issabel phone system shipped with the same secret key, and attackers have been using it since 9 September
VulnCheck published an advisory on 15 September for CVE-2026-89026, rated 9.8 (CVSS v3.1) and 9.3 (v4.0), in the Issabel Framework, the web layer of the open-source Issabel PBX built on Asterisk; every installation before commit b97dbaf carries the same hard-coded HS256 signing key in the pbxapi index.php file, so anyone can mint a valid bearer token, call the /pbxapi/manager/originate endpoint with the System application parameter and have Asterisk run operating system commands as the asterisk user, with no login at all. The Issabel Foundation fixed it on 1 August by moving the key into /etc/issabel.conf and rejecting the old one, and the Shadowserver Foundation first saw exploitation on 9 September; a public proof of concept exists, and neither the attackers nor the scale of the activity have been described.
The Cyber Expert’s read. A hard-coded key is a password printed in the manual, and the manual is on GitHub. The phone system is the same story as the Switchvox item from two weeks ago: it was installed by a vendor, it has worked for years, and it has a web API on the same port as the admin page nobody visits. Small offices, call centers and clinics on a budget run Issabel because it is free, which is exactly why the fix will not arrive on its own.
Who this touches: Any organization running an Issabel PBX on premises or in a hosted VM, and the VoIP installers and managed providers who set one up and still administer it.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 12 Network Infrastructure Management
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 8 Audit Log Management
Do this week
- Update the Issabel Framework package to a build from 1 August 2026 or later, then confirm /etc/issabel.conf now holds a pbxapijwtsecret value; if the old key still works against your server, the fix is not in.
- Take the Issabel web interface and the pbxapi path off the public internet today, patched or not; put them behind the VPN or an address allow list and leave only SIP and RTP exposed, from the trunk provider addresses you actually use.
- Read the web server and Asterisk logs back to 9 September for calls to /pbxapi/manager/originate that you did not make, and check the asterisk user for new cron entries, scripts or outbound connections; if you find any, rebuild the box rather than clean it and reset every SIP and admin credential it held.
Sources: VulnCheck advisory, 15 September · Issabel Foundation patch commit, 1 August · The Hacker News, 16 September
The box that decides who gets on the network has an API that let anyone in
Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on 16 September for CVE-2026-76460, a 10.0-rated authentication bypass in an API endpoint of Identity Services Engine and ISE Passive Identity Connector releases 3.0 through 3.5; an unauthenticated remote attacker sends one crafted request, skips the web management login and lands with root-level command execution on the appliance, regardless of configuration. Cisco PSIRT says the flaw is being exploited, CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 19 September deadline for federal agencies, there is no workaround, and the fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4; release 3.0 is no longer maintained and needs an upgrade. Two days earlier Cisco had confirmed a separate root-level bug in its Secure Email Gateway, and a same-day patch bundle for ISE fixed a second 10.0 bypass (CVE-2026-76423) that is not yet reported as exploited.
The Cyber Expert’s read. ISE is the policy engine that decides which laptops, phones and printers get onto which network segment, and it holds the credentials and certificates to enforce that. An attacker sitting on it as root can rewrite the rules, harvest what it knows and wipe its own logs on the way out, which is why Cisco is telling people to check the logs on every node and to re-image rather than clean if anything looks wrong. Most small businesses do not run ISE themselves, but the managed provider or the office landlord who runs the wired and wireless network might, and the question worth asking them this week is a short one.
Who this touches: Any organization running Cisco ISE or ISE-PIC for network access control, including the managed service providers, campuses and multi-tenant buildings that run it on behalf of smaller tenants.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 12 Network Infrastructure Management
- CIS 6 Access Control Management
- CIS 8 Audit Log Management
- CIS 4 Secure Configuration of Enterprise Assets and Software
Do this week
- Upgrade every ISE and ISE-PIC node to the fixed patch for its branch this week (3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11 or 3.1 Patch 12); anything still on 3.0 needs a version upgrade, not a patch. Until then, use infrastructure access lists so only your management subnets can reach the appliance.
- Review access.log on every node for usernames you do not recognize, then cross-check firewall logs for the appliance uploading to or downloading from addresses it never spoke to before, since an attacker with root can remove the local evidence.
- If anything is suspicious, re-image the affected nodes from a fixed release and restore from a configuration backup, then rotate the admin credentials and certificates the deployment held. If your network is run by a provider, ask them in one line which ISE patch they are on and when they checked the logs.
Sources: Cisco advisory, 16 September · CISA KEV, 16 September · BleepingComputer, 17 September · SecurityWeek, 17 September
A Pixel modem bug used in targeted attacks is now on the CISA exploited list
Google's September Pixel bulletin, published 16 September, fixes 110 vulnerabilities and says CVE-2026-58704, an 8.0-rated permission bypass in the cellular modem caused by a logic error, may be under limited, targeted exploitation; an attacker on an adjacent network with basic privileges on the device can escalate with no user interaction, and CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day. The fix is the 2026-09-05 patch level for supported devices, which covers Pixel 6 through the Pixel 11 series plus the Tablet and Fold models; Google has not attributed the activity, and the bulletin also lists 12 remote code execution and 89 privilege escalation fixes rated critical or high.
The Cyber Expert’s read. Limited and targeted means somebody paid for this and aimed it, which for most businesses is a reason to update the phones this week rather than to worry. The item earns its place because company phones hold the authenticator app, the email and the bank approval, and a modem-level bug is the kind that gets used near an airport lounge rather than through a phishing link. If your mobile devices are enrolled in management, this is a one-line policy change; if they are not, it is a group message and a follow-up on Friday.
Who this touches: Any organization that issues or allows Google Pixel phones for work, and in particular firms whose executives travel or who handle client or patient data on mobile.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 1 Inventory and Control of Enterprise Assets
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 6 Access Control Management
Do this week
- Push the September 2026 update to every managed Pixel and set the compliance rule to the 2026-09-05 patch level; for unmanaged phones, ask staff to open Settings, Security and privacy, System and updates, Security update and install it.
- Check the device inventory for Pixels older than the Pixel 6, which no longer receive fixes, and move any that hold company email or an authenticator to a supported model.
- Require a current patch level before a phone can reach email or the identity provider, so an unpatched device loses access rather than keeping it quietly.
Sources: Google Pixel bulletin, September 2026 · CISA KEV, 16 September · BleepingComputer, 16 September
A WordPress plugin update arrived from the real vendor site, and it carried a web shell
On 14 September an attacker with what looks like root access to adminmenueditor.com uploaded a poisoned version 2.35 of Admin Menu Editor Pro, the paid edition of a menu-management plugin whose free version runs on more than 300,000 WordPress sites; the update added a file named includes/wp-user-consent.php that installs a web shell and creates a hidden user whose name starts with wp_. Developer Janis Elsts says the malicious build was live from roughly 06:00 to 13:00 UTC, that a clean 2.36 pushed at 19:00 UTC was tampered with as well, and that server logs show at least 230 customers installed it across roughly 1,500 sites, with several hundred more customers downloading in the window; version 2.34 is believed clean and the site has been taken offline while it is rebuilt.
The Cyber Expert’s read. This is the update you are supposed to install: signed by nobody, served from the vendor's own domain, and it did exactly what every security guide tells you to do with plugin updates. The lesson is not to stop updating. It is that a premium plugin from a one-person shop is a supplier, and a supplier who gets rooted becomes your incident within hours. The indicators are short and specific, so run them today, and if you find one, the answer is the backup from before Sunday rather than a manual clean.
Who this touches: Any business or agency running Admin Menu Editor Pro on a WordPress site, and more broadly anyone whose website depends on paid plugins bought outside the WordPress.org directory.
Strengthen
- CIS 2 Inventory and Control of Software Assets
- CIS 15 Service Provider Management
- CIS 11 Data Recovery
- CIS 5 Account Management
- CIS 8 Audit Log Management
Do this week
- On every site with Admin Menu Editor Pro, check for includes/wp-user-consent.php in the plugin folder, a /wp-content/object-cache/ directory, any wp_users row whose login begins with wp_, and wp_options rows named wp_ocache followed by anything; the free plugin and version 2.34 are not affected.
- If any indicator is present, restore the site from a backup taken before 14 September and rotate the WordPress, database, SFTP and hosting-panel passwords; if no backup exists, delete the plugin, the object-cache folder and the database rows, then treat the site as untrusted until a fresh scan is clean.
- Write down every paid plugin and theme on every site you own or maintain, with where it came from and who would tell you if it were compromised. That list is the supplier inventory, and this week it would have saved a few hours.
Sources: BleepingComputer, 15 September · Developer incident notice, 14 September
The backup plugin on the hosting server is the one being used to climb to root
Acronis confirmed on 15 September that CVE-2026-87886, a 7.8-rated local privilege escalation caused by insecure file permissions in its Backup plugin for cPanel and WHM, has been exploited in limited, targeted attacks; the flaw also exists in the Backup extension for Plesk, where no exploitation has been seen. Fixed builds are 1.9.3.1021 (plugin 1.9.3 HF3) for cPanel and WHM and 1.8.11.638 for Plesk, an attacker needs an existing low-privilege account on the Linux server and no user interaction, and Acronis told BleepingComputer the exploitation assessment rests on a single report from a potentially affected customer, with no indicators of compromise published yet.
The Cyber Expert’s read. A local privilege escalation sounds like the boring end of the vulnerability spectrum until you remember what a cPanel server is: a box where every hosting customer already has a low-privilege login, which is exactly the starting point this bug needs. The web host applies this patch, not you, so the useful question for a business is whether your host has, and whether the shared server your site sits on is the kind where a neighbour's account becomes root. The same plugin is also the thing that writes your backups, which is a reason to keep a copy somewhere the hosting panel cannot reach.
Who this touches: Web hosting companies and IT providers running cPanel, WHM or Plesk on Linux with the Acronis backup integration, and every small business whose website lives on one of those servers.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 11 Data Recovery
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 15 Service Provider Management
- CIS 8 Audit Log Management
Do this week
- If you run the servers, update the Acronis Backup plugin for cPanel and WHM to build 1.9.3.1021 or later and the Plesk extension to 1.8.11.638 or later today; if you rent hosting, send your provider one line asking which build they are on.
- Review the hosting server for new or changed root-level cron jobs, SSH keys and accounts since the start of September, since Acronis has not published indicators and a successful exploit leaves the attacker as root.
- Keep a tested copy of the website and database outside the hosting account, on storage the control panel and its plugins cannot write to; a backup tool that runs as root is not the only place the backup should live.
Sources: Acronis advisory SEC-10986 · BleepingComputer, 15 September · SecurityWeek, 16 September
The vCenter bug from July is now a ransomware bug, says CISA
CISA updated its Known Exploited Vulnerabilities entry for CVE-2026-59310 over the weekend of 12 to 13 September to mark it as used in ransomware campaigns; the flaw is a 9.8-rated directory traversal in the vCenter Server syslog service that lets an unauthenticated attacker run code on the server, patched by Broadcom on 29 July under VMSA-2026-0006 and added to the catalog on 18 August with a three-day federal deadline. Incident responders at QUIRSO had already counted 361 compromised addresses across 47 countries in mid-August, when the exploitation was a reverse SSH tool for persistence, and Shadowserver still sees more than 450 vCenter servers reachable from the internet; CISA has not named the ransomware groups involved.
The Cyber Expert’s read. A vCenter server is the keyring for every virtual machine in the building, so an attacker who lands on it does not need to break into your file server, your domain controller or your backups one at a time. Six weeks is a long time for a patch to sit unapplied on a box that should never have been reachable from the internet in the first place. If yours was exposed and unpatched at any point since 29 July, the honest assumption is that someone has already looked in, and the useful question is whether your offline backup would survive them acting on it.
Who this touches: Any organization running VMware vCenter on premises, which includes most small and mid-sized businesses with a server room, and the managed service providers who host it for them.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 11 Data Recovery
- CIS 12 Network Infrastructure Management
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 8 Audit Log Management
Do this week
- Confirm every vCenter instance is on a build that fixes VMSA-2026-0006, and check the syslog service logs and outbound connections for the period since 29 July before you call it clean.
- Take vCenter and ESXi management interfaces off the public internet today; reach them through the VPN or a jump host only, and restrict the syslog port to the hosts that are supposed to talk to it.
- Restore one virtual machine from your offline or immutable backup this week and time it; if the backup lives on storage that vCenter can reach, it is not offline.
Sources: BleepingComputer, 15 September · CISA KEV, 18 August · Broadcom VMSA-2026-0006 FAQ
A wholesale sign-up form that accepts PHP is a sign-up form for the attacker
Wordfence reported on 15 September that its firewall has blocked more than 100,000 attempts to exploit CVE-2026-27540, a 9.8-rated unauthenticated file upload in the WooCommerce Wholesale Lead Capture premium plugin by Rymera, with activity spiking between 4 and 17 June, on 1 July and on 30 August. The plugin exposes an admin-ajax action named wwlc_file_upload_handler that checks uploads against an allow-list supplied in the request itself, so the attacker adds php to the list and uploads a web shell; versions 2.0.3.1 and earlier are affected, the fix shipped in 2.0.3.2 on 20 February, and the plugin has roughly 6,000 active installations.
The Cyber Expert’s read. Nobody buys this plugin for its security; they buy it because a wholesale customer needs an application form, and the form has quietly been a file drop for seven months. The lesson is the same one WordPress teaches every month: a paid plugin with a small install base gets less scrutiny, not more, and the site owner is the patch team. Check the uploads folder before you check the plugin version, because the version tells you whether you were exposed and the folder tells you whether it mattered.
Who this touches: Any business running a WooCommerce store with a wholesale or trade-customer sign-up, and the agencies that maintain WordPress sites for clients.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 2 Inventory and Control of Software Assets
- CIS 8 Audit Log Management
- CIS 11 Data Recovery
- CIS 16 Application Software Security
Do this week
- Bring WooCommerce Wholesale Lead Capture to 2.0.3.2 or later today, or remove it if the wholesale form is no longer in use; a deactivated plugin still ships its code.
- Search wp-content/uploads and its subfolders for .php files created since June, review web server logs for POST requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, and remove any administrator account you did not create.
- If you find a shell, restore the site from a backup taken before the first request rather than cleaning by hand, then rotate every WordPress, database and hosting credential.
Sources: Wordfence, 15 September · BleepingComputer, 15 September · Rapid7 vulnerability record
The September Windows update broke Remote Desktop. Do not roll it back, roll forward.
Microsoft released out-of-band updates on 14 September after the 8 September security updates made Remote Desktop Services unstable on affected systems, with RDP connection and sign-in failures, unresponsive servers, and knock-on problems in Management Console, File Explorer and the Windows Update page. The fixes are KB5129235 for Windows Server 2025, KB5129237 for Server 2022, KB5129238 for Server 2019, KB5129195 for Windows 11 24H2 and 25H2, KB5129194 for 11 26H1 and KB5129236 for Windows 10 21H2 and 22H2; the server builds come from the Microsoft Update Catalog rather than Windows Update, and some USB Audio Class 1.0 device failures from the same update are still open.
The Cyber Expert’s read. Administrators who could not get staff onto the terminal server found that uninstalling the September update fixed the problem, and it did, along with removing the two exploited privilege-escalation fixes and 972 others from that same release. The right move is the out-of-band update, applied from the catalog, with the Group Policy workaround as the bridge until it is on. A broken patch is a scheduling problem; a missing patch is an exposure, and the two are not the same size.
Who this touches: Any organization that runs Remote Desktop Services or a terminal server for staff, hosted desktops for remote workers, or Windows Server 2019 and later in general.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 11 Data Recovery
Do this week
- Apply the September out-of-band update for each Windows Server version from the Microsoft Update Catalog this week, testing on one RDS host before the rest.
- If anyone uninstalled the 8 September update to restore Remote Desktop, reinstall it together with the out-of-band fix; the exploited CVE-2026-81963 and CVE-2026-85880 fixes are in the package that was removed.
- Keep a pilot ring of one server and a handful of workstations that take Patch Tuesday first, so the next breaking update shows up in the pilot rather than on the terminal server everyone uses.
Sources: BleepingComputer, 14 September · Microsoft KB5129237 (Server 2022)
An email arrives, the mail filter reads it, and the attacker is root on the filter
Cisco published advisory cisco-sa-esa-inj-2bLVGmhX on 14 September for CVE-2026-76461, a 9.8-rated SQL injection in the email parsing of AsyncOS for Secure Email Gateway that lets an unauthenticated remote attacker run commands as root by sending a crafted message through the appliance; the flaw was found during a TAC support case and Cisco PSIRT confirms it has been exploited in September. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Fixed releases are 15.5.5-0141, 16.0.4-3021 and 16.5.0-780 (Cisco recommends 16.5.0-780), there is no workaround, every physical and virtual Secure Email Gateway is affected regardless of configuration, and Cisco says it has already upgraded all Secure Email Cloud devices and contacted the cloud customers where it found indicators of compromise.
The Cyber Expert’s read. The email gateway is built to open every message before anyone else does, so a bug in its parser is a bug anyone on the internet can reach with a single send. The check Cisco gives is short: grep the mail_logs for a COPY statement that ends in TO PROGRAM. Because the attacker lands as root, treat a clean log as a hint rather than a verdict and read your firewall logs for the appliance talking to places it never did before. If the box is virtual and you have any doubt, Cisco's advice is to rebuild it from a fixed image and renew every certificate and credential it held, and that is the advice we would give too.
Who this touches: Any organization that runs a Cisco Secure Email Gateway (formerly IronPort or ESA) on premises or as a virtual appliance, and the managed providers who operate them for clients.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 9 Email and Web Browser Protections
- CIS 12 Network Infrastructure Management
- CIS 8 Audit Log Management
- CIS 3 Data Protection
Do this week
- Upgrade every Secure Email Gateway to 16.5.0-780 (or the fixed build for your branch) this week; there is no workaround, so the patch is the whole plan.
- Run grep -i "COPY.*TO PROGRAM" against mail_logs on every appliance and cluster member, then check firewall logs for unexpected outbound connections from the gateway.
- If anything looks wrong on a virtual appliance, preserve the logs, deploy a fresh fixed image, rebuild the configuration and rotate certificates and admin credentials; on a physical unit open a TAC case. Keep the management interface off the internet and turn DLP rules back on after the rebuild so outbound mail policy survives the change.
Sources: Cisco advisory, 14 September · CISA KEV, 14 September
Two 9.8s in the Check Point VPN, no exploitation yet, and a national CERT saying do not wait
Check Point published fixes on 9 September for CVE-2026-85102, an improper validation of certificate data during VPN negotiation, and CVE-2026-85103, a heap overflow in the VPN certificate ASN.1 decoder, both rated 9.8 and both usable without credentials for remote code execution on Security Gateways, with 85103 also reaching Security Management Servers; affected lines include R81.20, R82 and R82.10 plus Spark firewalls, and R82.20 is not affected. The company found both bugs internally and reports no exploitation, but on 12 September the Dutch national cyber security centre assessed the likelihood and impact of exploitation as high and said it expects attempts soon; fixes arrive through LivePatch Take 24 or Jumbo Hotfix Takes 44 (R82.10), 126 (R82) and 166 (R81.20).
The Cyber Expert’s read. This one is not on the exploited list, and we are publishing it anyway because the pattern this year is that a pre-authentication bug in a VPN gateway gets used within days of a patch, and the Dutch agency is saying the same thing out loud. The gateway is the one device you cannot take off the internet, which is why it gets patched first. If you run site-to-site VPN, Check Point has given you a second lever that costs nothing: turn off the implied VPN rules and allow UDP 500 and 4500 only from the peer addresses you actually have.
Who this touches: Any organization with a Check Point Quantum Security Gateway or Spark firewall terminating remote-access or site-to-site VPN, and the managed providers who run them.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 12 Network Infrastructure Management
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 13 Network Monitoring and Defense
Do this week
- Confirm LivePatch has applied Take 24 on R81.20, R82 and R82.10, or install the Jumbo Hotfix for your branch; locally managed Spark units do not get the LivePatch mitigation and need the hotfix.
- For site-to-site VPN, disable implied rules and write explicit rules for UDP 500 and UDP 4500 from named peer IPs only.
- Watch the gateway logs for VPN negotiations from addresses that are not your peers or your remote-access users over the next two weeks, and plan the move to R82.20 rather than another hotfix cycle.
Sources: SecurityWeek, 11 September · Dutch NCSC alert, 12 September · Check Point sk1000117
One request, no login, and the GitLab server hands over its secrets file by file
GitLab shipped patch releases 19.1.8, 19.2.6 and 19.3.2 on 10 September for CVE-2026-85706, a 10.0-rated path traversal in the repository commits API that lets an unauthenticated user read arbitrary files from a self-managed Community or Enterprise Edition server, exposing SSH keys, database credentials, deploy tokens and CI/CD variables; all versions from 18.7 onward are affected and GitLab.com and GitLab Dedicated were already patched. watchTowr saw in-the-wild probes on 11 September, one day after disclosure, and CISA added the CVE to the KEV catalog that day with a 14 September deadline for federal agencies. The same release fixes 17 other bugs, including a 9.9-rated deserialization flaw (CVE-2026-87719) that is not yet known to be exploited.
The Cyber Expert’s read. A source-code server holds more than source code. It holds the keys to the build pipeline, and whatever leaves the pipeline is trusted by every server downstream, which is why a read-only bug here is not a read-only problem. The hunt is simple: look in the access logs for POST requests to /api/v4/projects/<id>/repository/commits/ that carry a file.path parameter. If you find one, assume the tokens on that box are already in circulation and rotate them, because patching the server does not un-read the file.
Who this touches: Software teams and any business running a self-managed GitLab instance, plus the software vendors and contractors who build for you on theirs.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 16 Application Software Security
- CIS 5 Account Management
- CIS 8 Audit Log Management
- CIS 12 Network Infrastructure Management
Do this week
- Upgrade self-managed GitLab to 19.1.8, 19.2.6 or 19.3.2 now; single-node installs will have a short outage while the database migrations run, so schedule it today rather than next sprint.
- Search the access logs for POST /api/v4/projects/*/repository/commits/ with file.path in the body or query; a hit means the server's secrets should be treated as exposed.
- Rotate deploy tokens, CI/CD variables, database credentials and SSH host keys on any instance that was internet-facing before the patch, and put the instance behind a VPN or identity-aware proxy so the API is not reachable by strangers again.
Sources: Rapid7 ETR, 14 September · SecurityWeek, 11 September · GitLab patch release 19.3.2
The remote-support tool that lets a session copy files to the next machine without asking
ConnectWise released ScreenConnect 26.6.5 to fix CVE-2026-84869, a 9.9-rated missing-authorization flaw in the ScreenConnect client that allows files to be transferred and executed through an active remote session without the host confirming; CISA added it to the KEV catalog on 11 September with a 14 September federal deadline. Huntress traced the exploitation to incidents going back to 20 August in which a caller posing as tech support talked a victim into opening Quick Assist, then a modified ScreenConnect client ran a chain of four VBScript files that surveyed the machine, hid a second ScreenConnect client, set a Run key for persistence and pushed the same four scripts to every newly connected endpoint, which is why Huntress describes the behaviour as worm-like. ConnectWise says the server is not affected and that disabling the TransferFiles permission is the interim mitigation.
The Cyber Expert’s read. ScreenConnect is what a lot of IT providers use to fix your laptop from the other side of town, so a rogue copy of it looks like Tuesday to most monitoring. The story here has two halves: a real bug, and a phone call that got the first foothold, and the patch only closes one of them. Update the clients, then look for ScreenConnect instances your provider did not install, and tell the front desk that nobody from IT will ever ring and ask them to open Quick Assist.
Who this touches: Any business whose IT provider supports it with ScreenConnect, and the providers themselves; the phone-call opener applies to everyone with a Windows fleet.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 2 Inventory and Control of Software Assets
- CIS 14 Security Awareness and Skills Training
- CIS 10 Malware Defenses
- CIS 6 Access Control Management
Do this week
- Ask your provider to confirm every ScreenConnect client and server is on 26.6.5 or later; until then have them disable the TransferFiles permission on hosts that do not need it.
- Inventory ScreenConnect installs across the fleet and remove any that point at a relay your provider does not own; check for a user Run key launching a .vbs file and for wscript.exe spawned by a ScreenConnect client.
- Restrict Quick Assist and other remote-help tools by policy to sessions your help desk starts, and put one line in the next staff note: IT will never call you and ask you to open a support tool.
Sources: Huntress, rogue ScreenConnect installations · SecurityWeek, 14 September · CISA KEV, 11 September
Two medium-rated bugs, one after the other, turned an anonymous request into an Artifactory admin
Wiz Research reported on 10 September that between 15 August and 8 September several actors chained CVE-2026-42018 (7.5, an internal anonymous-user token returned to an unauthenticated caller even with anonymous access off) and CVE-2026-42016 (8.1, a token whose scope is not enforced and can be exchanged for admin authority) against self-hosted JFrog Artifactory, creating persistent admin accounts in under five minutes, installing Groovy plugins for code execution and dropping a Rust backdoor; CISA added both to the KEV catalog on 11 September with a 25 September federal deadline. The chain is separate from the 9.8-rated CVE-2026-82329 we covered on 3 September, and Wiz found 59 percent of Artifactory customers still exposed to CVE-2026-42016 six weeks after its 27 July fix, against 49 percent for the critical one two weeks in. Fixed versions are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20.
The Cyber Expert’s read. This is the pattern to remember: two bugs nobody rushed because neither was rated critical on its own, and together they are a critical. The tell in the logs is identity mismatch, an anonymous or low-privilege token minting new tokens at /access/api/v1/tokens, enumerating users, or touching the plugins API. Patch the branch, then read the admin list for names like svc_ followed by eight random characters, jfrog-distribution, repo-service or ldap_admin that your team did not create, and revoke every token issued since 15 August.
Who this touches: Software teams and product companies with a self-managed Artifactory, especially one reachable from the internet, and the vendors who build software for you.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 5 Account Management
- CIS 6 Access Control Management
- CIS 8 Audit Log Management
- CIS 16 Application Software Security
Do this week
- Upgrade to a fixed Artifactory build this week even if you already patched CVE-2026-82329, because the two chained CVEs have their own fix thresholds (42016 needs 7.133.11 or later on that branch).
- Review admin users and tokens for anything created since 15 August, delete what you did not make, and revoke and reissue access tokens; in the access log look for POST /access/api/v1/aws/token/ returning 200 followed by a token mint from the anonymous identity.
- Block the Wiz IOC addresses at the edge, check /tmp, /dev/shm and /var/tmp on the Artifactory host for binaries you did not put there, and move the instance behind your VPN or identity proxy.
Sources: Wiz Research, 10 September · The Hacker News, 12 September · CISA KEV, 11 September
The caller says they are from IT, the page says register your passkey, and the mailbox is gone by lunch
Arctic Wolf published details on 7 September of a data theft and extortion cluster it tracks as PREY-0058 that phones directors, vice presidents and other executives while posing as the internal help desk, sends them to a domain shaped like yourcompany.passkey-mfa[.]com or yourcompany.registermymfa[.]com, and captures the Microsoft 365 password, the MFA approval and the resulting session token through an adversary-in-the-middle login page. The token is then replayed from residential proxies in the victim's own city and network range, the actor searches SharePoint and Entra ID, and bulk-downloads SharePoint, OneDrive, Exchange and Box before sending the extortion note; there is no malware and no lateral movement on the network. Arctic Wolf found hundreds of impersonated companies across the lure subdomains, with US targets concentrated in construction and engineering, healthcare and pharmaceuticals, real estate, finance and professional services, and it notes the tradecraft overlaps with the group Mandiant calls UNC6671.
The Cyber Expert’s read. Nothing here is broken. Every control did what it was told, which is the point: the password was right, the MFA prompt was approved, and the sign-in came from a nearby address. The lure domains all sell the same story, that IT needs you to register a passkey today, so the defence is partly a sentence your staff can repeat: IT will never call and ask you to sign in somewhere. The rest is configuration. Sign-ins from managed devices only, phishing-resistant MFA for anyone who can approve a payment, and a SharePoint search scoped so one stolen session cannot read the whole company.
Who this touches: Any US business on Microsoft 365 with executives who take phone calls, with construction, engineering, healthcare, real estate, finance and professional services named as the current focus.
Strengthen
- CIS 6 Access Control Management
- CIS 14 Security Awareness and Skills Training
- CIS 3 Data Protection
- CIS 8 Audit Log Management
- CIS 5 Account Management
Do this week
- Turn on Conditional Access that requires a compliant or hybrid-joined device for Microsoft 365, and move executives, finance and admins to phishing-resistant MFA (passkeys or hardware keys) issued in person, not through a link.
- Alert on sign-ins to My Signins, My Profile or My Apps from unfamiliar devices, on SharePoint SearchQueryPerformed bursts using contentclass:STS_Site, and on mass download events; block the Arctic Wolf lure domains and any newly registered domain containing passkey, mfa or sso.
- Brief the help desk and the executive assistants this week: the company will never phone a user to walk them through an MFA change, and any such call is reported, not followed. Apply DLP rules that stop bulk external sharing from SharePoint and OneDrive so a replayed session cannot empty the tenant quietly.
Sources: Arctic Wolf, PREY-0058 alert pack · The Hacker News, 7 September
The threat rundown, daily or weekly
The three minutes that keep you ahead of the bad guy.
Only the threats that apply to your business, with the control that answers each and what to do about it. Written by people who have done this for banks, read by owners who would rather be running the company. US regulatory context included.
How these are written
Each story is checked against its primary source before it appears here, and the verification notes for every edition are kept on file. Control names follow the CIS Critical Security Controls v8.1. The actions are the ones our engineers would run in your environment, in the order they would run them. For Protect clients, our team has already applied the relevant items before you read this.