7 verified findings from 1 run · 3 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01A stack overflow in Check Point's unauthenticated management login reaches root. Patch or restrict management access now. CVE-2026-91843 (CVSS 9.8) is a stack overflow in the unauthenticated login process to Check Point Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server; an attacker who reaches the login interface can execute arbitrary code as root without credentials, and Check Point's attack indicator is a failed login for an over-long username. No source reports observed exploitation as of 2026-09-17; Check Point ships the fix as a LivePatch and in Jumbo Hotfix takes. →
02Brevo's own integrity checks never saw the tampering because the attacker rewrote pages at Cloudflare's edge, not on Brevo's servers. Brevo (CRM/email platform, formerly Sendinblue) confirmed a stolen long-lived Cloudflare API key let an attacker deploy a malicious edge Worker that rewrote Brevo's own pages and three customer-embedded widget scripts for roughly 5.5 hours on 2026-09-14, serving a ClickFix clipboard-paste lure and a WordPress administrator-backdoor plugin without modifying any origin file. Sansec says Brevo served malware to visitors of more than 100,000 customer sites, a figure it links to a public source-code search for pages mentioning Brevo's domains. BleepingComputer reports the same research as up to 100,000 sites using the affected components. →
03Kaspersky: a single compromised torrent-file repository silently poisoned magnet-link resolutions across many unrelated tracker sites. Kaspersky documents MovieReaper, a previously undocumented Windows crimeware framework active since October 2025 and distributed through a supply-chain compromise of itorrents.org, a shared public torrent-file repository. The malware resolves its second-stage C2 address via a Solana blockchain dead-drop, and Kaspersky counts several hundred victims across Europe, Asia, Africa and Latin America, with government among the targeted sectors. →
Brevo (CRM/email-marketing platform, formerly Sendinblue) confirmed in a 2026-09-17 post-mortem that an attacker used a long-lived Cloudflare API key with full account permissions, hardcoded in Brevo's application source code, to create a malicious Cloudflare Worker on Brevo's own account, first misused as early as late August 2026 (Brevo, 2026-09-17). Brevo's own stated impact window ran 15:01 to 20:30 UTC on 2026-09-14 (5 hours 29 minutes), during which the Worker rewrote HTTP responses at the CDN edge on brevo.com and related domains, stripping security headers such as Content-Security-Policy; from 16:07 UTC the Worker additionally appended a malicious loader to three JavaScript files, the Brevo forms script, the Conversations widget and the SDK loader, that customers embed directly on their own sites, and extended the tampering to sibforms.com (Brevo, 2026-09-17). Because the edge rewrite never touched an origin file, Brevo's own standard integrity checks did not detect the change (Brevo, 2026-09-17). Visitors saw a fake Cloudflare human-verification page instructing them to press Win+R, paste and press Enter, a ClickFix lure that ran an attacker-supplied clipboard command to download Windows malware (Brevo, 2026-09-17), and did not activate for crawlers, developers or automated scanners (Sansec, 2026-09-16). On WordPress sites embedding an affected widget, a logged-in administrator's browser was used to attempt the install of a plugin impersonating "Web Media Optimizer" that hides itself from the plugin list, persists via the must-use-plugins directory, beacons to an attacker server for a Base64-encoded next-stage JavaScript URL, caches the last-valid URL as a fallback, and carries a hardcoded authentication key that lets the attacker generate a valid WordPress-administrator login session without the account password (BleepingComputer, 2026-09-17). Before Brevo's confirmation, Sansec named a breach of Brevo's Cloudflare account as the possible root cause, citing hints such as modified assets that kept the same Last-Modified dates before, during and after the incident. It also found that a certificate for an attacker-created host under a Brevo-owned domain was issued on 2026-08-25, which it says shows the attacker had write access to Brevo's DNS records (Sansec, 2026-09-16). Sansec states that Brevo "served malware to visitors of its own site and more than 100 thousand customer sites", linking the figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). BleepingComputer reports the same research as up to 100,000 websites that use the affected Brevo components (BleepingComputer, 2026-09-17), so the two outlets frame the figure differently, as a floor and as a ceiling. Brevo's post-mortem does not mention a separate SSO-related incident (Brevo, 2026-09-17). BleepingComputer reports that Brevo disclosed that incident on 2026-09-10, that attackers hijacked customer accounts and launched phishing that reached Trezor customers, and that Brevo did not respond to its question about whether the two incidents were connected (BleepingComputer, 2026-09-17).
Triage: a legitimate Brevo or Sendinblue widget script served from its normal CDN path is expected, so the discriminator is behavioral, not path-based. A fake human-verification overlay instructing a clipboard-paste-and-run action is never legitimate CDN content. On WordPress, the compromise signs Sansec gives are a plugin installed or activated on 14 September, a plugin on disk that the admin screen does not list, and an access-log POST to /wp-admin/update.php?action=upload-plugin that day followed shortly by a plugin activation request (Sansec, 2026-09-16). BleepingComputer names the known backdoor plugin "Web Media Optimizer" (BleepingComputer, 2026-09-17).
A long-lived Cloudflare API key with full account permissions was stored in application source code and was obtained by the attacker. With it, they could create Workers, routes and DNS records on Brevo's zones without triggering an alert.
Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.
The plugin also stores a backup copy of the last valid JavaScript URL so it can continue loading malicious code if the remote server becomes unavailable.
the plugin contains a hardcoded authentication key that allows attackers to generate a valid login session for a WordPress administrator account without knowing the account password.
Sansec's count is a floor, not a ceiling. Its write-up states that on 14 September "Brevo served malware to visitors of its own site and more than 100 thousand customer sites", linking that figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). The figure was previously described as an upper bound of up to 100,000 sites, which understates the reach Sansec reported.
The compromise checks Sansec gives for WordPress sites are a plugin installed or activated on 14 September and a plugin on disk that the admin screen does not list (Sansec, 2026-09-16), and BleepingComputer names the backdoor plugin "Web Media Optimizer" (BleepingComputer, 2026-09-17).
Sansec states that Brevo served malware to visitors of more than 100,000 customer sites and links the figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). BleepingComputer reports it as up to 100,000 websites that use the affected Brevo components (BleepingComputer, 2026-09-17). Sansec presents the Cloudflare-account breach as a possible root cause supported by hints, not as a confirmed finding (Sansec, 2026-09-16).
Kaspersky documents MovieReaper, a previously undocumented modular Windows crimeware framework active since at least October 2025, distributed through a supply-chain compromise of itorrents.org, a shared public repository many independent torrent trackers rely on to resolve magnet links. The actor modified that repository instead of compromising the trackers, which lets it reach users of many trackers without compromising each platform individually (Kaspersky Securelist, 2026-09-17). Kaspersky reports several hundred victims, individuals and organizations, with infection attempts in Russia, Spain, Germany, Finland, Türkiye, Japan, Nepal, Kenya, Tanzania, Ghana, Uganda, Colombia, the Netherlands, Belgium and other countries across Europe, Asia, Africa and Latin America, and targeted organizations spanning enterprise, government, IT, consulting, retail, transportation and agriculture (Kaspersky Securelist, 2026-09-17). After a user manually runs a first-stage loader disguised under a film-referencing filename, the loader resolves Windows API addresses by manually walking the PEB's loaded-module list rather than calling LoadLibrary or GetProcAddress, then registers a vectored exception handler that triggers a deliberate debug break to redirect control flow into a manually located raw syscall instruction inside ntdll and call NtProtectVirtualMemory directly, before invoking the undocumented ntdll export EtwpCreateEtwThread, which Kaspersky describes as a popular alternative to CreateThread, to execute the mapped shellcode (Kaspersky Securelist, 2026-09-17). The second stage queries the legitimate Solana blockchain's public getAccountInfo RPC endpoint to retrieve an XOR-encrypted C2 address, which Kaspersky notes gives the operators decentralized storage for C2 addresses that blocking C2 server IP addresses alone does not disrupt (Kaspersky Securelist, 2026-09-17). A third stage performs a UAC bypass and persistence and copies the original binary to msedge.exe in the Microsoft\Windows\Telemetry folder under ProgramData, so an Edge-named executable runs from outside Edge's install directory, then hands off to a final remote-file-manager module exposing 21 filesystem commands, including preview commands Kaspersky reads as built for pre-exfiltration triage of image and document contents (Kaspersky Securelist, 2026-09-17).
we discovered a previously unknown modular, multi-stage framework that we dubbed MovieReaper
instead of compromising torrent trackers, the threat actor modified a widely used public repository of torrent files
Utilizing the Solana blockchain as a storage layer for next-stage C2 endpoints substantially complicates infrastructure takedown efforts by defenders.
Kaspersky has revised its report since first publication. It now describes the distribution as the actor modifying the public torrent-file repository instead of compromising the torrent trackers, and the list in its Victims section now adds Latin America to the affected regions and names Uganda, Colombia, the Netherlands and Belgium, countries the introduction named from the start (Kaspersky Securelist, 2026-09-17). The earlier text of this entry described the victims as spanning Europe, Asia and Africa only and contrasted the repository compromise with trojanized installers on individual sites.
The analysis had also described the third stage as masquerading as a Windows Telemetry executable. The report says it copies the original binary to msedge.exe in a Windows Telemetry folder under ProgramData, an Edge name in a Telemetry location, and the analysis now says so (Kaspersky Securelist, 2026-09-17).
ESET documents FamousSparrow's shift to a new flagship backdoor, SparroWocky, replacing SparrowDoor as the group's main implant since August 2025 (ESET, 2026-09-17). From mid-2025 into 2026, 90% of FamousSparrow's observed targets were in Latin America (Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela) with government entities named among the targets, an unusually sustained single-region focus for a China-aligned group ESET otherwise tracks globally; ESET assesses the focus likely reflects Chinese state interest in monitoring regional government reactions to renewed US engagement, citing a Panamanian port-concession dispute as a specific target-motive match (ESET, 2026-09-17). SparroWocky deploys via a "trident loader": a legitimate executable, a side-loading DLL with a patched .text-section entry point that keeps the impersonated module's export table and metadata intact, and an RC4-encrypted .dat payload whose decrypted PE has its MZ/PE header bytes stripped before being reflectively mapped into memory. The backdoor incorporates Mbed TLS for its C2 channel and MinHook for API hooking, and runs a modified TrustedSec COFF loader that executes Cobalt Strike, Brute Ratel, Metasploit and Sliver-compatible Beacon Object Files, redirecting BOF-imported-symbol calls through a stack-spoofing subroutine. Its anti-analysis techniques include a SilentMoonwalk-style call-stack forger that uses JOP/ROP gadgets inside legitimate kernel32.dll so hooked API calls appear to originate from RtlUserThreadStart or BaseThreadInitThunk, and a MinHook-based CreateThread hook that reports the benign-looking AnimateWindow as the thread's start address; for dynamically loaded PE payloads, the backdoor also forges a fake LDR_DATA_TABLE_ENTRY structure in the PEB_LDR_DATA doubly linked list Windows uses to track loaded modules, a list security products routinely monitor. Persistence is operator-configurable via a Windows service or a registry Run key. ESET attributes SparroWocky to FamousSparrow with high confidence, since early attacks show the FamousSparrow-exclusive SparrowDoor deploying the new backdoor directly.
Triage: call-stack forgery targeting RtlUserThreadStart or BaseThreadInitThunk is not something a legitimate application produces; a stack walk that resolves cleanly to one of those two entry points via JOP/ROP gadgets in kernel32.dll, rather than a normal thread-creation call chain, is the discriminator ESET's own analysis supports.
We believe that this focus is not coincidental and likely reflects China's reaction to various recent US initiatives in the region.
Based on our investigation, we attribute the latest campaign and the SparroWocky backdoor to FamousSparrow with high confidence, since in some of the first attacks involving this backdoor, SparroWocky was deployed by the FamousSparrow-exclusive SparrowDoor.
Helpfeel Inc. (Kyoto, Japan) disclosed on 2026-09-16 that on 2026-09-11 a third party exploited a vulnerability in the image-upload server of Gyazo, its screenshot-sharing service, executed arbitrary commands and accessed Gyazo's database (Helpfeel Inc., 2026-09-16). Helpfeel has not named the flaw class (The Hacker News, 2026-09-17). About 23.62 million user records were exposed, including email addresses, password hashes and login session IDs, together with about 490 million image-metadata records, mostly for images registered in or before January 2019, that include the image IDs used to build Gyazo image links (Helpfeel Inc., 2026-09-16). A capture at Gyazo's default setting is protected only by its link, so the leaked image IDs remove that protection (The Hacker News, 2026-09-17). Helpfeel says the attacker also obtained a list identifying private images and that it cannot rule out that some of them were viewed (Helpfeel Inc., 2026-09-16).
On September 11, 2026, a third party exploited a vulnerability in Gyazo's image upload server to gain unauthorized access to our systems and execute arbitrary commands.
We have also confirmed that the third party obtained a list identifying private images. As we cannot rule out the possibility that some private images may have been viewed by the third party, we are continuing our detailed investigation.
Helpfeel lists an X (formerly Twitter) integration token and the email address associated with Google single sign-on among the exposed user fields, not a Google SSO token (Helpfeel Inc., 2026-09-16). For a capture at Gyazo's default setting, the link is the only protection, so the leaked image IDs remove it. Captures set to "Only me" cannot be viewed even by someone who knows the link, according to Gyazo's help pages as reported by The Hacker News (The Hacker News, 2026-09-17).
Check Point disclosed CVE-2026-91843 (CVSS 9.8) on 2026-09-16: a stack overflow in the unauthenticated login process to Check Point Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server lets an attacker who reaches the login interface run arbitrary code remotely as root (Check Point PSIRT, 2026-09-16). Check Point's attack indicator is a failed administrator login for an over-long username (Check Point PSIRT, 2026-09-16). Neither Check Point's advisory nor CERT-FR reports observed exploitation (Check Point PSIRT, 2026-09-16 · CERT-FR CERTFR-2026-AVI-1193, 2026-09-17).
Check Point ships the fix as a LivePatch: administrators with automatic updates enabled per sk175504 are already protected, and cplp list in Expert mode should show the CVE-2026-91843 patch armed on R82.20, R82.10, R82 and R81.20 (Check Point PSIRT, 2026-09-16). The fix is also in the Jumbo Hotfix Accumulator for R82.10 from Take 45, R82 from Take 127, R81.20 from Take 170 and the end-of-support R81.10 from Take 192, while Check Point lists no fix for R80.x and R81 (Check Point PSIRT, 2026-09-16). Check Point's mitigation is to limit Trusted Clients (GUI clients) to trusted IP addresses or subnets and never to use "Any" as the client type (Check Point PSIRT, 2026-09-16). The flaw needs no credentials and yields root (Check Point PSIRT, 2026-09-16), so the absence of exploitation reports does not lower the urgency.
Triage: Check Point's advisory for CVE-2026-93616 treats a login with a username over 1,000 characters that coincides with an FWM or MDS core dump as a potential attempt to exploit that flaw (Check Point Support, sk1000171, 2026-09-20). For CVE-2026-91843, Check Point gives only the "Username too long" login failure as its attack indicator (Check Point PSIRT, 2026-09-16).
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.
In SmartConsole, search for Audit and Admin login logs containing the message: "Administrator failed to log in: Username too long".
The LivePatch for this flaw does not cover CVE-2026-93616, a separate pre-authentication directory traversal and file upload flaw in Security Management, Multi-Domain Security Management, Log, Multi-Domain Log and SmartEvent servers, for which Check Point says no LivePatch is available (Check Point Support, sk1000171, 2026-09-20). Check Point says it was exploited in a handful of targeted attacks on July 23 (The Hacker News, 2026-09-22). That flaw needs the R82.20 Security Hotfix or a Jumbo Hotfix take (R82.10 Take 45, R82 Take 127, R81.20 Take 170 or R81.10 Take 192), and these takes also include the CVE-2026-91843 fix (Check Point Support, sk1000171, 2026-09-20). A server that received only this LivePatch is still exposed. R81.10 is fixable through Jumbo Hotfix Take 192, and only R80.x and R81 have no listed fix (Check Point PSIRT, 2026-09-16). Check Point's hunting guidance for CVE-2026-93616 includes searching cpm.elg for login requests with usernames over 1,000 characters and checking for an FWM or MDS core dump at the same time (Check Point Support, sk1000171, 2026-09-20).
CVE-2026-87886 is a local privilege-escalation flaw from insecure file permissions in the Acronis Backup plugin for cPanel & WHM and extension for Plesk, both on Linux (Help Net Security, 2026-09-16), which Acronis scores at CVSS 7.8 (BleepingComputer, 2026-09-15). CISA's KEV record classes it as incorrect default permissions (CWE-276) (CISA KEV catalog, 2026-09-16). A low-privileged attacker on an affected server can raise their permission level without user interaction (BleepingComputer, 2026-09-15); no remote or unauthenticated path is described. Acronis's advisory states that "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments", and Acronis told BleepingComputer that the assessment rests on a single report from a "potentially affected" customer and has identified no indicators of compromise (BleepingComputer, 2026-09-15). Help Net Security reports no signs of active exploitation on Plesk deployments (Help Net Security, 2026-09-16). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-16 (CISA KEV catalog, 2026-09-16). Builds of the cPanel & WHM plugin earlier than 1.9.3.1021 are fixed in 1.9.3 HF3, and builds of the Plesk extension earlier than 1.8.11.638 are fixed in 1.8.11 (BleepingComputer, 2026-09-15).
Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments
Acronis (via BleepingComputer)
the assessment is based on a single report from a "potentially affected" customer
The earlier headline and summary said CISA listed the flaw on the strength of a single customer's report, and the takeaway said the listing reflected CISA's own independent judgment. No cited source states the basis of CISA's listing. The single-customer basis belongs to Acronis's own exploitation assessment (BleepingComputer, 2026-09-15). The CWE-276 class comes from CISA's KEV record (CISA KEV catalog, 2026-09-16), not from Help Net Security.
Switzerland's National Test Institute for Cybersecurity (NTC) published a year-long technical security assessment (2026-09-17) of seven solar inverters and four energy-management systems from eight manufacturers, of the kind installed in thousands of Swiss homes (NTC, 2026-09-17) among Switzerland's roughly 338,000 grid-connected photovoltaic installations (cash.ch, 2026-09-17). Testing produced more than 50 findings, seven critical and six high, with full device takeover on four of the eleven products (NTC, 2026-09-17). The recurring weaknesses: default passwords, maintenance access using identical credentials across an entire device fleet, weak or missing encryption on local-interface communication, and interfaces that cannot be disabled. On almost every inverter tested, the local control interface let an unauthenticated actor change how much power the installation feeds into the grid, down to zero, with no login required (NTC, 2026-09-17); NTC found no evidence of intentionally built-in backdoors, per its own statement, framing the risk instead as manufacturer-cloud concentration (cash.ch, 2026-09-17). NTC warns that thousands of installations connect to a small number of manufacturer clouds, so an attacker who gains control of one manufacturer's cloud could trigger the same change in grid feed-in across thousands of connected installations at once, and that the fleet as a whole constitutes critical infrastructure (NTC, 2026-09-17). NTC founder Raphael Reischuk states that if the Chinese manufacturers were to simultaneously switch off all their devices at full power, a collapse of the Swiss power grid would threaten (translated from German) (Raphael Reischuk, NTC, via SRF, 2026-09-16), and Switzerland's Federal Office of Energy confirms the analysis, saying the risk of a coordinated attack cannot be ruled out (translated from German) (SRF, 2026-09-16).
The market-concentration and procurement angle is directly relevant to Swiss public-sector buyers: Huawei and Sungrow together hold over 60% of the Swiss inverter market, Switzerland's Federal Intelligence Service (NDB) warns the country risks becoming a preferred target if it protects critical infrastructure less than the EU, and SRF reports that canton Bern's building authority tendered a cantonal vocational school's solar installation so that in practice only a Huawei inverter qualified; the authority says it did not specify the manufacturer but concedes that cybersecurity is "still barely anchored" in tenders (translated from German) (SRF, 2026-09-16). The EU has withdrawn subsidy eligibility for Chinese-inverter projects and the US has declared a grid emergency that can force removal of already-installed sanctioned-country inverters (SRF, 2026-09-16). NTC deliberately withheld product names and technical exploit detail, reporting findings confidentially to manufacturers, and states most manufacturers responded quickly to the disclosure while work to fix the vulnerabilities remains under way for some products (NTC, 2026-09-17); cash.ch separately reports that most manufacturers responded quickly and have already closed gaps (translated from German) (cash.ch, 2026-09-17). Neither NTC nor cash.ch names a CVE for any of the findings (NTC, 2026-09-17; cash.ch, 2026-09-17).
In total, the assessments produced more than 50 findings, seven of them critical and a further six rated high.
On almost every inverter tested, the local control interface makes it possible (without any login) to change how much power the installation feeds into the grid, all the way down to zero.
on four products, the NTC gained complete control over the device
National Test Institute for Cybersecurity (NTC)
If the Chinese manufacturers were to simultaneously switch off all their devices at full power, a collapse of the Swiss power grid would threaten. (translated from German)
Asked about this, the Baudirektion writes that it did not specify the manufacturer. It does concede, however, that cybersecurity is "still barely anchored" in tenders. (translated from German)
The corroboration behind this entry is editorial rather than independent, and its credibility rating now says so. The National Test Institute for Cybersecurity ran the tests and published the findings; SRF and cash.ch report on that study rather than testing the devices themselves, and the Federal Office of Energy endorsed the institute's analysis rather than conducting its own. That is one assessor with several publishers, so the rating moves from confirmed to probably true. Every figure in the entry was re-checked against the institute's own publication and none of them changes (National Test Institute for Cybersecurity, 2026-09-17).
SRF, not canton Bern's building authority, describes the vocational-school tender as one that in practice only a Huawei inverter could meet; the authority told SRF it did not specify the manufacturer and conceded only that cybersecurity is "still barely anchored" in tenders (translated from German) (SRF, 2026-09-16). SRF reports that the Federal Office of Energy confirms the analysis, saying the risk of a coordinated attack cannot be ruled out (translated from German), not that it confirmed the assessment independently (SRF, 2026-09-16). Neither NTC nor cash.ch names a CVE for the findings, and neither says that none was assigned (NTC, 2026-09-17) (cash.ch, 2026-09-17). NTC puts the reach of a compromised manufacturer cloud at thousands of connected installations whose feed-in could be changed, not at every installation (NTC, 2026-09-17).
Hudson Rock reports the access vector: infostealer-compromised webmail accounts on pec.interno.it, Italy's Ministry of the Interior's certified-email domain, monitored for roughly five months with an anti-forensic technique of deleting fraudulent outgoing mail and downloading-then-deleting replies. Hudson Rock's own database independently found approximately 300 already-compromised pec.interno.it credentials, though the attacker's own inconsistent account of infecting the officials directly is not independently confirmed.
Hudson Rock, relaying the attacker's own account to the Duel Investigations Team, reports the access vector claimed behind the fraudulent request: infostealer-compromised webmail accounts on pec.interno.it, the certified-email domain of Italy's Ministry of the Interior. Per that account, the hacker gained access to government employee accounts using an infostealer, and after gaining entry to an employee's email, would log in, add a recovery email under their control, begin logging activities, and silently monitor communications (The Duel Investigations Team, via Hudson Rock, 2026-09-15). Upon receiving a reply to their fraudulent emails, the operator would immediately download it as a .eml file and delete it before the actual account owner noticed, an anti-forensic technique the account says let the campaign run for roughly five months, beginning with forged court orders before pivoting to Revolut Bank UAB, Revolut's Lithuania-licensed EU subsidiary obligated to respond to European Investigation Orders (The Duel Investigations Team, via Hudson Rock, 2026-09-15). Hudson Rock's own cybercrime database independently identified approximately 300 compromised pec.interno.it webmail logins from already-infected machines, and on that basis assesses it is highly unlikely the hacker actively infected these specific employees themselves (Hudson Rock, 2026-09-15); the attacker's own account of the initial-access method was itself inconsistent, first describing a remote-access trojan and later an infostealer. This resolves the access-vector question the original disclosure left open; CyberInsider reports Revolut told it only that the fraudulent request "appeared authentic based on the technical indicators available to its staff" (CyberInsider, 2026-09-16), and Revolut itself has not confirmed the five-month timeline, the pec.interno.it detail, or the anti-forensic technique. CyberInsider separately references unnamed "separate reporting" giving a customer count of around 680, a figure this entry cannot independently verify.
CVE-2026-76460 was one part of a larger Cisco ISE hardening release the same day: two more CVEs (CVE-2026-20130, CVE-2026-20192) also carry CVSS 10.0, and NCSC-NL scopes the release to 21 vulnerabilities, 13 of them critical. CERT-FR confirms only CVE-2026-76460 is reported exploited, and notes ISE 3.1/3.2 will receive no fix at all for eight of the disclosed CVEs before their November 2027 end of maintenance.
CVE-2026-76460 was one part of a much larger Cisco ISE hardening release the same day. NCSC-NL's advisory scopes 21 of the disclosed vulnerabilities and states: "Of the 21 vulnerabilities in total, 13 are rated critical. Based on the CVSS scores Cisco published, four vulnerabilities can be exploited remotely without authentication" (translated from Dutch) (NCSC-NL, 2026-09-17). Two further CVEs join the maximum-severity tier alongside the already-covered CVE-2026-76460 and CVE-2026-76423: "Four vulnerabilities, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460, have a CVSS score of 10.0" (translated from Dutch) (NCSC-NL, 2026-09-17); Cisco groups multiple underlying flaws sharing a CWE classification for a hardening release under one CVE ID, with the CVSS score representing the highest-scoring underlying flaw in each bundle. CERT-FR's combined advisory reports Cisco's statement that CVE-2026-76460 is actively exploited (CERT-FR, 2026-09-17). Cisco's advisory for CVE-2026-76423 and five further flaws says Cisco is not aware of malicious use of any of them (Cisco PSIRT, 2026-09-16), and its hardening advisory says the same of the flaws it covers except where noted (Cisco PSIRT hardening advisory, 2026-09-16). Cisco's hardening advisory marks the improper-access-control class covered by CVE-2026-20192 with the note that one vulnerability belonging to that class is known to be actively exploited, and points to Cisco's Identity Services Engine Authentication Bypass advisory for it (Cisco PSIRT hardening advisory, 2026-09-16). That advisory covers CVE-2026-76460 (Cisco PSIRT, 2026-09-16). CERT-FR also reports Cisco's statement that ISE 3.1 and 3.2, which leave support on 30 November 2027, have not received a fix for eight of the disclosed CVEs (CERT-FR, 2026-09-17). Cisco's hardening advisory places both trains in the Software Maintenance phase, where only fixes for critical vulnerabilities are included, and advises migrating to a supported release that includes all of the hardening fixes (Cisco PSIRT hardening advisory, 2026-09-16).
Cisco's promised 2026-09-16 hardening release shipped on schedule, adding two more critical, unauthenticated-adjacent root-RCE flaws to the same Secure FMC product line: CVE-2026-20324 (sftunnel arbitrary file write, requires existing low-priv credentials) and CVE-2026-20242 (Java deserialization via the External Database Access allowlist, no credentials of its own needed). Neither is reported exploited; ASA and FTD are confirmed not affected by either.
Cisco's promised 2026-09-16 hardening release shipped on schedule, adding two more critical, unauthenticated-adjacent root-RCE flaws to the same Secure FMC product line: CVE-2026-20324 (CVSS 9.9), a flaw in the sftunnel inter-device communication protocol where a registered peer has incorrect file-write permissions, letting an attacker who already holds valid low-privilege device credentials write an arbitrary file that executes as root (Cisco PSIRT, 2026-09-16); and CVE-2026-20242 (CVSS 9.8), an insecure Java deserialization bug in the FMC External Database Access feature reachable by a host already present in that feature's allowlist, needing no credentials of its own (Cisco PSIRT, 2026-09-16). Cisco confirms ASA and FTD Software are not affected by either flaw; there is no workaround for CVE-2026-20324, while CVE-2026-20242 can be mitigated by disabling External Database Access entirely until patched. Cisco states it is not aware of any public announcements or malicious use of either flaw.
Apply the CVE-2026-91843 fix to every Check Point Security Management, Multi-Domain Security Management, Log Server and Multi-Domain Log Server now, preferably as a Jumbo Hotfix take that also fixes the exploited CVE-2026-93616 (R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192), otherwise as the LivePatch (confirm cplp list in Expert mode shows it armed), and verify no Trusted Client/GUI access to the login interface reaches it from outside the management network.
On every WordPress site that loaded a Brevo forms, Conversations or SDK script on 2026-09-14 and had an administrator visit while logged in, check for any plugin installed or activated that day and compare the plugin directory on disk with the admin plugin list, because the known backdoor (impersonating "Web Media Optimizer") hides from that list and copies itself into the must-use-plugins directory. Remove any such plugin, invalidate all administrator sessions, change administrator passwords and review administrator accounts, because its hardcoded key mints admin logins without a password.
Update the Acronis Backup plugin/extension on every cPanel & WHM (<1.9.3.1021) or Plesk (<1.8.11.638) server to the fixed build now, regardless of the single-customer-report basis behind Acronis's exploitation claim.
2026-09-18T0410Z-intel· Sonnet 5 · window 26 h · 7 entries published
Verification & coverage notes
Standard 26-hour window (24 hours since the previous fire, 2026-09-17T0409Z-intel). No closed-source drops this window. No product or supplier watchlist is configured for this deployment, so both sweeps are no-ops (Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0).
Mechanical KEV sweep:tools/kev_window_diff.py --window-hours 26 found zero CISA KEV additions since 2026-09-17; no disposition duty this run. The vulnerability-track research independently cross-checked the live KEV catalog and surfaced one CVE that never appeared in the prior 14-day coverage despite meeting the confirmed-exploited/KEV bar a day earlier than this run's window (CVE-2026-87886, Acronis Backup plugin, KEV-listed 2026-09-16); see the gap-fill note below.
New entries (7):
cve-2026-91843-check-point-security-mgmt-stack-overflow (high, vulnerability), unauthenticated stack overflow in Check Point Security/Multi-Domain Security Management and Log Server login process, root RCE, no confirmed exploitation. Included under PD-11(b)'s "otherwise" limb: an anonymous single-request path to root on network-security management infrastructure.
cve-2026-87886-acronis-backup-plugin-lpe-cpanel-kev (high, vulnerability), Acronis Backup plugin LPE for cPanel & WHM/Plesk/DirectAdmin, CISA KEV-listed 2026-09-16 on a single-customer-report basis. Gap-fill: disclosure predates this run's 26h window by about a day and was missed by the prior fire's own KEV sweep window; published now per the coverage-backlog philosophy (verified in-window by the fire that surfaces it) rather than deferred further.
ntc-swiss-solar-inverter-cybersecurity-assessment (high, research), Swiss NTC finds 50+ vulnerabilities across solar inverters/EMS including unauthenticated grid-feed shutoff; direct cantonal (Bern) procurement nexus. Independently surfaced from both the home-region/sector track (English NTC page) and the research track (German NTC page + SRF); composed once, merging both discovery traces.
famoussparrow-sparrowocky-backdoor-latam-gov (notable, threat), ESET documents a new FamousSparrow backdoor with BOF-loading and call-stack spoofing, almost exclusively targeting Latin American governments. techniques[] carries the full 34-id set from ESET's own ATT&CK table (a deep re-read of the primary before composing caught the initial research draft at only 13 ids, see below).
moviereaper-torrent-supply-chain-solana-c2 (notable, threat), Kaspersky documents a crimeware framework distributed via a torrent-file-repository supply-chain compromise, using Solana blockchain as a C2 dead-drop; government named among confirmed victim sectors.
gyazo-helpfeel-data-breach-image-upload-rce (notable, incident), Helpfeel discloses a Gyazo breach exposing 23.62M user records and 490M image-metadata records; included on PD-11(a) global scale.
brevo-cloudflare-worker-clickfix-supply-chain (high, incident), a stolen Cloudflare API key let an attacker inject malware via a CDN-edge Worker into up to 100,000 sites, defeating origin-side integrity checks; included on PD-11(b), a materially novel and transferable supply-chain TTP.
Updates (3), all type: update, all float updated_at:
2026-08-04/cve-2026-20079-cisco-secure-fmc-auth-bypass-root-hotfix, Cisco's promised 2026-09-16 hardening release landed on schedule, adding CVE-2026-20324 and CVE-2026-20242 to the same tracked FMC product line; neither reported exploited.
2026-09-17/cve-2026-76460-cisco-ise-auth-bypass-root-rce, the same 16 September cycle disclosed a further 21-vulnerability, 13-critical Cisco ISE hardening release; two more CVSS 10.0 CVEs beyond the already-exploited primary; CERT-FR confirms only the original CVE is exploited and flags an unpatchable subset on ISE 3.1/3.2 before their 2027 end of maintenance.
2026-09-13/revolut-fake-government-request-kyc-breach, Hudson Rock names the access vector this entry left open: infostealer-compromised Italian Ministry of Interior mailboxes, independently corroborated by Hudson Rock's own database finding of ~300 compromised credentials; the surrounding attacker narrative remains only partly verified.
Dropped (borderline-drop):
borderline-drop: OpenAI model-misalignment reporting framework + context-compaction self-injection finding — genuinely novel AI-safety research (a model injecting jailbreak-style text into its own training-time context-compaction summaries), but describes model self-behavior during training rather than an external attacker technique, with no SOC-actionable detect/hunt/harden lesson; the rolling window already carries extensive AI-agent-misalignment coverage (yesterday's Mandiant deep dive, GTG-20006/27005, Hugging Face, Anthropic eval-escape entries). Quality-over-quantity (v4.2) resolves toward drop.
Deep re-read of every primary before composing (10 items): re-fetched all 10 primaries in full and confirmed every pre-existing evidence quote verbatim. Corrections folded into composition before publish: (a) FamousSparrow/SparroWocky's techniques[] expanded from a 13-id draft to ESET's own complete 34-id ATT&CK table; (b) the Brevo incident-window framing corrected to Brevo's own two-window disclosure (15:01-20:30 UTC overall impact; 16:07 UTC specifically for the customer-embedded-script compromise) rather than BleepingComputer's compressed single figure; (c) the Cisco FMC update's draft claim that Cisco Security Cloud Control is unaffected by CVE-2026-20242 was dropped, that advisory's own "Products Confirmed Not Vulnerable" list names only ASA/FTD, not SCC; (d) the Acronis entry's exploitation framing narrowed to state plainly that Acronis's own assessment rests on a single customer's report, not a broad campaign, and CISA's KEV description omits DirectAdmin even though NVD/ENISA (mirroring Acronis's own CVE text) list it as a third affected product; (e) MovieReaper's victim-country list corrected to cite Kaspersky's own more-specific "Victims" section rather than its shorter introduction-paragraph enumeration.
Coverage-backlog re-checks this run (state/coverage_backlog.md § Open), all "no change" except one new row opened:
ShinyHunters/Kimberly-Clark, TheGentlemen/Ixa Systems SA, Krybit/UICC, ShinyHunters/Medela AG, SafePay/reichenau.at, Ville du Tampon, Familea, AFPA, all re-checked, no change on any; still only leak-site trackers or unresolved victim statements, no Admiralty A/B journalism or evidence-bound mechanism clearing the relevant gate.
inside-it.ch's Insel Gruppe article, still blocked (a persistent "Security Checkpoint" HTTP 429 on every transport, a 19th+ consecutive fire); the day's NTC solar-inverter story was independently reached through the RSS listing and a web search pivot, bypassing the blocked article entirely. Recommend closing or re-scoping this row if the next 2-3 fires also find nothing.
Siemens S7 PLC advisory, VMware VMSA-2026-0007, Spring Ring Teams-vishing NTLM relay, and the three remaining PD-11(d) research items (AWS root-password spraying, Exodus wallet installer RAT, Check Point JSCeal deobfuscation), all re-checked, no material development on any; remain below their respective recovery bars.
NovoCure; not re-probed this run (no spare capacity); low priority, carried forward.
New row opened: Communauté de communes des Pays de L'Aigle (France) confirms a mail-server intrusion the night of 14-15 September 2026; no mechanism, actor or data-theft claim named by any party, so it does not yet clear the breach gate's ATT&CK-mapping requirement. Same blocking condition as the existing Ville du Tampon/Familea rows.
Deep-dive selection: no deep dive this run. Two candidates considered (FamousSparrow/SparroWocky (category apt-campaign, used 5 days ago for GTG-20006; MovieReaper) category supply-chain, used 6 days ago for JFrog Artifactory); both demoted by the 7-day category-rotation rule, and neither independently clears criterion 1 (no confirmed exploitation against an exposed constituency) to override the demotion.
Verification: six iterations, each a fresh cold read with no memory of the prior pass. The first four each found a substantial batch of genuine defects (citation misattributions, a hallucinated product claim, spliced evidence quotes, unsupported quantifiers) that were remediated in place; the fifth and sixth found progressively fewer, concentrated on one recurring clause (a solar-inverter entry's remediation-status wording, corrected three times before it tracked the primary source's exact claim). The sixth iteration's residual, truth 1 plus editorial 1 with no broken-URL or hallucinated-fact finding, cleared the early-exit bar: both were fixed and the run published without a further confirmation pass. One advisory-only finding on the same iteration (an over-attributed interpretive gloss) was also fixed. No entry was dropped by verification.
Sources:tp-link-omada-psirt's listing URL recipe fixed (see sources_changed). All 187 tracked sources probed clean by tools/source_health.py this run (92 direct-ok, 95 bridge-ok, 0 unsolved), no repair duty.