Sunday, 20 September 2026

The sourcing note said no vendor advisory added exploitation detail beyond re-listing fixed kernel builds. Red Hat had already updated its advisories for all three flaws, on 2026-09-19 at 02:00 UTC, to acknowledge active exploitation, state that public exploits exist and tell customers to address them with high priority. The sourcing note and the verification value now reflect that second assessment, and the three NVD API endpoints previously listed as sources are replaced by Red Hat's own per-flaw advisory pages. Two evidence quotes attributed to those endpoints were re-checked: one is carried verbatim by Red Hat's page and is now attributed there, the other is on no reachable first-party page and is removed. The three inline citations in the analysis pointed at the same endpoints and now point at Red Hat's pages; the sentence on the bridge flaw is rewritten to what Red Hat states, because the function name and the page-fragment detail it previously carried are on no source the entry can cite.

Red Hat has acknowledged active exploitation of all three flaws. It updated its advisories for CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 on 2026-09-19 at 02:00 UTC, saying of each that "This CVE is high risk and there are known public exploits leveraging this vulnerability" and "Address this vulnerability with high priority" (The Hacker News, 2026-09-19). This entry previously stated that no vendor advisory added exploitation detail beyond the fixed kernel builds. How the flaws are being exploited, and whether they are chained, is still not described anywhere.

The scope figure was inverted. Sansec reports that Brevo served malware to visitors of its own site and more than 100,000 customer sites; the title, summary and analysis all said "up to 100,000" and the analysis called it an upper bound. It is a floor, so the entry understated the reported reach. The title, summary and the body sentence now state what Sansec states.

Sansec's count is a floor, not a ceiling. Its write-up states that on 14 September "Brevo served malware to visitors of its own site and more than 100 thousand customer sites", linking that figure to a live search for sites embedding the affected components (Sansec, 2026-09-16). This entry previously described the same figure as an upper bound of up to 100,000 sites, which understates the reach Sansec reported.

The Japanese-language evidence record was not verbatim: the stored source-language text reordered and abridged the sentence on the Piyolog page and could not be matched against it. Both the source-language text and its English rendering now reproduce what the page actually says, which qualifies the rating as the one in the assessment published at the time rather than a flat Medium; the analysis carries the same qualification. The substance, that a Medium-rated flaw was exploited before its scheduled fix, is unchanged.

The Digital Agency's statement on the flaw's severity is narrower than this entry first rendered it. Piyolog's account of the 2026-09-11 press conference reports the agency saying that the Common Vulnerability Scoring System rated the severity at around "Medium" in the vulnerability assessment published at the time, and that the flaw was exploited before a fix or patch had been applied (Piyolog, 2026-09-11). The qualification matters: the agency described the rating as it stood when first published, not as a settled assessment of the flaw.

The remediation this entry named is superseded. Cisco revised the advisory to 2.6 on 2026-09-16, replacing the per-train hot fixes with the September 2026 hardening releases and telling customers to upgrade to those instead. The headline, the fixed-version record, the action item and two body statements now name the hardening releases; a reader following the earlier guidance would have installed a hot fix the vendor no longer recommends.

The per-train hot fixes are no longer Cisco's remediation for CVE-2026-20079. Revision 2.6 of the advisory, dated 2026-09-16, records "Replaced hot fixes with the security hardening releases", and the Fixed Releases table now reads 7.0 and earlier to 7.0.10, 7.2 to 7.2.12, 7.4 to 7.4.8, 7.6 to 7.6.6, 7.7 to 7.7.13, 10.0 to 10.0.2 and 10.1 to 10.1.0 (Cisco PSIRT, 2026-09-16). Cisco adds that the hardening releases carry this fix "as well as multiple other internally discovered vulnerabilities" and recommends upgrading to them, directing anyone who still needs hot-fix detail to its support centre. An appliance patched with the earlier hot fix is fixed for this flaw but not for the rest of the hardening release.

Credibility was rated 1 (corroborated by independent sources). Every cited source traces to the National Test Institute for Cybersecurity's own study: SRF and cash.ch report on it and the Federal Office of Energy endorsed it, and none of them re-tested the inverters. That is one assessor with several publishers, which rates 2. A sourcing note now records the provenance. The findings themselves were re-verified against the institute's own publication and are unchanged.

The corroboration behind this entry is editorial rather than independent, and its credibility rating now says so. The National Test Institute for Cybersecurity ran the tests and published the findings; SRF and cash.ch report on that study rather than testing the devices themselves, and the Federal Office of Energy endorsed the institute's analysis rather than conducting its own. That is one assessor with several publishers, so the rating moves from confirmed to probably true. Every figure in the entry was re-checked against the institute's own publication and none of them changes (National Test Institute for Cybersecurity, 2026-09-17).

The entry said Anthropic banned nine accounts and banned all of them. Anthropic's report states that it identified nine accounts associated with the group, that eight were used only for ordinary freelance work, and that it banned accounts associated with the actors; it does not say how many of the nine were banned. The summary and the analysis now state what the report states. A sentence explaining the absence of an ATT&CK mapping was also removed from the analysis.

Anthropic's report does not state how many of the nine accounts it identified were banned. It says it identified nine accounts associated with the group, that eight of them were used only for ordinary freelance work rather than weapons-related software development, and that it "banned accounts associated with the actors" (Anthropic, 2026-09-10). The earlier statement that all nine were banned went beyond the report.