About this episode
Trusted development platforms, browser integrations, cloud identities, and exposed control planes drive a week of active exploitation, supply-chain compromise, agentic abuse, and financial impact. Defenders need verified remediation, access scoping, and connected telemetry across every layer.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities
CISA has added three critical Linux kernel vulnerabilities, including CVE-2025-39682 with a 9.8 CVSS score, to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. These flaws impact the TLS receive path and pose significant security risks.
Source: The Hacker News
CISA Warns of Active Exploitation of Three Linux Kernel Flaws
CISA has issued an alert about active exploitation of three Linux kernel vulnerabilities, including one critical severity flaw. These vulnerabilities pose significant risks to systems running Linux and should be addressed immediately.
Source: BleepingComputer
Critical Pre-Auth RCE in Orkes Conductor Actively Exploited
A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor is currently being exploited in the wild. This vulnerability affects versions before 3.30.2 and scores up to 9.8 on the CVSS scale.
Source: The Hacker News
CISA Adds Zyxel Switch Buffer Overflow to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities Catalog following evidence of active exploitation. This addition emphasizes the importance of prioritizing remediation under BOD 26-04 to mitigate significant risks to federal and other organizations.
Source: CISA
Critical Bifrost AI Gateway Flaw Allows Credentialless Command Execution
A critical vulnerability in Bifrost, an open-source AI gateway, lets attackers execute arbitrary commands on the gateway server without credentials. The flaw, CVE-2026-90898, affects versions before 2.1.0 and scores 9.8 on the CVSS scale.
Source: The Hacker News
Check Point Fixes Critical Management Server Zero-Day Exploited in Attacks
Check Point Software issued emergency hotfixes for a critical zero-day vulnerability in its Security Management Server actively exploited by attackers to run arbitrary scripts. This flaw poses a serious risk to enterprise environments relying on Check Point's management infrastructure.
Source: BleepingComputer
Check Point Warns of Active Exploitation in Security Gateway VPN RCE Flaw
Check Point confirmed active exploitation of a pre-authentication RCE vulnerability (CVE-2026-85102) in the VPN certificate handling of its Security Gateway product. This flaw allows remote attackers to execute code without prior authentication.
Source: BleepingComputer
MikroTrick Chain Lets Attackers Control MikroTik Routers Without Credentials
Two linked vulnerabilities in MikroTik RouterOS allow attackers to gain full admin access without passwords or SSH keys. CERT Polska identifies CVE-2026-67279 and CVE-2026-86060 as the combined exploit dubbed MikroTrick.
Source: The Hacker News
Elementor WordPress CSRF Flaw Allows Admin Account Creation
A critical CSRF vulnerability in the popular Elementor WordPress plugin allows unauthenticated attackers to create administrator accounts, posing severe risks to affected websites. This flaw exposes sites to potential full compromise if exploited.
Source: BleepingComputer
WordPress Patches Critical Flaw Allowing Remote Code Execution
WordPress fixed a severe vulnerability enabling unauthenticated attackers to load PHP files externally, potentially leading to remote code execution on some servers. The patch covers all supported versions from 4.7 onward, released on September 22 in version 7.1.2.
Source: The Hacker News
Critical Vulnerabilities Discovered in Eufy Omni C20 and Omni X10 Pro
Multiple high-severity vulnerabilities in Eufy Omni C20 and Omni X10 Pro cameras could allow attackers to execute system commands, abuse hard-coded credentials, or conduct man-in-the-middle attacks. Users are urged to update to firmware version 1.6.4 or later to mitigate risks.
Source: CISA
North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide
The North Korean hacking group WaterPlum compromised over 30,000 devices globally from December 2025 to July 2026, stealing more than $10.7 million in cryptocurrency. This large-scale campaign highlights ongoing state-sponsored cyber threats targeting cryptocurrency assets.
Source: BleepingComputer
Contagious Interview Campaign Hits 30K Devices, Steals $10.7M Crypto
North Korean hackers behind the Contagious Interview campaign have compromised over 30,000 devices globally, targeting web designers and crypto specialists to steal $10.71 million from more than 7,000 cryptocurrency wallets. The campaign spans 100+ countries and continues to pose a significant threat to individuals in the crypto sector.
Source: The Hacker News
Tracking Storm-2570's Consistent Ransomware Tradecraft
Storm-2570 is a ransomware affiliate known for using consistent tools and techniques across multiple ransomware deployments, including Qilin, DragonForce, Anubis, and BERT. Microsoft provides guidance to help defenders detect and disrupt this activity before ransomware deployment.
Source: Microsoft
Bitget Loses $351.6M in Suspected North Korean Hack
Bitget announced a theft of $351.6 million from its hot and warm wallets by suspected North Korean hackers after a backend compromise. Its cold wallets remain secure.
Source: The Hacker News
Storm-3168: Cloud Attacks Using Compromised Azure Service Principals
Microsoft reveals Storm-3168's JADEPUFFER-linked activity involving Azure reconnaissance, credential access, and resource deletion through compromised service principals. Guidance for defenders is provided to mitigate these agentic-driven cloud attacks.
Source: Unknown
FBI & CISA Warn on Risks of Third-Party ICS Integrators in Critical Infrastructure
The FBI and CISA issued guidance for critical infrastructure operators to manage cybersecurity risks posed by third-party industrial control system integrators, highlighting recent breaches and emphasizing the principle of least privilege. They recommend risk assessments, contract security clauses, and careful monitoring of integrator access.
Source: CISA
Fake LastPass Authenticator GitHub Repos Spread New Rapuncel Infostealer
A malware campaign uses SEO-optimized GitHub repositories impersonating LastPass Authenticator to distribute a previously unknown information stealer called Rapuncel. This attack targets users via fake repositories linked to popular software companies.
Source: BleepingComputer
Malicious npm Packages Evade Install-Script Defenses at Runtime
Threat actors are leveraging the 'indexed-btree' npm package to bypass supply chain defenses by hiding malicious code in runtime behavior instead of installation scripts. This evolving tactic challenges traditional detection methods in open-source software security.
Source: BleepingComputer
Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry
Researchers have uncovered Go-based malware delivered through two Go Modules and two Terraform providers hosted on the HashiCorp centralized repository, marking a new attack vector. The malicious providers have been downloaded hundreds of times, posing risks to users of these popular DevOps tools.
Source: The Hacker News
New Carbonato Botnet Uses AI Agents to Hijack Docker Hosts
The Carbonato malware targets exposed Docker daemons by installing the Hermes Agent AI framework to control infected hosts. This marks a notable evolution in malware leveraging AI for automated hijacking.
Source: BleepingComputer
Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution
Two GitHub Actions repositories compromised during the May 2026 Mini Shai-Hulud campaign have been disabled again after being accessed last week. The actions resumed executing malware, highlighting ongoing supply chain risks in CI/CD environments.
Source: The Hacker News
EvilTokens PhaaS Disrupted After Compromising 12,000 Microsoft Accounts
The EvilTokens platform, responsible for compromising over 12,000 Microsoft accounts across more than 10,000 organizations, has been disrupted following an operation led by Microsoft's Digital Crimes Unit. This action aims to prevent further account takeovers and reduce ongoing threats.
Source: BleepingComputer
BigCommerce Alerts Merchants of Data Breach via Ribon Apps
BigCommerce informed merchants of data breaches after attackers compromised credentials of third-party Ribon apps to inject malicious scripts into stores. This incident highlights risks from compromised third-party applications in ecommerce environments.
Source: BleepingComputer
CrowdSec Private GitHub Repos Copied in TanStack npm Supply Chain Attack
An attacker accessed about 170 private CrowdSec GitHub repositories using credentials stolen in the May TanStack npm package supply chain attack. The breach occurred through a compromised account of a former employee whose laptop was infected during the incident.
Source: The Hacker News
ShinyHunters exploits zero-day to breach FBI, steal sensitive data
The ShinyHunters extortion group claims to have breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, accessing internal services and stealing sensitive employee and job applicant data. This incident highlights a critical security failure in widely used enterprise software.
Source: BleepingComputer
BragJack Exploits AI Browser Agents via Malicious Extensions
BragJack is a proof-of-concept attack that hijacks AI assistants in browsers like Chrome and Edge using a single malicious extension. It uses Prompt Forcing and has earned over $20,000 in bounties plus two CVEs.
Source: BleepingComputer
Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
A financially motivated threat actor is leveraging open-source AI agent frameworks to compromise over 100 online retailers, stealing more than 600,000 credit card records. These AI-driven skimmers represent a new scale of automated cybercrime targeting e-commerce platforms.
Source: BleepingComputer
AI-Driven Secret Leaks Double Compared to Human-Coded Commits
AI coding agents speed up software development but also double the rate of secret leaks in commits. GitGuardian's 2026 report highlights a surge in AI-linked credential exposures, posing new identity risks for security teams.
Source: The Hacker News
Chapters
- Opening
- CrowdSec Private GitHub Repos Copied in TanStack npm Supply Chain Attack
- Malicious npm Packages Evade Install-Script Defenses at Runtime
- Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry
- Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution
- AI-Driven Secret Leaks Double Compared to Human-Coded Commits
- Fake LastPass Authenticator GitHub Repos Spread New Rapuncel Infostealer
- BragJack Exploits AI Browser Agents via Malicious Extensions
- BigCommerce Alerts Merchants of Data Breach via Ribon Apps
- Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
- Critical Pre-Auth RCE in Orkes Conductor Actively Exploited
- Critical Bifrost AI Gateway Flaw Allows Credentialless Command Execution
- Check Point Fixes Critical Management Server Zero-Day Exploited in Attacks
- Check Point Warns of Active Exploitation in Security Gateway VPN RCE Flaw
- CISA Adds Zyxel Switch Buffer Overflow to Known Exploited Vulnerabilities Catalog
- MikroTrick Chain Lets Attackers Control MikroTik Routers Without Credentials
- CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities
- CISA Warns of Active Exploitation of Three Linux Kernel Flaws
- WordPress Patches Critical Flaw Allowing Remote Code Execution
- Elementor WordPress CSRF Flaw Allows Admin Account Creation
- EvilTokens PhaaS Disrupted After Compromising 12,000 Microsoft Accounts
- Storm-3168: Cloud Attacks Using Compromised Azure Service Principals
- FBI & CISA Warn on Risks of Third-Party ICS Integrators in Critical Infrastructure
- North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide
- Contagious Interview Campaign Hits 30K Devices, Steals $10.7M Crypto
- Bitget Loses $351.6M in Suspected North Korean Hack
- Tracking Storm-2570's Consistent Ransomware Tradecraft
- New Carbonato Botnet Uses AI Agents to Hijack Docker Hosts
- Critical Vulnerabilities Discovered in Eufy Omni C20 and Omni X10 Pro
- ShinyHunters exploits zero-day to breach FBI, steal sensitive data
- Closing