Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, nation-state campaigns, data breaches, and emerging AI-driven threats so you can brief readers and tighten defenses in a fast-moving threat landscape.
1. ShinyHunters Claims FBI Breach via New Oracle PeopleSoft Zero-Day
Published: 2026-09-22
The ShinyHunters extortion group claims it exploited a previously unknown Oracle PeopleSoft zero-day to access FBI systems, move into AWS GovCloud infrastructure, and steal 2–3 TB of data on employees and job applicants. The FBI confirmed it is investigating claims of unauthorized activity affecting FBIjobs.gov but has not confirmed a breach or data theft.
2. Check Point Patches Actively Exploited Management Server Zero-Day
Published: 2026-09-22
Check Point released emergency hotfixes for CVE-2026-93616, a path-traversal flaw in Security Management Server that lets unauthenticated attackers upload and run scripts. The company said the bug was exploited in a handful of targeted attacks and also affects Multi-Domain Management, Log Server, and SmartEvent. Apply the R82.20 hotfix and restrict management-plane access to trusted IPs if you cannot patch immediately.
3. WordPress Issues Critical Core Patch That Can Lead to Code Execution
Published: 2026-09-22
WordPress 7.1.2 (and backports through 4.7) fixes CVE-2026-87902, a critical unauthenticated path-traversal / local file inclusion bug in page-template resolution (CVSS 4.0: 9.2). On some theme and server setups, an attacker with no account can force WordPress to include a readable PHP file outside the theme and reach remote code execution. Site owners should update immediately rather than waiting for the next maintenance window.
4. Chinese-Linked Actors Exploit Zyxel and WordPress Flaws to Steal Government Data
Published: 2026-09-22
A Chinese-speaking threat actor has exploited CVE-2026-7273 in Zyxel GS1900 switches plus WordPress weaknesses to compromise nearly 1,000 devices and more than 18,500 backend records. CISA added the Zyxel bug to its Known Exploited Vulnerabilities catalog and ordered U.S. federal civilian agencies to patch by Thursday. GreyNoise described this as the first public in-the-wild exploitation of CVE-2026-7273.
5. ClosedQuorum Windows Malware Uses Multiple AIs to Choose Next Attack Step
Published: 2026-09-22
Cisco Talos documented ClosedQuorum, a Go-based Windows implant that queries Google Gemini, DeepSeek, Qwen, and Mistral and then votes on post-compromise actions such as credential theft, injection, or persistence. Stolen data is sent over a Discord webhook, so after initial delivery the campaign can run with little human direction. Researchers call it the first publicly documented Windows implant to hand tactical C2 decisions to a panel of AI models.
6. Microsoft and Partners Disrupt EvilTokens AI Phishing Service
Published: 2026-09-22
Microsoft’s Digital Crimes Unit led a takedown of EvilTokens, a device-code phishing-as-a-service platform that used AI across the attack chain and was linked to about 12,000 compromised Microsoft accounts at more than 10,000 organizations. Partners seized 50 websites and disabled 150-plus domains; UK police arrested two men. Microsoft correlated at least $1.7 million in reported FBI IC3 losses to the service.
7. Foreign Hackers Tamper With OT at Two Colorado Water Utilities
Published: 2026-09-22
Colorado officials said foreign actors briefly breached two small private water utilities in late August, changing equipment settings, disabling remote access and alarms, and altering pumping cycles. Officials said treatment, water quality, and public safety were not affected. The governor’s office has not named the utilities or confirmed attribution, but noted ongoing Iranian-linked targeting of U.S. water and wastewater systems flagged by CISA.
8. Gyazo Breach Exposes 23.6 Million User Records and 490 Million Metadata Rows
Published: 2026-09-21
Helpfeel confirmed attackers exploited a Gyazo image-upload server flaw on September 11 and stole about 23.62 million user records plus roughly 490 million image metadata records (mostly uploads from 2019 or earlier). Stolen account data includes names, emails, password hashes, device IDs, session IDs, and some social/SSO tokens. Payment cards were not taken, but metadata can help reconstruct image URLs and includes OCR text pulled from screenshots.
9. North Korea’s WaterPlum Infects 30,000 Devices via Fake Job Interviews
Published: 2026-09-22
A joint advisory from Japan, the U.S., Australia, and Germany says North Korea’s WaterPlum (Contagious Interview) group used fake recruiter pitches and coding tests to infect at least 30,000 devices in 100-plus countries. Agencies say the campaign compromised more than 7,000 crypto wallets and moved about $10.71 million to Pyongyang. Malware families cited include BeaverTail, InvisibleFerret, OtterCookie, and StoatWaffle; activity is assessed as overlapping North Korea’s overseas IT-worker scheme.
Stay Vigilant
Today’s mix is familiar but sharper: unauthenticated enterprise and CMS flaws, OT interference at small utilities, supply-chain and screenshot-platform data theft, and AI used both as a phishing co-pilot and as on-host malware decision logic.
Practical actions for this cycle:
- Patch WordPress to 7.1.2 (or the matching backport), Check Point Management Server, Zyxel GS1900 firmware, and any internet-facing PeopleSoft / ISE / firewall management planes.
- Treat unexpected recruiter coding tests, device-code MFA prompts, and third-party ecommerce app keys as high-risk.
- Review OT remote access, alarm paths, and network segmentation for water, healthcare, and other critical systems.
- If you used Gyazo, rotate passwords and assume older screenshot metadata and OCR text may be in attacker hands.
Subscribe for the next daily roundup. Stay safe online.