Stay updated with the latest cybersecurity news. This daily roundup covers claimed government breaches, AI-driven crime platforms, actively exploited critical vulnerabilities, supply-chain malware, and new router takeover chains so you can prioritize patches and detection before attackers do.
1. ShinyHunters Claims FBI Breach via Alleged PeopleSoft Zero-Day
Published: 2026-09-23
Extortion group ShinyHunters claimed it breached FBI systems using a new Oracle PeopleSoft remote-code-execution zero-day, then moved into FBI-managed AWS GovCloud. The group says it stole 2–3 TB of data covering current and former agents, job applicants, and services including Criminal Justice, HR, and Medlink. It also defaced apply.fbijobs.gov. The FBI said it is investigating unauthorized activity affecting FBIjobs.gov and has not confirmed the full scope of data theft. Outlets including 404 Media said sample agent records they reviewed appeared authentic.
2. Microsoft Disrupts EvilTokens, an AI Phishing-as-a-Service Platform
Published: 2026-09-22
Microsoft’s Digital Crimes Unit disrupted EvilTokens (Storm-2992), a subscription phishing service that used device-code phishing plus an AI chatbot to mine stolen inboxes for payment authority, trusted contacts, and impersonation targets. Microsoft linked the platform to more than 12,000 compromised inboxes across 10,000+ organizations, with heavy impact in the U.S., Canada, the U.K., Australia, India, and France. Partners seized 50 websites and disabled 150+ domains. U.K. Metropolitan Police arrested two men. Coinbase traced about $1.1 million in platform revenue. Clones may still appear.
3. Check Point Confirms Active Exploitation of Security Gateway VPN RCE
Published: 2026-09-23
Check Point confirmed active exploitation of CVE-2026-85102 (CVSS 9.8), a pre-auth RCE in VPN certificate handling on Security Gateway and Spark firewalls. Exploitation against Spark customers began around September 12 from anonymizing infrastructure using certificates such as CN=vpn. CISA added the bug to its Known Exploited Vulnerabilities catalog with a September 25 federal deadline. A separate management-server path-traversal/upload RCE, CVE-2026-93616, was also added to KEV after limited in-the-wild use. Apply LivePatch Take 26 or the listed Jumbo hotfixes immediately and hunt anomalous certificate-based VPN logins.
4. Attackers Exploit Critical WordPress Core Flaw CVE-2026-87902
Published: 2026-09-23
Threat actors moved from reconnaissance to exploitation of CVE-2026-87902, a critical unauthenticated path-traversal/LFI in WordPress page-template resolution (CVSS 9.2). Under certain themes and PHP settings (register_argc_argv on, PEAR gadgets present), it can become RCE. WordPress 7.1.2 and backports down to 4.7.37 fix it. Patchstack saw probes within hours of the patch, then a 10x jump in traffic and payloads writing PHP files that execute shell commands. Update now, then search for unexpected files under /tmp and /var/tmp with names such as poc87902.php or wp-pear-rce-flag.php.
5. Autonomous AI Agents Steal 600,000+ Credit Cards From Retailers
Published: 2026-09-23
Gambit Security reported a financially motivated operator using open-source agent frameworks—Strix (scanning), Cairn (autonomous exploitation), and Hermes (orchestration, including Claude Opus)—against online retailers since at least July. In one five-day window the operator launched 105 attack projects and compromised at least 27 companies. Researchers recovered more than 600,000 unexpired card records from two victims, confirmed skimmers on dozens of sites, and found targeting of a Fortune 500 hospitality firm, a major U.S. airline, an industrial distributor, and a fashion retailer. Average cost was about $25 per completed scan. Some agent “cleanup” routines wiped Magento card fields after theft.
6. CLOSEDQUORUM Malware Lets Up to Four AI Models Vote on Next Moves
Published: 2026-09-23
Cisco Talos documented CLOSEDQUORUM, a Go-based Windows implant that, after compromise, queries commercial models (including Gemini, DeepSeek, Qwen, and Mistral), tallies their votes, and executes the winning action without a traditional human-run C2 server. Possible actions include stealing Windows credentials, browser passwords, and crypto-wallet data. The design reduces operator workload and makes takedowns harder because there is no single attacker command channel. Treat unexpected outbound LLM API traffic from endpoints as a hunting signal, not just a productivity feature.
7. Attackers Abuse HashiCorp Terraform Registry to Deliver Go Malware
Published: 2026-09-23
Researchers disclosed Go malware distributed through two Go modules and two Terraform providers on HashiCorp’s centralized registry—the first documented use of that registry as a payload delivery channel. The campaign overlaps with techniques seen in North Korean-linked supply-chain activity. Anyone who terraform inits a malicious provider can pull attacker code into CI/CD and developer workstations. Pin provider versions, verify publisher identity, restrict registry sources, and scan lockfiles for unexpected modules.
8. MikroTrick Chain Takes Over Exposed MikroTik Routers With No Password
Published: 2026-09-23
CERT Polska detailed MikroTrick, a chain of two RouterOS SSH flaws (CVE-2026-67279 and CVE-2026-86060) that lets attackers gain full administrative control of internet-exposed MikroTik routers without a password, SSH key, or completed authentication. Exploitation has been logged since September 2. Exposed management interfaces remain a high-value foothold for botnets, VPN pivots, and ISP-scale disruption. Patch RouterOS, disable WAN SSH, and restrict management to a jump host or VPN.
Also watching
- GitLab issue-by-email addresses act as credentials. Anyone who obtains the private issue-email address can push commits and start CI jobs as you, including on main. Rotate leaked addresses and treat them like tokens. Read more
- F5 patched an exploited BIG-IP APM zero-day enabling unauthenticated RCE on systems acting as OAuth servers. Read more
- Ransomware volume hit a 2026 monthly record in August, with 1,073 confirmed victims and industry remaining the most targeted sector, according to NCC data. Read more
- North Korea-linked WaterPlum compromised about 30,000 devices and stole roughly $10.7 million from crypto wallets via fake job-interview lures. Read more
Stay Vigilant
The through-line this week is speed: AI agents compressing multi-stage retail compromises into hours, phishing kits that read inboxes for you, and critical patches being exploited the same day they ship. Prioritize internet-facing appliances (Check Point, F5, MikroTik), WordPress core updates, and supply-chain controls for Terraform/npm/PyPI. Review OAuth device-code flows and unexpected LLM API calls from endpoints. Subscribe for the next daily drop, and treat “we patched last week” as incomplete until you confirm the September 22–23 emergency releases are actually installed. Stay safe online.