View Ridge Security
Back to Cyber Hose

Critical ScreenConnect flaw now actively exploited in attacks

Active exploitation of a critical ScreenConnect flaw headlines this digest, alongside WordPress RCE flaws exposing 200k+ sites and a 280k-person medical breach.

🕵️ RESEARCH & DEEP DIVES

  • All remaining support acts quit Ed Sheeran's US tour after Macklemore dropped over 'Free Palestine' remarks
    Ed Sheeran's remaining US tour support acts, including Finneas and Beoga, have quit after Macklemore was dropped for pro-Palestinian remarks on stage.

    • All remaining support acts on Ed Sheeran's US Loop tour — Finneas, Aaron Rowe, Lukas Graham, and Beoga — announced departures in protest.
    • Macklemore was removed after performing 'Hind's Hall' and calling for a 'Free Palestine' at MetLife Stadium shows in early September 2026.
    • Sheeran said the removal was the promoter's decision (Messina Touring Group) and that he avoids politics because his audience includes children.
    • Macklemore said billionaire Robert Kraft, owner of Gillette Stadium, organized the boycott; Kraft confirmed barring him, citing 'antisemitic rhetoric'.
    • Venues told promoters they would not allow Macklemore to perform, threatening cancellation of the whole tour.
    Sources 📄 Source: instagram.com · 📎 Coverage: bbc.co.uk · 👁 via @GossiTheDog@cyberplace.social

  • Secure design reviews and architecture checkpoints strengthen the SDLC
    Security Boulevard outlines how secure design reviews and architecture checkpoints catch design weaknesses early in the software development lifecycle.

    • Aimed at UK SMEs and software teams building security into the development lifecycle
    • Secure design reviews and architecture checkpoints surface design weaknesses before code is written or dependencies are locked
    • The practice improves software security without relying on late-stage testing alone
    Sources 📎 Coverage: securityboulevard.com · 👁 via securityboulevard.com (discovered)

  • Critical ScreenConnect flaw now actively exploited in attacks — <https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/|BleepingComputer>

  • Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover — <https://www.securityweek.com/unauthenticated-rce-flaws-could-expose-200000-wordpress-sites-to-takeover/|SecurityWeek>

  • Hackuity Raises $19 Million for AI-Powered Vulnerability Management — <https://www.securityweek.com/hackuity-raises-19-million-for-ai-powered-vulnerability-management/|SecurityWeek>

  • 280,000 Impacted by Premier Medical Group Data Breach — <https://www.securityweek.com/280000-impacted-by-premier-medical-group-data-breach/|SecurityWeek>

  • Fake CAPTCHA Scams — <https://www.schneier.com/blog/archives/2026/09/fake-captcha-scams.html|Schneier on Security>

  • Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People — <https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/|404 Media>

  • Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation — <https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html|The Hacker News>

  • Threat Intelligence Alone Won't Close the Exploitation Gap — <https://thehackernews.com/2026/09/threat-intelligence-alone-wont-close.html|The Hacker News>

  • Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks — <https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html|The Hacker News>

  • Atomic macOS (AMOS) Stealer Activity — <https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/|Palo Alto Unit 42>

  • net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()In the Linu... — <https://cve.threatint.com/CVE/CVE-2026-90049?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()In the Linux k... — <https://cve.threatint.com/CVE/CVE-2026-90048?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • drm/xe: Don't hand out the flat CCS storage as usable VRAMIn the Linux kernel... — <https://cve.threatint.com/CVE/CVE-2026-90047?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • mm/page_alloc: don't spin_trylock() in NMI on UPIn the Linux kernel, the foll... — <https://cve.threatint.com/CVE/CVE-2026-90046?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • USB: gadget: ffs: fix mm lifetime handlingIn the Linux kernel, the following ... — <https://cve.threatint.com/CVE/CVE-2026-90045?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • usb: gadget: f_fs: Fix Use-After-Free in AIO error pathIn the Linux kernel, t... — <https://cve.threatint.com/CVE/CVE-2026-90044?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • zram: fix slot lock bit position on big-endian 64-bitIn the Linux kernel, the... — <https://cve.threatint.com/CVE/CVE-2026-90043?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • ceph: properly decrypt filenames in vmalloc() buffersIn the Linux kernel, the... — <https://cve.threatint.com/CVE/CVE-2026-90042?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • HID: sony: clean up device list on probe failureIn the Linux kernel, the foll... — <https://cve.threatint.com/CVE/CVE-2026-90041?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zappedIn... — <https://cve.threatint.com/CVE/CVE-2026-90040?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • NFSD: Guard admin state-revocation walks with NFSD_NET_UPIn the Linux kernel,... — <https://cve.threatint.com/CVE/CVE-2026-90039?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • NFSD: Prevent client use-after-free during export state revocationIn the Linu... — <https://cve.threatint.com/CVE/CVE-2026-90038?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • NFSD: Prevent client use-after-free during close_lru reapingIn the Linux kern... — <https://cve.threatint.com/CVE/CVE-2026-90037?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • NFSD: Prevent client use-after-free during blocked-lock reapingIn the Linux k... — <https://cve.threatint.com/CVE/CVE-2026-90036?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • drm/amd/display: fix division by zero in get_estimated_bw()In the Linux kerne... — <https://cve.threatint.com/CVE/CVE-2026-90035?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • usb: image: mdc800: change kmalloc() to kzalloc()In the Linux kernel, the fol... — <https://cve.threatint.com/CVE/CVE-2026-90034?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()In the Linux ker... — <https://cve.threatint.com/CVE/CVE-2026-90033?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • media: usbtv: keep device alive while ALSA card existsIn the Linux kernel, th... — <https://cve.threatint.com/CVE/CVE-2026-90032?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • usb-storage: ene_ub6250: fix race between scan work and probeIn the Linux ker... — <https://cve.threatint.com/CVE/CVE-2026-90031?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • usb: dwc3: clear forceRM when issuing EndTransferIn the Linux kernel, the fol... — <https://cve.threatint.com/CVE/CVE-2026-90030?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Securing the unpatchable in an age of AI-driven vulnerabilities — <https://blog.talosintelligence.com/securing-the-unpatchable-in-an-age-of-ai-driven-vulnerabilities/|Cisco Talos>

  • Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites — <https://cybersecuritynews.com/espionage-infrastructure/|Cyber Security News>

  • 700+ OpenAI Agents Built Their Own Message Board to Coordinate an Attack on Hugging Face — <https://cybersecuritynews.com/700-openai-agents/|Cyber Security News>

  • Top 10 Best Multi-Cloud Security Platforms in 2026 — <https://cybersecuritynews.com/best-multi-cloud-security-platforms/|Cyber Security News>

  • Axoflow Launches AxoDetect, Bringing Detection Into the Pipeline and Making the SIEM Optional — <https://securityboulevard.com/2026/09/axoflow-launches-axodetect-bringing-detection-into-the-pipeline-and-making-the-siem-optional/|securityboulevard.com (discovered)>

  • The Coast Guard and FBI are investigating after two oil tankers bound for the U.S. — <https://infosec.exchange/@metacurity/117280410886618165|@metacurity@infosec.exchange>

  • The Spanish Data Protection Agency has registered the first cyberattack carried out autonomously by an artificial... — <https://infosec.exchange/@metacurity/117280373380160409|@metacurity@infosec.exchange>

  • The anonymous hacker group SikLik claimed to have breached the infrastructure of Russia’s Central Election Commission... — <https://infosec.exchange/@metacurity/117280320727089539|@metacurity@infosec.exchange>

  • NightEagle targets Russian companies — <https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/|Securelist (Kaspersky)>

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check