🚨 ACTIVE EXPLOITATION
CISA warns of active exploitation of three Linux kernel flaws, one critical
CISA has added three actively exploited Linux kernel vulnerabilities to its KEV catalog, ordering federal agencies to patch by end of day.- Applies to organizations running Linux kernels; federal agencies must patch and perform forensic triage on affected assets.
- CVE-2025-39964: race condition in the AF_ALG cryptographic socket interface, present for 14 years, rated critical; demonstrated with privilege escalation and container escape in Google's kernelCTF.
- CVE-2026-53266: out-of-bounds write in ebtables SNAT that can modify shared file-backed memory; known exploit confirmed by Red Hat.
- CVE-2025-39682: kTLS receive-path flaw mishandling zero-length records; public exploits available per Red Hat.
- CISA has not disclosed details about the threat actors or incidents; none of the flaws is flagged as used by ransomware groups.
Zyxel GS1900 switch buffer overflow CVE-2026-7273 added to CISA KEV
CVE-2026-7273
CISA has added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, to its KEV catalog.- Affects Zyxel GS1900 series switches; federal agencies must apply mitigations by 2026-09-24 under BOD 26-04.
- The flaw is a stack-based buffer overflow in a CGI program that could allow OS command execution.
- A LAN-based, unauthenticated attacker can exploit it via a crafted HTTP request.
💥 BREACHES & INCIDENTS
ShinyHunters hacks Clop ransomware leak site, steals data and Tor keys
ShinyHunters breached and defaced the Clop ransomware gang's Tor leak site and is now extorting Clop.- Affects the Clop (Cl0p) ransomware operation, whose Tor data leak site was hijacked on September 19, 2026
- ShinyHunters exploited a claimed unauthenticated file upload vulnerability in Grav CMS to upload a taunting message, then fully defaced the site with Umbreon ASCII art
- ShinyHunters claims to have stolen source code, Grav CMS plugins, /var/log files, and the private keys for Clop's Tor onion service
- The group demands an eight-figure payment rising every 24 hours, plus a public apology, and threatens to expose companies that paid Clop during its Oracle E-Business Suite extortion campaign
- The attack is retaliation in a feud stemming from Clop's 2025 Oracle EBS campaign, which used exploits including CVE-2025-61882 that ShinyHunters claims originally belonged to them
OWASP API Security project website serving third-party 'security notice' page, sparking compromise claims
The OWASP API Security project website appears to have been taken over, currently displaying a NOX Offensive Security page.- Users of api-security.owasp.org (OWASP's API Security project site) are affected.
- The site currently serves a page from NOX Offensive Security asking visitors to contact them for a responsible disclosure of an unidentified vulnerability.
- A Reddit post by user tpasmall flagged the apparent compromise of the site.
- The notice page is signed by 0xAspros and links to noxoffsec.com.
🕵️ RESEARCH & DEEP DIVES
- Kaspersky: New Malware Distributed via Torrents of Popular Films Hits Hundreds of Victims
Kaspersky has uncovered a multi-stage malware campaign distributing a previously unknown strain via torrents disguised as popular films.- Individuals and organizations in Russia, Türkiye, Japan, Kenya, Uganda, Colombia, and several European countries affected; sectors include enterprise, government, IT, consulting, retail, transportation, and agriculture.
- Malware is disguised as torrents for popular films, including The Odyssey, delivered via a compromised public torrent archive; active since at least mid-August.
- Multi-stage design: loader detects antivirus sandboxes, modules establish persistence, bypass Windows UAC, and give attackers remote access.
- C2 server address is retrieved via the Solana blockchain, making infrastructure resilient to takedowns.