🚨 ACTIVE EXPLOITATION
- CISA adds exploited Zyxel GS1900 switch flaw CVE-2026-7273 to KEV catalog
CISA has added an actively exploited Zyxel GS1900 switch vulnerability (CVE-2026-7273) to its KEV catalog after a suspected Chinese actor compromised nearly 1,000 devices.- Applies to Zyxel GS1900 series Smart Managed Switches running firmware 2.90 versions and earlier, including GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, and -48HPv2 models.
- CVE-2026-7273 is a high-severity stack-based buffer overflow in a CGI program allowing unauthenticated LAN attackers to execute OS commands via crafted HTTP requests.
- GreyNoise observed a suspected Chinese-speaking actor exploit the flaw and exfiltrate sensitive data from 996 switches across 48 countries as of September 17, 2026.
- The campaign targeted over a dozen other vulnerabilities across a wide range of software and tech products.
- Zyxel released patched firmware on June 16; CISA ordered FCEB agencies to patch by Thursday under BOD 26-04.
💥 BREACHES & INCIDENTS
- GHAPPIER supply chain attack poisons npm package and hits 65 GitHub repositories
A supply chain attack tracked as GHAPPIER poisoned the npm package @dforge-core/dforge-mcp with a remote code loader and compromised 65 GitHub repositories.- Developers and organizations depending on the npm package @dforge-core/dforge-mcp were exposed; the attack reached 65 GitHub repositories, infecting 73 files across 22 accounts.
- Malicious version 0.2.21 carried a hidden remote code loader; clean version 0.2.22 followed within about 36 minutes.
- On September 9 an intruder used the package maintainer account for 105 minutes, inserting the loader and rewriting the release workflow for unattended publication.
- The poisoned release carried valid npm provenance via GitHub Actions OIDC trusted publishing, with a Sigstore attestation recording the attacker's commit.
- The loader, hidden in one line of a 99 KB file, launched a four-stage chain with a self-deleting final component; a linked PolinRider payload reads C2 data from Ethereum blockchain transactions and harvests cached Git credentials.
Sources 📄 Source: cloudsek.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-89422 — Erlang OTP — CVSS 9.3 — TLS 1.3 client skips server authentication when ServerHello carries an unsoli...
CVE-2026-86296 — D-Link DIR-822A — CVSS 9.3 — D-Link Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without Authentication
CVE-2026-95511 — Red Hat Enterprise Linux 10 — CVSS 8.2 — Cups: cups-filters: cups-filters: lpadmin can escalate to root via privileged...
CVE-2026-95508 — Red Hat Enterprise Linux 10 — CVSS 7.4 — Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on ...
CVE-2026-95503 — Red Hat Build of Keycloak — CVSS 6.8 — Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerb...
🕵️ RESEARCH & DEEP DIVES
SideCopy Expands India Targeting to Academia With ReverseRAT Spear-Phishing
Pakistan-linked SideCopy is spear-phishing Indian academic institutions to deploy the ReverseRAT backdoor.- Targets: academic institutions in India, expanding beyond SideCopy's historical focus on Indian defense and government entities
- Delivers a weaponized ZIP containing an LNK file disguised as "commskll.docx" with a spoofed PDF icon
- LNK fetches an obfuscated HTA from "docsportal[.]in" and executes it via mshta.exe, reflectively loading a DLL dropper
- Multi-stage in-memory XAML payload via .NET deserialization deploys ReverseRAT, which steals system metadata, screenshots, passwords, clipboard data and supports remote execution
- C2 traffic encrypted with hard-coded key; data exfiltrated via port 5863 to "dns.educationportals[.]biz" (45.61.157[.]22)
SpyCloud: nearly 1 in 5 US water and wastewater organizations have active infostealer credential exposure
A SpyCloud study found 1,787 of about 10,000 analyzed US water and wastewater organizations have credentials actively exposed by infostealers.- Applies to US water and wastewater utilities; SpyCloud analyzed 10,000 organizations from a database of 66,845 EPA-registered systems.
- 1,787 organizations showed active infostealer exposure; 258 of them carried credentials to operational technology or remote-access systems.
- One infected device at an unnamed smart meter provider held saved logins for roughly 167 US utility metering tenants, a cascading supply chain exposure.
- Infostealer logs contain stolen session cookies, credentials, and autofill data that can bypass MFA via session hijacking; access brokers sell them to ransomware crews.
- The study measured identity exposure, not OT devices or confirmed intrusion; SpyCloud began responsible disclosure with a CISA briefing.
- Exposure concentrated in larger operators and the vendor supply chain, with small utilities largely underrepresented.
Context Bombs Trick Autonomous Qwen AI Agents Into Stopping Cyberattacks
Tracebit researchers used hidden 'context bomb' prompts in cloud decoys to make autonomous Qwen3.8-27B AI agents halt their simulated attacks.- Applies to autonomous AI hacking agents, tested on original Qwen3.8-27B and Blackfrost AI's 'abliterated' version in a controlled AWS environment.
- Context bombs are defensive strings embedded in vulnerable resources like AWS Secrets Manager that agents encounter while scanning.
- Earlier payloads triggering safety refusals failed; a new indirect prompt injection disguised as a valid operator command told the agent to end its assessment, and both Qwen versions complied.
- Over 82 runs, the standard model gained admin privileges in 20.5% of 39 attempts versus 2.3% for the abliterated version, which was also slower (28.4–29.9 min vs 13.5 min for first critical action).
- Findings show abliteration (weight-level refusal removal) does not improve hacking effectiveness and highlight indirect prompt injection risk where hostile data is read as legitimate directives.
Sources 📄 Source: tracebit.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- 📄 Source for Suspected Chinese-speaking actor exploits wp2shell chain to steal 18,566 government records — greynoise.io