🚨 ACTIVE EXPLOITATION
- Check Point patches Management Server zero-day (CVE-2026-93616) exploited in attacks
Check Point has released emergency hotfixes for a critically exploited Security Management Server zero-day that allows arbitrary script execution.- Applies to Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
- CVE-2026-93616 is a path traversal flaw letting unauthenticated attackers upload and execute arbitrary scripts in low-complexity attacks; exploited in the wild against a handful of customers.
- Fixed in R82.20 Security Hotfix; temporary mitigation includes restricting access to trusted IPs via SmartConsole Trusted Clients settings.
- Check Point advises checking networks for exploitation using IOCs from its security advisory.
💥 BREACHES & INCIDENTS
ShinyHunters claims FBI breach, says it holds data on all FBI employees and applicants
ShinyHunters claims it hacked FBI-related systems and stole personal data on all FBI employees and applicants.- FBI employees, former employees, and job applicants are impacted; a 5,000-person sample includes names, home addresses, phone numbers, dates of birth, and spouse details.
- ShinyHunters says it exploited a zero-day in Oracle PeopleSoft, then accessed AWS GovCloud servers and exfiltrated 2-3 terabytes of data.
- The group defaced the FBI jobs site and says Apply.fbijobs.gov and the Special Agent Applicant Portal are unavailable.
- The group says the motive is not financial, describing planned pressure as 'coercion' rather than extortion; the FBI has not commented.
Autonomous AI agents hack online retailers for ~$25 per victim, steal 600,000 credit cards
An operator used three open-source AI tools to autonomously hack dozens of online retailers, stealing over 600,000 credit card records at a mean cost of $25 per victim.- Victims include a Fortune 500 hospitality firm, a major US airline, an industrial supplies distributor, an online fashion retailer, and a bicycle retailer; at least 27 companies were compromised between September 10-15, 2026.
- Over 600,000 credit card records were stolen from two victims, roughly 79% belonging to US holders, and card skimmers were confirmed on 19 named victims plus 100+ additional infected sites.
- The campaign used three open-source AI tools: Strix for autonomous vulnerability discovery, Cairn for end-to-end exploitation, and Hermes to orchestrate intrusions, loaded with 121 skills (78 offensive) plus a custom skill to strip its own content-safety filters.
- The operator spent $12,000-$18,000 on AI model access via OpenRouter, using Anthropic's Opus 4.6 and Chinese models DeepSeek and Kimi, issuing only brief Chinese-language commands across 260 Hermes sessions.
- One documented attack chain used unauthenticated SQL injection, plaintext OTP reading to bypass MFA, a web shell, root escalation via misconfigured sudo, NFS pivoting, AWS Secrets Manager dumping, and Magento encryption key extraction to decrypt stored card numbers; a 'Database Wipe After Extraction' skill erased card fields and dropped 180 tables at two victims.
Sources 📄 Source: gambit.security · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
- CVE-2026-86805 — The GNU C Library glibc — CVSS 7.0 — AT_SECURE programs may load attacker-controlled code via $ORIGINA time-of-che...
🕵️ RESEARCH & DEEP DIVES
CERT Polska details MikroTrick zero-day chain giving unauthenticated full takeover of MikroTik routers
CERT Polska published a technical analysis of MikroTrick, a zero-day attack chain against MikroTik RouterOS that allowed full device takeover without authentication.- Applies to MikroTik routers running RouterOS; patches released 3 September 2026 for branches 7.25beta3, 7.24.2, 7.23.4, and 6.49.21.
- Chain combines CVE-2026-67279 (SSH server mishandles a rekey during user authentication, skipping to channel handling without SSH_MSG_USERAUTH_SUCCESS) with CVE-2026-86060 (username passed unvalidated to /nova/bin/login, allowing argument injection via -N file-descriptor syntax).
- Chained, the flaws grant full administrative privileges without knowing a password, possessing an SSH key, or completing authentication.
- Observed attacks used a failed SSH login for user '-2' followed by creation of a privileged 'ops' account; an attacking IP of 82.192.72.4 appeared in administrator logs posted on the MikroTik forum and Reddit.
- RouterOS 7.23.4 added a Flagged rule detecting an ops account in the full group as an indicator of compromise at startup.
Graphalgo malware campaign spreads to Terraform providers and Go modules
Aikido discovered Go malware linked to the Graphalgo NPM campaign distributed via malicious Terraform providers and Go modules.- Affects Terraform and Go developers: malicious providers gocommunity-io/dockerd and kreuzwenker/docker (a typosquat of kreuzwerker/docker, which has 56M downloads), plus Go modules gocommunity.io/orderedbtree and gogets.dev/btreex.
- The malware is a Go port of the Graphalgo NPM malware first reported by ReversingLabs in February 2026, sharing blockchain and Slack infrastructure and a public key with the JavaScript samples.
- Hidden entry points activate only when the SHA256 hash of concatenated containerName and networkID variables matches b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5, making the provider inert except under targeted conditions.
- The hash serves as an AES key to decrypt a payload ZIP (examples/resources/docker_container/import-resource.sqlite3, SHA256 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f), which is decrypted and executed via a detached 'go run'.
- The second-stage Go RAT exfiltrates system info to a Slack channel (frontend-devs) and uses dual C2 via Slack workspaces and an Ethereum smart contract on Arbitrum Sepolia (0xAD02b5cDE693529d3bdA0266299501ad0193036C) with ephemeral key-based encrypted communications.
📋 ADVISORIES
CISA warns of critical auth bypass in Siemens Industrial Edge Management (CVE-2026-18963)
Siemens Industrial Edge Management contains a critical authentication bypass allowing unauthenticated remote attackers to take over user accounts.- Affects Industrial Edge Management Cloud (all versions), Pro V1 1.14.9–1.15.20, Pro V2 2.2.0–2.2.2, and Virtual 2.6.0–2.9.1; CVSS 9.1 critical.
- The flaw (CVE-2026-18963, CWE-640) in the keycloak-services password reset flow lets attackers reset any user's credentials without the email verification link, achieving full account takeover.
- Exploitation is unauthenticated and remote; the affected reset-credentials path is /auth/realms/customer/login-actions/reset-credentials.
- Siemens released fixed versions (Pro V1 1.15.20+, Pro V2 2.2.2+, Virtual 2.9.1+); the Cloud instance was mitigated via firewall rules on 2026-08-26 and fixed on 2026-09-02.
- Siemens ProductCERT reported the vulnerability to CISA in advisory ICSA-26-265-06; critical manufacturing sector, deployments worldwide.
CISA warns of XSS flaw in OpenPLC Runtime v3 that could let attackers hijack PLC control
CISA released an ICS advisory for a cross-site scripting vulnerability (CVE-2026-88020) in Autonomy Logic OpenPLC Runtime v3.- Affects Autonomy Logic OpenPLC Runtime v3, deployed worldwide in critical manufacturing, energy, transportation, and water/wastewater sectors.
- CVE-2026-88020 is a CWE-79 cross-site scripting flaw (CVSS v3.1 6.1 Medium) in the web interface, which routes programs based on a query string parameter without encoding.
- Successful exploitation could hijack session cookies and issue state-changing requests as an operator, giving control of the PLC and the physical processes it drives.
- OpenPLC v3 is end-of-life and no longer receiving patches; the vendor recommends upgrading to OpenPLC v4.
- No known public exploitation targeting this vulnerability has been reported; reported by Rajivarnan R. and Shirshak of Secnora.
CISA warns of code execution flaw (CVE-2026-34223) in Siemens Desigo CC V6/V7 clients
Siemens has disclosed a client code execution vulnerability in Desigo CC V6 and V7 with no fix currently available.- Affects Siemens Desigo CC ClickOnce and Installed Clients, V6 and V7, all versions; V8, V9, and Flex Clients are not affected.
- CVE-2026-34223 (CWE-94 code injection, CVSS 3.1 score 8.2) stems from insufficient input validation of scripts embedded in user-defined graphics documents.
- Opening a maliciously crafted graphics document executes embedded script on the client instance, letting an attacker write arbitrary files to the client OS.
- Exploitation requires enticing a user with sufficient privileges to display the crafted document; success could enable client OS compromise and lateral movement.
- No fix is currently available; the flaw was reported to Siemens by Michelin CERT.
📌 4 | *CISA warns of 'Copy Fail' flaw (CVE-2026-31431) in Siemens SIPLUS