🚨 ACTIVE EXPLOITATION
F5 BIG-IP APM zero-day CVE-2026-94127 added to CISA KEV
CVE-2026-94127
A zero-day heap-based buffer overflow in F5 BIG-IP APM (CVE-2026-94127) has been added to CISA's KEV catalog.- Affects F5 BIG-IP APM when both an access policy and an OAuth profile are configured on a virtual server.
- The flaw is a heap-based buffer overflow that allows unauthenticated attackers to achieve remote code execution.
- CISA added CVE-2026-94127 to the KEV catalog with a patching due date of 2026-09-25.
Sources 📄 Source: my.f5.com · 📎 Coverage: mastodon.social · 👁 via @campuscodi@mastodon.social, CISA KEVChinese hackers exploit WordPress, Zyxel flaws to steal government data
A Chinese-speaking threat actor has exploited WordPress and Zyxel switch vulnerabilities to steal data from 996 devices and over 18,500 database records.- Targets include small businesses, government entities, and at least 49 organizations in 29 countries via WordPress wp2shell flaws (CVE-2026-63030, CVE-2026-60137).
- Zyxel GS1900 Smart Managed Switch flaw (CVE-2026-7273) exploited since August 17, compromising 996 devices in 48 countries to extract configurations and hashed root credentials.
- In one Western government intrusion, attackers used 17 scripts over 36 minutes to bypass AMSI, escalate privileges, and steal 18,566 records with plaintext passwords and PII from a backend SQL server.
- Activity attributed to a Red Heron-related actor, tracked by GreyNoise since early June 2026 from a single IP; also targeted Ubiquiti UniFi OS (CVE-2026-34908/09/10), PAN-OS GlobalProtect, FlowiseAI, Nuclio, Proxmox VE, Gitea, and SENAITE LIMS.
- GreyNoise published IOCs including backdoor hashes and C2 infrastructure.
WordPress Patches Critical Unauthenticated LFI Flaw (CVE-2026-87902) as Probing Begins
CVE-2026-87902
WordPress fixed a critical unauthenticated local file inclusion flaw in core, and attackers began probing sites hours after the patch.- Affects WordPress core versions 4.7.0 through 7.1.1; fixed in 7.1.2 (released September 22, 2026) with backports to every supported branch down to 4.7.37
- CVE-2026-87902, CVSS 9.2: path traversal in page template resolution lets unauthenticated attackers load PHP files outside theme folders, with conditional RCE on some servers
- Exploitation requires the active theme to have a top-level folder starting with page- and, for code execution, PHP register_argc_argv enabled (off by default on PHP 8.5)
- Probing began at 17:44 UTC on September 22, under five hours after the patch, using double-encoded payloads like %252e%252e in the pagename parameter with a valid page_id
- Observed sources include 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b, mostly using Go-http-client/1.1 user agents
Sources 📄 Source: github.com · 📎 Coverage: patchstack.com · 👁 via The Hacker News, patchstack.com (discovered)
💥 BREACHES & INCIDENTS
- Microsoft disrupts EvilTokens device-code phishing service that hit 12,000 Microsoft accounts
Microsoft's Digital Crimes Unit led a disruption of the EvilTokens phishing-as-a-service platform, which compromised over 12,000 Microsoft accounts.- Targets Microsoft 365 accounts across wholesale distribution, construction, financial services, real estate, higher education, and healthcare sectors, with 97.5% of compromised accounts on enterprise domains in 79 countries.
- EvilTokens abused Microsoft's OAuth 2.0 device-code authentication flow to steal authentication tokens despite MFA, compromising 12,000+ inboxes at 10,000+ organizations and fueling BEC campaigns.
- Delivered via phishing lures impersonating document-signing platforms, Microsoft services, invoicing, and voicemail services; sold on Telegram for $500/month or $1,500 one-time with 44 customizable kits.
- Evaded detection using multi-stage redirects, PDFs, HTML attachments, fake CAPTCHA pages, and routing through compromised sites and legitimate cloud platforms like Vercel, Cloudflare Workers, and AWS Lambda.
- Microsoft seized 50 websites and disabled 150+ domains; two suspected administrators aged 32 and 38 were arrested in the U.K., though the threat remains active with clones like APToken already emerging.
🔓 CVEs & KEV
CVE-2026-28325 — SolarWinds Observability Self-Hosted — CVSS 8.8 — SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vu...
CVE-2026-76714 — Hewlett Packard Enterprise (HPE) ALE — CVSS 7.2 — Authenticated Remote Code Execution with Elevated Privileges Vulnerability in...
CVE-2026-76713 — Hewlett Packard Enterprise (HPE) ALE — CVSS 7.2 — Authenticated Remote File System Access Vulnerability in HPE Networking Analy...
CVE-2026-76715 — Hewlett Packard Enterprise (HPE) ALE — CVSS 7.1 — Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulne...
🕵️ RESEARCH & DEEP DIVES
GitGuardian finds 474 leaked GitHub App private keys still valid, exposing CDC and BuildBuddy
GitGuardian researchers found 474 of 4,802 leaked GitHub App private keys still valid, allowing impersonation of 440 apps including the CDC and BuildBuddy.- Applies to GitHub App owners and organizations installing them, including the US CDC, BuildBuddy, GitHub Actions tooling, and other CI/CD integrations.
- 474 of 4,802 tested keys (from 500,000+ leaked RSA keys) still authenticated as 440 distinct GitHub Apps; keys never expire until manually rotated.
- 72% of compromised Apps could read private repositories, 207 could write to them, 44 had full org admin privileges, 98 could control workflows, and 40 could administer self-hosted runners — enabling full organization takeover.
- Attack works by signing a JWT with the leaked RSA private key to obtain installation access tokens indistinguishable from the App's own; keys leaked in PEM format alongside App IDs are easily detectable.
- Most affected parties were slow or unresponsive to disclosure; most keys were reportedly still active at publication, and CDC took about two weeks to rotate its key.
North Korea-linked WaterPlum infects thousands of devices worldwide via fake job offers
North Korea-linked hackers infected tens of thousands of devices through fake job offers, stealing $10.8 million in crypto.- Targets software developers and IT professionals in Japan, the US, Europe, and beyond; attacks occurred December 2025–July 2026 and remain active, per a joint FBI, Australian, German, and Japanese advisory.
- Over 7,000 crypto wallets had funds or credentials stolen, with $10.8 million transferred to the DPRK.
- Hackers pose as prospective employers, impersonating AI, cryptocurrency, and NFT companies and using recruiting services to contact victims via social media and job platforms.
- Victims are told during virtual interviews or technical assignments to download and execute malicious files that give backdoor access to their networks.
- FBI and Japan's NPA identified 'enablers' in the US and Japan facilitating the operation.
Malicious npm package "tw-pkgprobe-7731" poses as Twilio bug-bounty probe to steal credentials
A malicious npm package posing as a Twilio bug-bounty security probe was found exfiltrating Twilio credentials and environment data.- Targets developers integrating Twilio into their applications via the npm registry.
- Package "tw-pkgprobe-7731" published 11 versions in ~45 minutes in mid-August 2026 by account "twdepprobe7731," which has since been removed.
- Posed as an "Authorized bug-bounty research probe (Twilio HackerOne program)"; exits unless run in a Twilio developer environment.
- Later versions scanned for Twilio SID folders, injected a custom npm package into node_modules, and exfiltrated process.env.ACCOUNT_SID and process.env.AUTH_TOKEN.
- Final versions probed Twilio hosts (support-api.us1.twilio[.]com, kafka-ui.au1.twilio[.]com, litellm.ai-services.corp.twilio[.]com) and fetched AWS metadata at 169.254.169[.]254/latest/meta-data/.
New Windows kernel technique achieves arbitrary function execution via thread pool work items, bypassing HVCI and CET
A researcher has published a binary exploitation technique that uses Windows kernel thread pool work items to achieve arbitrary function execution while bypassing HVCI and CET mitigations.- Applies to the Windows kernel (ntoskrnl), targeting the KPRIQUEUE in nt!ExWorkerQueue.
- With an arbitrary write primitive, an attacker injects a fake WORK_ITEM into the kernel worker queue; a worker thread dequeues it