12 stories · 2 sources · 1 critical · 5 high · ~15 min read
Coverage: Last 24 hours
Today’s Highlights
Critical vulnerabilities and targeted exploits dominated the security landscape this cycle, including active exploitation of Cisco’s Secure Email Gateway (CVE-2026-76461), a privilege escalation flaw in LiteSpeed Web Server Enterprise, and targeted zero-day attacks by advanced persistent threat (APT) actors. Defenders are facing complex operational risks as attackers leverage rapid exploit chains and automation, illustrated by Apple, WordPress, and hosting provider exposures. Hardware attacks like DDRop breaking confidential computing protection and new supply chain controls for WordPress plugins round out major defensive priorities.
Table of Contents
- Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack
- Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
- China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
- Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
- New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
- 3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
- Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
- WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
Critical High Medium Low
Top Stories
Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack
Source: SecurityWeek | Published: Sep 15 | Risk: HIGH | Impacted: macOS users, Windows users, Reddit account admins | Topics: Vulnerability / Threat Intel
What happened: Ads led to a ClickFix page designed to trick macOS and Windows users into installing malware. The post Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack appeared first on SecurityWeek.
Why it matters: The attack used a high-profile brand’s Reddit presence and embedded ads to deliver malware payloads to unsuspecting users, showing how trusted community accounts can be weaponized for broad distribution.
How it works: Attackers compromised or abused access to a prominent Reddit account and posted promotions linking to ClickFix, a platform abused for social engineering, enticing users into downloading malware for various platforms. This highlights risk where community moderation or credential hygiene is weak, and users trust posts from official or verified accounts.
Practitioner Perspective
Any organization employing Reddit or similar social platforms for communication needs to implement strong credential control and monitoring. High-profile accounts offer both amplification and easy target value for adversaries, especially as promotions or recommendations may be viewed as legitimate by end users. Routine reviews of account security and rapid response to suspicious behavior are required to reduce downstream malware risk.
Recommended Actions
- Enable multi-factor authentication on all organization-managed Reddit and social media accounts
- Conduct regular audits of account permissions and moderation history for official channels
Exploits & CVEs
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Source: The Hacker News | Published: Sep 15 | Risk: CRITICAL | Impacted: Organizations using Cisco Secure Email Gateway (ESA), Large enterprises with perimeter email appliances, Government agencies | Topics: Ics Ot / Vulnerability
What happened: Cisco has identified a critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway, tracked as CVE-2026-76461, which has been actively exploited. This flaw allows unauthenticated remote attackers to execute arbitrary commands with root privileges by sending crafted email messages containing malicious SQL statements. The vulnerability affects both physical and virtual Cisco Secure Email Gateway devices running versions 15.5 and earlier, 16.0, and 16.5. Cisco has released patches for these versions and recommends updating to the latest supported release. Indicators of compromise include suspicious SQL statements in mail logs and unexpected uploads or downloads from external IP addresses. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply the patches by September 17, 2026.
Why it matters: This is a pre-auth remote code execution on perimeter email defenses, already exploited in the wild. Attackers could take control of Secure Email Gateway appliances to steal, alter, or reroute sensitive email traffic, as well as pivot deeper into internal networks.
How it works: Cisco Secure Email Gateway, formerly known as Email Security Appliance (ESA), uses AsyncOS to filter enterprise email. CVE-2026-76461 allows unauthenticated attackers to send crafted emails with malicious SQL, leading to root-level command execution on the appliance.
Affected / Fix: Fixed in latest AsyncOS releases for versions 15.5 and earlier, as well as 16.0 and 16.5; patches are available from Cisco.
Practitioner Perspective
Any organization running Cisco Secure Email Gateway (physical or virtual) is at immediate risk. Active exploitation means it’s not a hypothetical scenario, exposure equals probable compromise. Review are not enough: apply the patch or mitigate immediately, and check for signs of exploitation including mail logs and anomalous file transfers. Defender focus should shift from just patching to rapid compromise assessment and incident response due to active abuse. Patch deadline requirements from CISA further underline urgency for public sector and regulated industries.
Recommended Actions
- Apply Cisco patches for CVE-2026-76461 on all Secure Email Gateway devices (physical and virtual) without delay
- Review mail logs for suspicious SQL statements as potential indicators of compromise
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
Source: The Hacker News | Published: Sep 15 | Risk: HIGH | Impacted: NGOs and non-profits, Academic institutions, Users of Google Chrome and Windows | Topics: Vulnerability / Ai
What happened: A Chinese threat actor exploited vulnerabilities in Google Chrome and Windows to deliver the GRIMWEDGE backdoor to multiple NGOs on September 1, 2026. The attack involved spear-phishing emails leading to a U.S. university website with a reflected XSS vulnerability, initiating a multi-stage exploit chain.
Why it matters: Sophisticated attackers are chaining browser and OS zero-days to target NGOs and academics, circumventing mature endpoint defenses and exploiting trusted third-party infrastructure as initial access vectors.
How it works: Attackers exploited vulnerabilities in both Google Chrome (browser) and Microsoft Windows (OS) to execute a multi-stage backdoor. The initial access began with spear-phishing and a trusted university site compromised by reflected XSS (cross-site scripting) to launch the exploit chain.
Practitioner Perspective
This campaign illustrates how even environments with up-to-date security controls can be breached when attackers leverage chains of zero-days, here in Chrome and Windows, to deliver bespoke payloads like GRIMWEDGE. Any organization with high-risk user groups (NGOs, academic institutions, policy organizations) should assume they are viable targets, not just bystanders. Cross-site scripting on a trusted university site was used to bootstrap the attack, emphasizing that supply chain trust extends beyond signed code to web content integrity. If you operate in or serve high-risk verticals, accelerate browser and OS patch cycles, and scrutinize trusted third-party domains as potential delivery vectors.
Recommended Actions
- Ensure all endpoints are running latest Chrome and Windows versions with all recent patches applied
- Monitor for execution or persistence of GRIMWEDGE backdoor, especially on high-risk user machines
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
Source: The Hacker News | Published: Sep 14 | Risk: HIGH | Impacted: Organizations with public Gitea servers, DevSecOps pipelines, Taiwanese businesses, Software development teams | Topics: Vulnerability / Exploit
What happened: A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. “Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,” Acronis Threat Research Unit (TRU)
Why it matters: Organizations running internet-exposed Gitea instances may have suffered code compromise and credential theft, resulting in persistent supply chain and software integrity risk across multiple regions.
How it works: Gitea is a self-hosted Git repository management platform. The exploited vulnerability permitted remote code execution on exposed servers, allowing attackers to run arbitrary code, harvest credentials, and insert malicious changes into repositories.
Practitioner Perspective
Red Heron’s rapid exploitation highlights the critical need to close RCE windows on developer-facing infrastructure like Gitea. Systems in Taiwan and companies with globally exposed instances are especially at risk from APT campaigns seeking to compromise pipeline secrets and inject malicious code. Post-exploitation, attackers may have persistent access via implants or stolen admin credentials, so a mere patch is insufficient: hunt for evidence of deeper compromise. Assume all exposed instances have been scanned and prioritize forensic review.
Recommended Actions
- Patch all public-facing Gitea instances for the recent RCE vulnerability
- Investigate exposed instances for signs of Red Heron persistence, lateral movement, and credential theft
Emerging Signals
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
Source: The Hacker News | Published: Sep 14 | Risk: HIGH | Impacted: Cloud service providers, Confidential computing tenants, Co-location facilities | Topics: Vulnerability / Exploit
What happened: Researchers have disclosed DDRop, a hardware attack that compromises memory protection in Intel TDX and AMD SEV-SNP by silently dropping writes to server memory, allowing processors to read outdated encrypted data as current. This attack requires brief physical access to the server to insert a low-cost interposer between the processor and memory module. DDRop is the first active interposer attack effective on DDR5 memory in current cloud servers and the first to break the integrity of an up-to-date Intel TDX system.
Why it matters: Hardware-backed protections for confidential computing, like Intel TDX and AMD SEV-SNP, can be bypassed if attackers achieve even brief physical access to the server, undermining cloud tenant isolation and integrity assumptions.
How it works: Intel TDX (Trust Domain Extensions) and AMD SEV-SNP (Secure Encrypted Virtualization) are processor technologies providing encrypted memory isolation for VMs. The DDRop attack uses a physical hardware interposer to tamper with memory writes, causing processors to read outdated, but valid, encrypted data, thereby breaking data integrity without alerting software.
Practitioner Perspective
Any organization relying on hardware-encrypted memory isolation for sensitive workloads (government, crypto, healthcare) must reconsider their models if physical access by attackers is plausible, such as in shared datacenters or co-location scenarios. DDRop is a new class of hardware attack that doesn’t require expensive infrastructure, making it feasible for sophisticated insiders or supply-chain threat actors. This attack erodes trust in confidential computing against hardware-level attackers and raises the bar for physical security and server chain of custody. If physical tampering is a realistic concern in your environment, defense must extend well beyond application-layer controls.
Recommended Actions
- Audit Intel TDX and AMD SEV-SNP deployments for exposure to physical access risks in their operational environments
- Reassess trust models for highly sensitive workloads running on DDR5-equipped servers in shared or untrusted facilities
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
Source: The Hacker News | Published: Sep 14 | Risk: HIGH | Impacted: Internet service providers, Internal IT admin teams, Subscriber databases | Topics: Ics Ot / Vulnerability
What happened: An attacker infiltrated Thailand’s 3BB network, deploying MeshCentral as a hidden backdoor to gain root access to internal servers and targeted subscriber credentials.
Why it matters: Undetected deployment of a legitimate remote management tool like MeshCentral as a backdoor can allow attackers to maintain persistent root access and exfiltrate credentials from internal infrastructure.
How it works: MeshCentral is an open-source remote management platform used for legitimate IT support but can be covertly installed to provide external attackers with root administration access, bypassing traditional remote access controls and audit trails.
Practitioner Perspective
Defenders need to expect attackers to use ‘off-the-shelf’ admin tools (such as MeshCentral) to blend in and establish long-term access. Any compromise of network operators or ISPs is especially high risk, customer data and infrastructure become part of the adversary’s value chain. This illustrates how remote management solutions, often whitelisted and trusted, can be weaponized post-intrusion. Hunt for unexpected MeshCentral installs and be prepared to review historical access and credential leaks.
Recommended Actions
- Scan internal networks for unauthorized MeshCentral installations and active processes
- Isolate any infrastructure with unexplained MeshCentral access pending full investigation
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
Source: The Hacker News | Published: Sep 14 | Risk: MEDIUM | Impacted: Telegram Desktop users, Staff managing chat data exports, Organizations archiving chat for compliance | Topics: Vulnerability / Exploit
What happened: A flaw in Telegram Desktop allowed bots to embed hidden JavaScript in exported HTML chats, enabling exfiltration of messages when opened in a browser. Telegram addressed the issue in July, but existing exports remain vulnerable.
Why it matters: Sensitive chat exports from Telegram can still be exfiltrated if previously exported HTML files are opened in a browser, allowing attackers to abuse already-leaked data even after the app is patched.
How it works: Telegram Desktop allows chat histories to be exported as HTML files. A flaw allowed embedded JavaScript in these files, which, when viewed in a browser, could send chat content to an attacker-controlled site without user awareness.
Affected / Fix: Issue addressed by Telegram in July for new exports; previously created HTML exports remain vulnerable.
Practitioner Perspective
Telegram Desktop users who have exported HTML chat histories prior to July remain exposed to embedded malicious JavaScript contained in those files. If these exports are shared or opened by others, the risk persists despite patching the client going forward. The threat is acute where staff have used chat exports for compliance, archiving, or migration, not realizing those files contain executable code. Mitigation mandates retroactive review and possible cleansing of legacy exports, not just updating the desktop client.
Recommended Actions
- Identify and quarantine historical Telegram Desktop HTML chat exports created before July
- Educate staff on risk of opening Telegram HTML exports in browsers, even internally
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
Source: The Hacker News | Published: Sep 14 | Risk: MEDIUM | Impacted: Site owners using WordPress.org plugins, DevOps teams automating WordPress plugin deployment, Web agencies managing multiple WordPress sites | Topics: Vulnerability / Exploit
What happened: WordPress has announced it’s launching an automated security review for every release of a plugin before it’s distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved. “New plugins are reviewed before they enter the directory, but updates ship continuously after that,” David Perez, WordPress Official Plugin
Why it matters: Automated pre-release plugin security reviews can flag risky code before it reaches production, reducing the likelihood of widespread compromise from legitimate but vulnerable WordPress plugins.
How it works: WordPress.org now uses automated systems to scan every plugin update for vulnerabilities before release, supplementing human review but applying continuously as plugins update through the WordPress API.
Affected / Fix: Security review automation applies to all plugins distributed via WordPress.org; no action required for base platform.
Practitioner Perspective
Organizations reliant on WordPress need to recalibrate CI/CD and deployment playbooks, as plugin updates now undergo automated security vetting. This may reduce the velocity of zero-day plugin exploitation but could also alter release timings and require closer monitoring for delayed or blocked updates. Defenders should not assume all risk is eliminated, attacker attention may shift to exploiting plugins from outside the official ecosystem or targeting review bypasses. Treat this as a baseline improvement, not a silver bullet.
Recommended Actions
- Monitor and document all automated plugin review alerts or blocks in WordPress deployment logs
- Test critical workflows for plugin updates, as rollout may now be gated or delayed
Also Today
- LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server: A critical LiteSpeed Web Server Enterprise bug could grant root to low-privilege users; cPanel urges updates to 6.3.7.
- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits: Attackers continue to automate exploits and leverage old and new vulnerabilities across popular platforms.
- AI Changed the Exposure Problem. Validation Needs to Change With It.: The influx of CVEs due to AI automation makes triage and validation a growing challenge for defenders.
- Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints: Microsoft’s Humanist AI Code of Conduct draws specific lines between research and offensive cyber capabilities.
Defensive Actions
- Apply Cisco patches for CVE-2026-76461 on all Secure Email Gateway devices without delay
- Upgrade all LiteSpeed Web Server Enterprise deployments to version 6.3.7 immediately
- Patch all public-facing Gitea instances for the recent RCE vulnerability
- Ensure all endpoints are running latest Chrome and Windows versions with all recent patches applied
- Audit Intel TDX and AMD SEV-SNP deployments for exposure to physical access risks
- Monitor and document all automated plugin review alerts or blocks in WordPress deployment logs
- Identify and quarantine historical Telegram Desktop HTML chat exports created before July
- Scan internal networks for unauthorized MeshCentral installations and active processes
What We’re Watching
- Ongoing exploitation attempts and incident disclosures tied to Cisco Secure Email Gateway CVE-2026-76461
- Rapid Gitea RCE probes and possible supply chain compromise stemming from Red Heron actor activity
- DDRop-class hardware attacks targeting Intel TDX and AMD SEV-SNP servers in major data centers
- Retrospective exposure assessment for Telegram Desktop HTML chat exports
- Deployment efficacy of new WordPress automated plugin review systems and potential circumvention attempts
Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply