12 stories · 4 sources · 3 critical · 6 high · ~19 min read
Coverage: Last 24 hours
Today’s Highlights
Active exploitation of critical vulnerabilities and evolving malware campaigns highlight substantial risks across email infrastructure, development pipelines, browser trust boundaries, and multi-platform endpoints. Cisco Secure Email Gateway (CVE-2026-76461) and GitLab vulnerabilities are being used to compromise enterprise mail and software supply chain operations. Adaptive malware using browser extension, Telegram-based, and MQTT communication methods broadens the attacker toolkit, underscoring the urgency of rapid incident response and robust defensive practices.
Table of Contents
- Cisco Secure Email Gateway zero‑day (CVE‑2026‑76461) under active exploitation
- CISA warns GitLab flaw is being exploited, patch urgently
- Chinese-linked attackers exploit Chrome–Windows zero‑day chain to deploy GRIMWEDGE
- Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
- Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
- Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
- Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
- Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
- Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
- KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
- BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Critical High Medium Low
Top Stories
Cisco Secure Email Gateway zero‑day (CVE‑2026‑76461) under active exploitation
Source: SecurityWeek | Risk: CRITICAL | Impacted: Cisco Secure Email Gateway customers, Enterprise perimeter email infrastructure | Topics: Cisco / Zero Day
What happened: A critical unauthenticated root‑RCE zero‑day (CVE‑2026‑76461, CVSS 9.8–10.0) in Cisco Secure Email Gateway is actively exploited in the wild.
Why it matters: Root-level remote code execution in a perimeter email gateway leaves organizations open to full compromise of mail flows and associated credentials until remediation is complete.
How it works: Cisco Secure Email Gateway is an enterprise appliance for filtering and managing inbound and outbound email. CVE-2026-76461 is a zero-day that enables unauthenticated attackers to execute code as root remotely via the mail interface.
Practitioner Perspective
Email gateways like Cisco Secure Email are critical trust boundaries for enterprises. With active exploitation in the wild, attackers gaining root access on this device may redirect email, harvest internal credentials, and pivot further inside with little resistance. This risk is magnified in organizations without layered mail security, strong segmentation, or rapid patch cycles. Patching must be prioritized before incident response, and you should scour historic logs for signs of exploitation or suspicious email flow anomalies. The key insight is that email infrastructure should never be assumed safe from endpoint or credential-based attacks.
Recommended Actions
- Immediately apply patches or mitigations for Cisco Secure Email Gateway CVE-2026-76461
- Inspect email gateway logs for anomalous configurations, credential creation, or relay modification since vulnerability disclosure
- Isolate or restrict external connectivity on vulnerable gateways pending patching
- Aggressively hunt for post-exploitation activities inside the mail environment
CISA warns GitLab flaw is being exploited, patch urgently
Source: TechRadar (via CISA KEV catalog update) | Risk: CRITICAL | Impacted: Enterprises and vendors using GitLab, CI/CD and DevOps pipelines | Topics: Gitlab / Active Exploitation
What happened: CISA added a GitLab vulnerability to its Known Exploited Vulnerabilities catalog, warning it’s actively being exploited and urging immediate patching.
Why it matters: Supply chain risks escalate when attackers exploit flaws in CI/CD tools like GitLab, enabling them to compromise both build pipelines and downstream software artifacts.
How it works: GitLab is a self-hosted DevOps platform used to manage source code, pipelines, and software releases. The listed vulnerability is severe enough for CISA KEV catalog, indicating widespread exploit activity targeting these environments.
Practitioner Perspective
With CISA officially flagging active exploitation, organizations running unpatched GitLab are at real risk of both source code theft and malicious tampering with software releases. A breach at this level can empower adversaries to implant persistent backdoors or distribute exploits downstream to customers. Defensive focus should be on rapid patch deployment, retroactive code integrity validation, and tracing for evidence of build artifacts or credentials being exfiltrated. Supply chain security posture must adapt to treat internal dev tools as high-value targets subject to continuous review.
Recommended Actions
- Apply GitLab security updates associated with the known actively exploited CVE
- Review project and runner logs for signs of credential theft, source code access, or pipeline modification
- Perform forensic analysis on recent builds to detect unauthorized changes or backdoors
- Rotate keys and tokens stored or accessed by GitLab if compromise is suspected
Chinese-linked attackers exploit Chrome–Windows zero‑day chain to deploy GRIMWEDGE
Source: The Hacker News (via news.mlab.sh) | Risk: CRITICAL | Impacted: Enterprise Windows desktops, Organizations with delayed Chrome/Windows patching | Topics: Chrome / Windows
What happened: A Chrome–Windows zero‑day chain exploited by China‑linked UTA0560 group to deploy GRIMWEDGE backdoor enabling file management and payload delivery.
Why it matters: A zero-day chain across Chrome and Windows elevates attacker opportunities to bypass user and endpoint controls, gifting footholds deep within enterprise environments when desktop patch cycles lag.
How it works: The UTA0560 group chained a Chrome browser zero-day with a Windows OS zero-day to gain initial access on desktops and drop the GRIMWEDGE backdoor, giving file and payload management capability inside enterprise networks.
Practitioner Perspective
Chinese-linked APT usage of chained Chrome and Windows zero-days to deliver a persistent backdoor should trigger immediate concern across organizations managing large desktop fleets. Supply chain compromise and remote access are highly likely in targeted environments, particularly where users habitually run with excess privilege or delay browser/OS patching. Defensive teams need to prioritize attacking the kill chain, hunt for both exploitation traces and GRIMWEDGE malware activity, not just initial browser compromise. Time-to-response matters: a single missed endpoint invites lateral movement and deeper persistence.
Recommended Actions
- Apply emergency patches for both Chrome and Windows addressing the exploited zero-day chain
- Proactively hunt for GRIMWEDGE backdoor IOCs using current threat intelligence and EDR data
- Correlate endpoint and browser telemetry for signs of chained exploit activity to inform response efforts
- Isolate potentially compromised systems until full remediation is confirmed
Exploits & CVEs
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Source: The Hacker News | Published: Sep 16 | Risk: HIGH | Impacted: WordPress ecommerce sites, Online stores using WooCommerce, Sites with Wholesale Lead Capture plugin | Topics: Threat Actor / Exploit
What happened: Attackers are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin, allowing unauthenticated users to upload arbitrary files, including PHP backdoors, leading to remote code execution. Over 100,000 exploit attempts have been blocked since June 2026. Site owners are advised to check for unexpected .php files in the uploads directory and monitor for suspicious requests to ‘/wp-admin/admin-ajax.php’ with the ‘wwlc_file_upload_handler’ action.
Why it matters: This vulnerability gives unauthenticated attackers full control of affected WordPress environments, providing a straightforward vector to establish long-term persistence and use compromised sites as launching pads for further attacks.
How it works: WooCommerce Wholesale Lead Capture is a WordPress plugin used to manage B2B customer onboarding. The vulnerability allows attackers to upload arbitrary files (such as PHP web shells) without authentication, enabling remote code execution at the site level.
Practitioner Perspective
If your WordPress environment leverages the WooCommerce Wholesale Lead Capture plugin, treat this as a high-urgency incident. The opportunistic nature of widespread exploit attempts means defenders should assume compromise on any unpatched or recently patched system. This kind of file-upload bug is routinely abused by both commodity and targeted actors to land web shells, escalate privileges, or plant additional malware. Prioritize forensic review of recent uploads and access logs, do not rely solely on patching to fully remove attacker presence. The most important step is to verify no PHP shells remain after any code or plugin updates.
Recommended Actions
- Scan uploads directory for unauthorized .php files in WordPress instances running WooCommerce Wholesale Lead Capture
- Monitor for requests to ‘/wp-admin/admin-ajax.php’ with ‘wwlc_file_upload_handler’ parameter
- Update WooCommerce Wholesale Lead Capture plugin to the latest patched version immediately
- Review recent administrative actions and audit for secondary persistence mechanisms typical of web shell deployments
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
Source: The Hacker News | Published: Sep 16 | Risk: HIGH | Impacted: Organizations running WSO2 API Manager, Publicly exposed API endpoints | Topics: Exploit / Vulnerability
What happened: A critical vulnerability in WSO2 API Manager, identified as CVE-2026-5430, allows attackers to bypass JWT authentication by using unsupported algorithms, potentially leading to unauthorized access and account takeover. Active exploitation attempts have been observed, with forged JWT tokens granting administrative privileges. Users are advised to apply available fixes promptly.
Why it matters: Attackers can forge admin-level JWTs to achieve full API access, undermining authentication and potentially exposing sensitive APIs and backend systems.
How it works: WSO2 API Manager is an API gateway solution that provides centralized control over APIs. The vulnerability (CVE-2026-5430) allows attackers to generate admin-level JWTs using unsupported signing algorithms, bypassing authentication checks.
Practitioner Perspective
Organizations using WSO2 API Manager must recognize the ease with which critical APIs can be compromised if this CVE remains unaddressed. JWT misimplementation is frequently exploited for privilege escalation and lateral movement, especially where APIs operate without sufficient secondary controls. Active exploitation signals that opportunistic and targeted attackers are seeking out these weak deployments. Confirming integrity of authentication and reviewing API logs for anomalous access are essential. The top concern should be how quickly you can patch and then validate for unauthorized token usage.
Recommended Actions
- Apply the WSO2 API Manager CVE-2026-5430 fix without delay
- Review access logs for signs of forged JWTs granting admin privileges
- Audit authentication and token parsing libraries to ensure unsupported JWT algorithms are blocked
- Revoke any active tokens issued before patching if compromise is suspected
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Source: The Hacker News | Published: Sep 15 | Risk: HIGH | Impacted: Environments exposing Marimo to the internet, Networks relying on SSH bastion hosts, Organizations with weak segmentation | Topics: Exploit / Vulnerability
What happened: A human attacker exploited a Marimo RCE vulnerability to gain SSH access to a bastion host in eight seconds, using a custom Python toolkit without AI assistance.
Why it matters: Manual exploitation by a skilled attacker can rapidly breach sensitive infrastructure layers when remote code execution is exposed, especially if network segmentation and monitoring are weak.
How it works: Marimo is a platform (presumably for interactive notebooks or development) with an RCE vulnerability. Attackers can trigger code execution and move laterally (such as to SSH bastions) rapidly if the service is exposed.
Practitioner Perspective
Incidents like this highlight that sophisticated threat actors need only seconds to escalate from RCE to deep access, particularly in environments where SSH bastions are not tightly monitored. Automated defenses will struggle to keep pace in the absence of robust alerting and forensic readiness. Teams must scrutinize any exposure of Marimo or similar platforms and validate that all internet-facing resources are least-privilege and audited. Consider re-evaluating the assumptions underlying privileged access management for your bastion hosts. Your best defense is layered detection and minimizing attack exposure time.
Recommended Actions
- Remove or restrict internet exposure of Marimo installations with known RCE vulnerabilities
- Instrument detailed monitoring on SSH bastion hosts for anomalous lateral movement post-breach
- Deploy real-time alerting for exploitation of RCE bugs in custom Python toolchains
- Force rotation of credentials associated with breached bastion hosts following any compromise
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Source: The Hacker News | Published: Sep 15 | Risk: HIGH | Impacted: DevOps teams using Vite, Cloud infrastructure with exposed dev servers, AWS and Azure environments | Topics: Exploit / Cloud
What happened: Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that’s designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs.
Why it matters: Attackers leveraging dev server misconfigurations to extract sensitive cloud credentials directly expose both application source and infrastructure control to remote compromise.
How it works: Vite is a development build tool for modern web applications. If misconfigured or left exposed, the Vite dev server can leak cloud provider credentials and state configuration files to unauthenticated attackers.
Practitioner Perspective
If you run internet-facing Vite dev servers, the campaign demonstrates that attackers are aggressively scanning for such hosts in order to harvest AWS, Azure and other cloud secrets. This turns even short-lived or test environments into major breach vectors, especially if cloud provider credentials or state files are cached there. Organizations must revisit which environments are actually exposed and treat exposed CI/CD, test, and dev infra as targets. Immediate removal or remediation of externally accessible dev endpoints is vital. Your most substantial risk is that cloud compromise is achieved without any alert if attackers grab valid secrets.
Recommended Actions
- Identify and take offline all publicly accessible Vite servers not required for external use
- Scan storage locations and logs on Vite servers for unauthorized access to AWS, Azure, and infrastructure files
- Reset credentials and rotate secrets exposed on compromised development endpoints
- Implement network controls so dev and CI/CD frameworks like Vite cannot be internet-facing by default
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
Source: SecurityWeek | Published: Sep 16 | Risk: HIGH | Impacted: Web hosts using cPanel, Acronis backup plugin users, Multi-tenant hosting environments | Topics: Exploit / Threat Intel
What happened: CVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation. The post Acronis Patches Exploited Vulnerability in cPanel Backup Plugin appeared first on SecurityWeek.
Why it matters: Local privilege escalation in widely deployed backup plugins can enable attackers to convert low-level footholds into full control over hosting environments, potentially affecting backup integrity and data recovery.
How it works: Acronis Backup Plugin integrates with cPanel to automate and manage backups. CVE-2026-87886 is an insecure file permissions vulnerability that can lead to local privilege escalation on the host.
Practitioner Perspective
Any provider or admin relying on cPanel with Acronis Backup Plugin should assume threat actors could escalate privileges from simple web or shell access. Exploited file permission issues often allow automation or malware to subvert host protections, particularly when multiple tenants or workloads share infrastructure. Review backup server accessibility, monitor for suspicious privilege changes, and verify restoration chain-of-custody. Ignore such issues and attackers may quietly corrupt backups or harvest cleartext data. Your highest priority is closing off privilege escalation and certifying backup integrity post-remediation.
Recommended Actions
- Apply the Acronis Backup Plugin for cPanel patch addressing CVE-2026-87886
- Audit backup servers for signs of local privilege escalation attempts or tampered backup files
- Restrict local access and monitor for anomalous privilege escalations on cPanel hosts
- Validate disaster recovery workflows to ensure uncorrupted backups following update
Emerging Signals
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
Source: The Hacker News | Published: Sep 15 | Risk: HIGH | Impacted: Dissidents and journalists, Advocacy and nonprofit sectors, Windows endpoints with internet access | Topics: Exploit / Vulnerability
What happened: Cybersecurity agencies from the U.S., U.K., and Netherlands have identified a Windows malware, controlled via Telegram, used by Iran’s Ministry of Intelligence and Security to spy on dissidents, journalists, and activists globally. The malware can access emails, chat messages, take screenshots, and activate microphones to record audio.
Why it matters: Attackers leveraging Telegram-based command and control can evade many network security controls, enabling persistent espionage against sensitive user populations.
How it works: This Windows malware family uses Telegram, an encrypted messaging platform, to establish command and control, facilitating remote access, data theft, and user surveillance. Telegram-based C2 can bypass many standard proxy and firewall policies.
Practitioner Perspective
If your user base includes journalists, NGOs, or dissidents, this type of campaign represents persistent and targeted risk. Telegram-based C2 channels often go unmonitored by legacy security stacks, allowing adversaries to maintain remote control and exfiltrate data for extended periods. The technical ability of the malware to access communications, use system resources, and surveil users indicates a multi-pronged approach to surveillance. Review endpoint activity for suspicious processes communicating with Telegram, and treat malware persistence as likely if infection timelines are unclear. Your primary concern should be monitoring for non-traditional C2 and controlling privileged access on endpoints.
Recommended Actions
- Hunt for malware processes using Telegram APIs or network traffic to Telegram from high-risk Windows users
- Inspect for unauthorized access to email, chat clients, and microphone activation on targeted systems
- Deploy EDR solutions with behavioral detection for Telegram-controlled remote access tools
- Engage at-risk user populations to educate on spear phishing vectors tied to Iranian threat actors
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Source: The Hacker News | Published: Sep 15 | Risk: MEDIUM | Impacted: Brazilian banking users, Organizations using unmanaged browsers, High-value financial endpoints | Topics: Exploit / Vulnerability
What happened: The KREMLIN malware targets Brazilian banking customers by delivering a malicious browser extension through deceptive documents. This extension steals credentials and session tokens from Chrome and Edge browsers. The operation employs multi-stage loaders, custom installers, and blockchain to conceal its infrastructure.
Why it matters: Compromise of Chrome and Edge via malicious extensions enables attackers to exfiltrate credentials and hijack online banking sessions, causing direct financial losses and downstream identity risks.
How it works: The KREMLIN malware leverages malicious extensions in Google Chrome and Microsoft Edge browsers to steal user credentials and active sessions. Its deployment chain involves multi-stage loaders and uses blockchain networks for control or infrastructure obfuscation.
Practitioner Perspective
This threat targets users through social engineering and document-based initial access, bypassing typical browser extension controls. Banking and enterprise environments often ignore the extension threat model, leaving credential theft and session hijack detection weak. The use of blockchain for infrastructure concealment complicates takedown and attribution. Defenders responsible for browser fleet management should urgently review allowed extension policies and investigate for the presence of unauthorized add-ons. The most critical action is to validate browser security hygiene in populations with access to financial data.
Recommended Actions
- Audit Chrome and Edge extension lists for unauthorized or suspicious additions in at-risk user environments
- Block installation of extensions not vetted by security for users accessing sensitive banking platforms
- Hunt for initial access vectors involving document loaders distributing KREMLIN malware
- Identify post-compromise activity indicating exfiltration of credentials or session tokens
BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Source: The Hacker News | Published: Sep 15 | Risk: MEDIUM | Impacted: Organizations in Asia and South America, Windows and Linux endpoints, IoT/OT environments with MQTT messaging | Topics: Exploit / Vulnerability
What happened: Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America. Activity linked to the malware has been detected as recently as July 2026.
Why it matters: Using MQTT as a C2 protocol allows threat actors to quietly manage footholds across Windows and Linux, bypassing conventional network detection due to its use in IoT and cloud-native messaging.
How it works: BambooToken is a remote access malware that uses the Message Queueing Telemetry Transport (MQTT) protocol, a lightweight publish-subscribe messaging system popular in IoT and cloud-native applications, for command and control on both Windows and Linux systems.
Practitioner Perspective
Organizations operating mixed-platform networks need to understand the growing trend of abusing IoT-centric protocols for malware C2. BambooToken’s use of MQTT gives attackers more cover in environments where this protocol is allowed, especially in tech or operations teams using device messaging systems. Because campaign activity has persisted for over a year and targets Asia and South America, reevaluate your internal visibility into MQTT traffic and endpoint persistence mechanisms. Pinpointing lateral movement and identifying cross-platform infection will be harder than with traditional RATs. Focus defense on MQTT telemetry and on host-based signs of novel persistence.
Recommended Actions
- Baseline and monitor MQTT protocol traffic for anomalous patterns within enterprise networks
- Hunt for unknown persistence mechanisms on Windows and Linux systems where MQTT is enabled
- Correlate endpoint alerts for BambooToken-related behaviors with network-based MQTT activity
- Educate infrastructure teams on risk of malware blending with legitimate IoT traffic
Also Today
- Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point: Explores why focusing only on technique-level defense overlooks multi-step attacks that can bypass layered controls, urging teams to validate full attack chains not just single events.
Defensive Actions
- Immediately apply or verify patches and mitigations for Cisco Secure Email Gateway CVE-2026-76461
- Deploy GitLab and related CI/CD security updates promptly, and audit recent projects for abnormal activity
- Baseline and monitor exposed Vite development servers, and eliminate unnecessary external access
- Rotate compromised or potentially exposed AWS, Azure, and GitLab credentials
- Hunt for chained zero-day exploitation activity targeting Chrome and Windows, and search for GRIMWEDGE backdoor artifacts
- Scan uploads directories and monitor admin-ajax requests for indicators of WooCommerce Wholesale Lead Capture exploitation
- Audit Chrome and Edge extension installations and browser security hygiene for unauthorized add-ons
- Review endpoint and network activity for evidence of Malware leveraging Telegram or MQTT-based command and control
What We’re Watching
- Further exploitation trends for Cisco Secure Email Gateway CVE-2026-76461 and coordinated patch rollouts
- Discovery or active targeting of new zero-days in Chrome or Windows desktop environments
- Circulation and impact of GitLab vulnerability exploitation in the software supply chain
- Indicators of expanded GRIMWEDGE backdoor deployment beyond initial enterprise targets
- Signs of increased abuse of MQTT or Telegram as command and control channels in both targeted and opportunistic campaigns
Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply