12 stories · 5 sources · 1 critical · 3 high · ~10 min read

Coverage: Last 24 hours

Today’s Highlights

Defenders faced urgent updates for critical vulnerabilities in WordPress and Zyxel GS1900 switches, with confirmed exploitation threatening wide swathes of internet-facing infrastructure. Emergent threats highlight the risk of npm supply chain compromise and expanding phishing campaigns targeting new sectors like academia. Meanwhile, attackers are deploying more autonomous, AI-powered malware and leveraging SaaS misconfigurations, making immediate response and broad visibility paramount.

Table of Contents

1. WordPress Patches ‘Click2Shell’ Vulnerability
2. Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
3. WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
4. SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
5. Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Critical   High   Medium   Low

Top Stories

WordPress Patches ‘Click2Shell’ Vulnerability

Source: SecurityWeek | Published: Sep 22 | Risk: HIGH | Impacted: WordPress site operators, Web hosting providers, Digital marketing agencies, Small-to-medium businesses with self-hosted sites | Topics: Threat Intel / Vulnerability

What happened: WordPress patched a vulnerability, dubbed ‘Click2Shell,’ that allowed attackers to install and preview inactive themes via crafted URLs, potentially leading to remote code execution. The flaw was discovered by pwn.ai, which reported that over 40 third-party themes could be exploited for PHP code execution while inactive.

Why it matters: Unpatched WordPress installations allow unauthenticated attackers to gain remote code execution by abusing theme preview features, exposing business-critical sites and user data.

How it works: WordPress is a widely used content management system; Click2Shell allows attackers to abuse crafted URLs to preview and execute PHP code via inactive themes, providing a remote code execution pathway through core functionality.

Affected / Fix: Patch available from WordPress; all site owners urged to update.

Practitioner Perspective

Sites running WordPress, especially those with numerous third-party themes installed, are highly exposed if not urgently patched. The Click2Shell flaw offers an avenue for threat actors to exploit inactive themes, bypassing the usual assumption that only active components expand surface area. This expands the risk far beyond poorly maintained plugins. Swift response is essential: defenders must patch, but also review inventory management and decommission unused themes to truly reduce risk. Unattended CMS platforms remain one of the prime vectors for high-impact web compromises.

Recommended Actions – Update WordPress core and all theme packages to the latest patched versions addressing Click2Shell – Enumerate and delete all unused and inactive third-party themes from WordPress installations

Emerging Signals

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

Source: The Hacker News | Published: Sep 22 | Risk: HIGH | Impacted: Development teams using npm dependencies, CI/CD pipelines ingesting open-source modules, Cloud platform hosts running Node.js | Topics: Supply Chain / Exploit

What happened: The ‘indexed-btree’ npm package hid malicious code within its runtime, avoiding traditional install-time security measures. It collected system information and exfiltrated data via encrypted smart contracts on the Sepolia testnet, then erased traces to evade detection.

Why it matters: Malicious npm packages that evade install-time controls expose internal developer environments and production infrastructure to covert data theft and exfiltration through blockchain-based channels, undermining supply chain trust.

How it works: The ‘indexed-btree’ npm package hid its malicious loader where it runs only during application execution, not installation, and exfiltrates host data via encrypted payloads on public blockchain networks, making the attack stealthier and harder to block with routine checks.

Affected / Fix: ‘indexed-btree’ npm package has been removed from npm; users must manually purge and audit affected environments.

Practitioner Perspective

Organizations relying on npm for both internal and production code need to re-evaluate their supply chain risk, especially regarding packages like ‘indexed-btree’ that only execute payloads at runtime. The use of encrypted smart contracts for data exfiltration bypasses traditional network monitoring and makes detection significantly harder. Even a brief window of exposure is enough for sensitive data to be stolen and erased. The priority for defenders must be immediate revocation and incident review for any environment where this package was present, coupled with a long-term strategy to reduce reliance on unvetted third-party code.

Recommended Actions – Immediately purge ‘indexed-btree’ from all npm dependency trees and lockfiles in internal and production codebases – Search logs and runtime environments for historic executions and system information exfiltration from endpoints running Node.js

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

Source: The Hacker News | Published: Sep 22 | Risk: HIGH | Impacted: WordPress site operators, High-traffic web platforms, Small businesses reliant on CMS | Topics: Exploit / Vulnerability

What happened: A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site’s server. WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed “Comment2Shell,” on September 17 in version 7.1.1 and told site owners to update right away.

Why it matters: Anonymous web users could chain a stored XSS flaw and privileged admin session to gain unrestricted code execution on WordPress servers, leading to full site compromise and downstream data breach.

How it works: Comment2Shell (CVE-2026-93485) allows attackers to store a malicious script in a WordPress comment, which, when rendered in an admin’s session, lets remote attackers escalate to executing code on the hosting server.

Affected / Fix: Fixed in WordPress 7.1.1 as of September 17.

Practitioner Perspective

WordPress installations still running below version 7.1.1 are exposed to Comment2Shell (CVE-2026-93485), which transforms a basic XSS vector into server-level RCE if a privileged admin opens a weaponized comment page. This is a prime target for automated botnets and targeted opportunists due to the low barrier to exploitation. Defenders should not delay: patch, audit for prior exploitation (especially recent admin logins on comment review pages), and apply additional browser isolation to admin workflows. Persistent XSS is not merely a nuisance here, it is a direct entry to shell access.

Recommended Actions – Upgrade all WordPress sites to version 7.1.1 or later to close CVE-2026-93485 – Search recent server logs for evidence of XSS payload execution tied to comment moderation pages

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

Source: The Hacker News | Published: Sep 22 | Risk: MEDIUM | Impacted: Indian academia, Campus IT administrators, Windows endpoint users in education | Topics: Phishing / Exploit

What happened: The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. “SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols,” Trellix researchers

Why it matters: Spear-phishing campaigns now routinely target academic environments, not just government or commercial sectors, increasing the attack surface for institutional credential theft and espionage.

How it works: SideCopy delivers spear-phishing emails that trick academic users into launching mshta.exe, a Windows component that executes HTML Application scripts, allowing attackers to bypass some endpoint security controls and drop malware.

Practitioner Perspective

The expansion of SideCopy’s operations to higher education signals that academic networks are now considered high-value pivots into research or sensitive data. Abuse of Windows native utilities like mshta.exe complicates traditional detection and often bypasses poorly tuned application whitelisting rules. Academic IT must reevaluate their controls, especially for phishing-induced script execution. Given limited IT resources and complex network topologies, bulk compromise risk is real. Awareness and technical controls must be raised quickly, or institutional compromise is inevitable.

Recommended Actions – Block and monitor all mshta.exe execution on Windows endpoints in academic networks – Conduct anti-phishing training for faculty and IT staff with a focus on SideCopy TTPs

Exploits & CVEs

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Source: The Hacker News | Published: Sep 22 | Risk: CRITICAL | Impacted: Enterprises deploying Zyxel GS1900 series switches, Organizations using Veeam backup solutions, Network administrators, IT managed service providers | Topics: Cloud / Exploit

What happened: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating system command execution. Veeam software faces similar privilege escalation threats.

Why it matters: Widespread, authenticated attackers are exploiting critical vulnerabilities in Zyxel switches and Veeam software to run arbitrary code as SYSTEM, threatening enterprise networks via remote command execution.

How it works: CVE-2026-7273 is a stack-based buffer overflow in Zyxel GS1900 series switches permitting arbitrary operating system commands; related privilege escalation flaws in Veeam software may enable SYSTEM access.

Affected / Fix: Both vendors have released patches; update immediately, per CISA KEV catalog.

Practitioner Perspective

These active exploitations represent real-world risk: internet-exposed Zyxel GS1900 series switches are being targeted for remote code execution via CVE-2026-7273, and Veeam installations face similar threats to privilege boundaries. This provides attackers with initial footholds for network compromise, persistence, or lateral movement. Defenders must treat unpatched hardware and backup infrastructure as open entry points. Immediate patching is mandatory and should be accompanied by a hunt for previous unauthorized SYSTEM-level actions or configuration changes.

Recommended Actions – Deploy the latest security patches to all affected Zyxel GS1900 switches and Veeam installations as listed in vendor advisories – Identify and segment any exposed management interfaces on vulnerable switch and backup infrastructure

Also Today

• A New Tool Found Malware That’s Guided by an AI Hive Mind, No Humans in Sight: Researchers from Cisco Talos developed the CAIRN framework to find AI-integrated malware like CLOSEDQUORUM, which autonomously consults multiple large language models.
• How to Use AI With Your Privacy Intact: Cloud AI assistants may store and expose user interactions; mitigation includes opting for zero data retention policies or running AI locally.
• One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor: Malware on Mac can hijack the Meta Muse assistant by toggling an obscure setting to reroute dictated prompts to an attacker.
• Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme: WaterPlum, a North Korean group, ran a global scheme recruiting contractors for siphoning access and funds from thousands of victims.
• US Proposes AI Incident Alert System in Talks With China, Bessent Says: US discusses an AI incident alert mechanism with China, signaling new policy emphasis on multilateral response to AI security events.
• GPT-6 Astra Breaks an Old Enigma Message: GPT-6 Astra AI broke an uncracked WWII Enigma cipher by identifying place name cribs.
• GlobalProtect App Local Privilege Escalation (CVE‑2026‑0307) Patch Released: Palo Alto fixed a local privilege escalation in GlobalProtect App for Linux, with a Windows/macOS patch coming September 28.

Defensive Actions

• Deploy the latest security patches to all affected Zyxel GS1900 switches and Veeam installations.
• Update WordPress to at least version 7.1.1 and patch all themes to address Click2Shell and Comment2Shell vulnerabilities.
• Immediately purge ‘indexed-btree’ from all codebases and audit logs for exfiltration or compromise.
• Enumerate and delete unused/inactive themes from WordPress installations; audit automation scripts for theme deployment.
• Block and monitor mshta.exe execution in education environments and conduct focused phishing training against SideCopy tradecraft.
• Identify and segment exposed management interfaces on Zyxel/Veeam devices and monitor for SYSTEM-level access.
• Search server logs for XSS exploitation attempts linked to WordPress comment moderation pages.
• Tighten npm installation policies and run post-mortem incident response for Node.js endpoints impacted by malicious packages.

What We’re Watching

• Ongoing exploitation activity for Zyxel GS1900 series (CVE-2026-7273) and Veeam, monitor for new IOCs and post-patch exploitation attempts.
• Rapid targeting of unpatched WordPress (Click2Shell, Comment2Shell/CVE-2026-93485) by automated botnets.
• Proliferation of npm and open-source package malware; risk of more blockchain-based exfiltration techniques.
• Adversary use of SideCopy and related spear-phishing targeting academic institutions, watch for mshta.exe abuse and payload delivery.
• Release of Windows/macOS patches for Palo Alto GlobalProtect App CVE-2026-0307 and corresponding exploitation in hybrid endpoint fleets.

Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: AI Security, npm, patching, Phishing, Supply Chain, Veeam, Vulnerabilities, WordPress, Zyxel