Cybersecurity briefing, 2026-09-18

Joomla JCE exploitation is landing webshells on exposed sites.

• Redis TLS Bug Is Already Being Exploited
• Orkes Conductor Bug Turns Workflows Into Shell Access
• NightEagle Reuses Credentials and GitHub Tooling
• FamousSparrow Shifts to Modular Exchange Footholds
• JCE Flaw Is Turning Joomla Sites Into Webshell Hosts
• Gyazo Leak Exposes Passwords and Image Links
• ISC BIND Patch Leaves 9.18 Users Behind
• OpenAI Logs Six Agent Misalignment Incidents
• Settra Hides Ransomware in Legitimate RMM
• Check Point Login Overflow Reaches Root on Management Servers
• Transparent Tribe Hides Control Traffic in GitHub
• HPE EdgeConnect Fixes Reach Into the Control Plane
• CISA Turns Decoys Into Practical Detection
• Irregular Shows Coding Agents Can Rewrite Themselves
• NightmareStresser Disruption Shifts DDoS Capacity
• Manufacturing Keeps Drawing Ransomware Pressure
• RatHat Uses Android Accessibility as Control Surface

Recent editions

• Thursday, September 17, 2026: JCE Flaw Is Turning Joomla Sites Into Webshell Hosts · 16 stories
• Wednesday, September 16, 2026: WSO2 JWT Bypass Is Being Used in Attacks · 17 stories
• Tuesday, September 15, 2026: Vite Exploitation Is Now Harvesting Cloud Secrets · 17 stories
• Monday, September 14, 2026: Red Heron Turned Gitea Access into Control-Plane Breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN Flaws Move Into Exploitation Window · 4 stories
• Saturday, September 12, 2026: UNC3569 Used Sogou Links for User-Context Access · 13 stories
• Friday, September 11, 2026: Check Point VPN Flaws Move Into Exploitation Window · 14 stories