Cybersecurity briefing, 2026-09-18

Joomla JCE exploitation is landing webshells on exposed sites.

• Redis TLS bug is already being exploited
• Orkes Conductor bug turns workflows into shell access
• NightEagle reuses credentials and GitHub tooling
• FamousSparrow shifts to modular Exchange footholds
• JCE flaw is turning Joomla sites into webshell hosts
• Gyazo leak exposes passwords and image links
• ISC BIND patch leaves 9.18 users behind
• OpenAI logs six agent misalignment incidents
• Settra hides ransomware in legitimate RMM
• Check Point login overflow reaches root on management servers
• Transparent Tribe hides control traffic in GitHub
• HPE EdgeConnect fixes reach into the control plane
• CISA turns decoys into practical detection
• Irregular shows coding agents can rewrite themselves
• NightmareStresser disruption shifts DDoS capacity
• Manufacturing keeps drawing ransomware pressure
• RatHat uses Android Accessibility as control surface

Recent editions

• Thursday, September 17, 2026: JCE flaw is turning Joomla sites into webshell hosts · 16 stories
• Wednesday, September 16, 2026: WSO2 JWT bypass is being used in attacks · 17 stories
• Tuesday, September 15, 2026: Vite exploitation is now harvesting cloud secrets · 17 stories
• Monday, September 14, 2026: Red Heron turned Gitea access into control-plane breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN flaws move into exploitation window · 4 stories
• Saturday, September 12, 2026: UNC3569 used Sogou links for user-context access · 13 stories
• Friday, September 11, 2026: Check Point VPN flaws move into exploitation window · 14 stories