Cybersecurity briefing, 2026-09-19

Redis is the lead item today, with active exploitation already targeting TLS-enabled servers.

• Orkes Conductor Bug Turns Workflows Into Shell Access
• Redis TLS Bug Is Already Being Exploited
• CrowdSec Leak Traced to Stale GitHub Access
• NightEagle Reuses Credentials and GitHub Tooling
• WaterPlum Turns Hiring into Corporate Access
• PhantomRaven Hides Stealer in npm Installs
• Malicious Extensions Can Steer Chromium AI Assistants
• Settra Hides Ransomware in Legitimate RMM
• Gyazo Leak Exposes Passwords and Image Links
• AgentCore Harness Shell Leaks Vaulted Credentials
• Microsoft Cloud Flaws Were Fixed Server-Side
• NightmareStresser Disruption Shifts DDoS Capacity
• Check Point Login Overflow Reaches Root on Management Servers
• CISA Drops Its Weekly CVSS Bulletin
• RatHat Uses Android Accessibility as Control Surface
• SolarWinds ARM Patch Fixes Hard-Coded Key RCE
• WordPress 7.1.1 Fixes Silent Theme Install Bug

Recent editions

• Friday, September 18, 2026: Redis TLS Bug Is Already Being Exploited · 17 stories
• Thursday, September 17, 2026: JCE Flaw Is Turning Joomla Sites Into Webshell Hosts · 16 stories
• Wednesday, September 16, 2026: WSO2 JWT Bypass Is Being Used in Attacks · 17 stories
• Tuesday, September 15, 2026: Vite Exploitation Is Now Harvesting Cloud Secrets · 17 stories
• Monday, September 14, 2026: Red Heron Turned Gitea Access into Control-Plane Breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN Flaws Move Into Exploitation Window · 4 stories
• Saturday, September 12, 2026: UNC3569 Used Sogou Links for User-Context Access · 13 stories