Cybersecurity briefing, 2026-09-20

Orkes Conductor is being actively exploited, with attackers using a workflow API flaw to get shell access through exposed endpoints.

• Orkes Conductor bug turns workflows into shell access
• CrowdSec leak tied to stale GitHub token
• WaterPlum’s hiring scam hits a new scale
• Google’s mole shrinks TeamPCP’s supply-chain blast radius
• Malicious extensions can steer Chromium AI assistants

Recent editions

• Saturday, September 19, 2026: Redis TLS bug is already being exploited · 17 stories
• Friday, September 18, 2026: NightEagle reuses credentials and GitHub tooling · 17 stories
• Thursday, September 17, 2026: JCE flaw is turning Joomla sites into webshell hosts · 16 stories
• Wednesday, September 16, 2026: WSO2 JWT bypass is being used in attacks · 17 stories
• Tuesday, September 15, 2026: Vite exploitation is now harvesting cloud secrets · 17 stories
• Monday, September 14, 2026: Red Heron turned Gitea access into control-plane breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN flaws move into exploitation window · 4 stories