Cybersecurity briefing, 2026-09-22

WordPress exploitation led the briefing, with default credentials helping attackers steal more than 18,000 government records.

• GitLab flaw hits KEV under active exploitation
• CISA puts SharePoint and RouterOS hits in KEV
• Microsoft seizes EvilTokens as AI drives BEC fraud
• CloudSEK finds trusted publishing was abused
• CLOSEDQUORUM moves malware decisions into LLMs
• CrowdSec leak tied to stale GitHub token
• Naceri’s BigDiskBuster keeps Defender stale
• Colorado water utilities saw quiet OT tampering
• Fake LastPass Authenticator repos push Rapuncel
• Indexed-btree hid npm malware in runtime code
• Gyazo leak exposes passwords and image links
• Irish regulator hits Google over location profiling
• Dutch arrest splits ShinyHunters leadership story
• Forescout shows segmentation often hides lateral paths
• BigCommerce finds app breach reaching storefronts
• OpenAI shortens the AI parity window
• Gartner says deepfakes are hitting recovery flows
• WordPress attacks now write PHP outside site directories
• Siemens OIS file upload flaw can reach root

Recent editions

• Monday, September 21, 2026: Zyxel switch exploit kept the door open · 20 stories
• Sunday, September 20, 2026: Orkes Conductor bug turns workflows into shell access · 5 stories
• Saturday, September 19, 2026: Redis TLS bug is already being exploited · 17 stories
• Friday, September 18, 2026: NightEagle reuses credentials and GitHub tooling · 17 stories
• Thursday, September 17, 2026: JCE flaw is turning Joomla sites into webshell hosts · 16 stories
• Wednesday, September 16, 2026: WSO2 JWT bypass is being used in attacks · 17 stories
• Tuesday, September 15, 2026: Vite exploitation is now harvesting cloud secrets · 17 stories