Daily Cybersecurity News – September 19, 2026

What happened

Researchers at AIR disclosed a zero-click remote code execution vulnerability, dubbed Plugin4Shell, that affects four major AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI.

The flaw is a plugin SHA-pinning bypass. Agents check out a pinned commit without verifying the checkout succeeded, allowing an attacker to swap malicious code while the pin appears intact. Claude Code, Codex, and GitHub Copilot share a version tied to git branch name handling; Gemini CLI has a separate fetch/checkout issue with the same result. Background auto-updates (default in some agents) re-run the checkout when a marketplace bumps the pinned SHA, delivering the payload with no user action.

AIR found the bug in May 2026 with working proofs-of-concept against all four, disclosed it the next month, and demonstrated end-to-end chains including earlier plugin spread to over 26,000 agents and SkillJacking takeovers of 925 skills reaching 134,000 agents. Two agents remained unpatched at the time of reporting.

Who is affected

Anyone running Claude Code, Codex, GitHub Copilot, or Gemini CLI that installs plugins from a marketplace is exposed, even users who pin reviewed plugins exactly as intended.

The reach equals the privileges of the employee running the agent, giving access to company systems and data. Exposure covers both careless installs and fully trusted, reviewed plugins.

Why it matters

This is described as the first supply-chain vulnerability of the AI agent ecosystem. A successful exploit hands an attacker the same reach into corporate environments as a legitimate developer using the agent.

Because it defeats pinning and works via auto-update or marketplace bumps without clicks, it turns trusted plugin ecosystems into persistent backdoors. Combined with demonstrated repository takeovers at scale, it creates a high-impact path for widespread compromise of development workflows and secrets.

How it could have been prevented

Disable automatic plugin updates where possible and manually review or pin plugins only after verifying the actual checked-out code hash matches the expected commit.

Prefer agents or marketplaces that enforce strict commit verification and reject branch names that collide with hashes. Monitor for unexpected plugin behavior, revoke unnecessary marketplace access, and apply vendor patches promptly once available. Audit installed plugins and remove any from less-trusted sources. Limit agent runtime privileges and isolate them from production credentials and sensitive repositories.

What happened

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18-19 2026, confirming active exploitation in the wild.

CVE-2025-39682 (CVSS 9.8) is an improper check for unusual conditions in the TLS receive path that can let local authenticated users trigger memory disclosure or denial of service. CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in the ebtables SNAT ARP rewrite path enabling unintended behavior, DoS, or local privilege escalation. CVE-2025-39964 (CVSS 7.8) is a race condition allowing concurrent writes to the same AF_ALG socket, leading to crashes, cryptographic result corruption, DoS, or integrity issues.

Red Hat updated advisories acknowledging known public exploits and high priority. No public details yet on exact exploitation methods or whether they form a single chain. Separate researcher disclosures of four other local privilege escalation flaws (including DirtyAH6 and others) were noted but not added to KEV at the time.

Who is affected

Linux systems running vulnerable kernel versions that include the affected TLS, netfilter/bridge ebtables, and AF_ALG crypto paths. Local authenticated users or attackers who already have a foothold can trigger them.

Federal Civilian Executive Branch agencies face a BOD deadline of September 21 2026. Enterprises, cloud providers, and any organization with unpatched Linux hosts are exposed, especially those allowing local access or multi-tenant workloads.

Why it matters

Active exploitation confirmed by CISA and Red Hat elevates these beyond theoretical risks. Local privilege escalation and DoS/memory issues can turn a low-privilege foothold into full system control or disrupt critical services.

Kernel flaws have broad blast radius across servers, containers, and desktops. Operators must treat them as urgent because public exploits exist and the KEV listing triggers mandatory federal patching timelines.

How it could have been prevented

Apply vendor kernel patches and updates immediately, prioritizing the three KEV CVEs. Red Hat and other distributors have issued advisories; reboot into the patched kernel.

For federal agencies, meet the September 21 2026 BOD deadline. Restrict local untrusted user access, enable kernel hardening features, monitor for unusual TLS/netfilter/crypto activity, and keep systems current with automated patch management. Consider temporary mitigations such as unloading unused modules if patches lag.

What happened

A three-person team from Hacktron used Anthropic's Claude Opus 4.8 and 5 to hack into OpenAI employee accounts in under 72 hours, according to reporting.

They gained access via Discourse (the third-party forum software hosting OpenAI's community forums) by exploiting an issue in HEIF image processing. Claude helped achieve remote code execution on Discourse Cloud within hours of Opus 5's launch, then pivot to OpenAI's instance. From there they reached an employee's Codex account and OpenAI's internal GitHub Monorepo (said to hold algorithmic secrets).

The researchers stopped short of reading internal code but proved access by sending a pull request from the employee account. Their HEIF Heist technique adapted quickly to other targets including Slack, Meta, GitHub, and more, at low token cost.

Who is affected

OpenAI staff accounts and systems reachable through the community Discourse instance, plus the Monorepo. Similar Discourse or HEIF-processing setups at other organizations that the researchers tested (Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and others) share the underlying risk.

Any company using Discourse Cloud or vulnerable image-handling libraries for user-uploaded HEIF files is potentially exposed.

Why it matters

AI coding agents dramatically accelerated a sophisticated multi-stage attack, turning complex vulnerability research and exploitation into a days-long effort for a small team.

Access to employee accounts and monorepos containing core IP shows how forum software and media parsers can become the weak link into high-value targets. It highlights both the dual-use power of frontier models and the need for hardened third-party services and image processing pipelines.

How it could have been prevented

Patch Discourse and any HEIF/image processing libraries immediately; disable or strictly sandbox HEIF support if not required. Enforce least-privilege on employee accounts, require hardware keys or strong MFA, and monitor for anomalous pull requests or forum-originating sessions.

Segment community forums from internal identity providers and code repositories. Audit third-party SaaS integrations, rotate tokens after suspected exposure, and treat AI-assisted red-teaming findings as high-priority signals for production defenses.

What happened

Google Threat Intelligence Group revealed that a Mandiant undercover analyst infiltrated the supply-chain hacking group TeamPCP almost from the start of its high-profile campaign, allowing real-time monitoring, victim warnings, and disruption support.

TeamPCP tainted hundreds of open-source packages, stole developer credentials in cascading attacks, and released a self-spreading worm, breaching more than a thousand companies. Compromised projects included Trivy, LiteLLM, Checkmarx infrastructure, TanStack, and others. Two alleged Australian members in their early twenties were arrested last month with FBI assistance.

Google also received intelligence from ShinyHunters (a former partner that turned) and followed operational security mistakes to aid identification. The infiltration details were presented at LABScon.

Who is affected

More than a thousand companies whose developers installed compromised open-source packages or whose accounts were hijacked in the cascading supply-chain attacks. Targets spanned security tools, AI libraries, web frameworks, and enterprise platforms.

Open-source maintainers and any organization relying on npm or similar ecosystems during the campaign window faced exposure.

Why it matters

TeamPCP ran one of the largest and most automated software supply-chain campaigns on record, turning trusted packages into credential thieves and further malware droppers at scale.

Having an undercover presence inside the group demonstrates how threat intelligence can shift from reactive to proactive disruption, while the arrests show international law enforcement pressure on prolific supply-chain actors. Builders must assume popular packages can be weaponized quickly.

How it could have been prevented

Pin dependencies to exact verified versions or hashes, enable lockfiles, and use private mirrors or allow-lists for critical packages. Monitor for unexpected publish events, anomalous maintainer activity, and credential theft indicators on developer machines.

Rotate tokens and keys regularly, enforce short-lived credentials, scan for malware in CI and on workstations after any suspicious package install, and participate in coordinated disclosure or threat intel sharing when campaigns surface. Remove unused or abandoned dependencies.

What happened

CrowdSec reported that an attacker used a former employee's still-active GitHub account on May 22 to copy approximately 170 of its private repositories. The laptop had been compromised earlier via the May 2026 TanStack npm supply-chain attack (CVE-2026-45321).

Malicious versions of 42 TanStack packages (84 versions total) were published on May 11 and stole GitHub tokens, SSH keys, and cloud credentials. The OAuth token from the ex-employee account enabled the copy; CrowdSec had left access open so the person could finish work. The account was removed May 25. The archive appeared on a forum September 16 and included source code plus emails of 83 users and details on 51 potential 2020 investors.

CrowdSec states infrastructure and databases were not accessed, no code was modified, and the leaked code is months old. GitHub later confirmed the TanStack link. Similar TanStack-driven incidents hit Mistral AI and OpenAI developer devices.

Who is affected

CrowdSec (private repos, some user emails, old investor data) and any organization whose developers installed the malicious TanStack npm packages in May 2026. OpenAI and Mistral AI publicly noted affected employee devices and limited internal repo access.

Developers and companies using TanStack packages during the short malicious publish window, especially those with long-lived GitHub tokens or delayed offboarding.

Why it matters

A classic cascading supply-chain compromise turned a popular library into a credential stealer, then leveraged residual access at a security vendor to exfiltrate private source, including proprietary algorithms and internal data.

It underscores failures in offboarding, token hygiene, and the speed with which npm malware can reach downstream private assets. Even without infrastructure compromise, leaked private code and contact lists create lasting risk.

How it could have been prevented

Immediately revoke access for departing employees and rotate all tokens, keys, and OAuth grants. Enforce short-lived credentials, hardware-backed MFA, and just-in-time access for GitHub.

Pin and verify npm packages, use lockfiles and private registries, scan developer endpoints after any supply-chain alert, and monitor GitHub for anomalous clone or token use. Review and minimize stored secrets on workstations. Apply lessons from CVE-2026-45321 by treating popular package ecosystems as high-risk.

What happened

University of Massachusetts Amherst researchers analyzed 61,500 abandoned Android IoT companion apps (no updates for two years or removed from Play Store by March 2025) and found nearly three in four contained dependencies tied to known vulnerabilities, many high-severity.

The apps, used to control smart plugs, cameras, thermostats and similar devices, still had thousands to over 100 million historical installs. They embed hard-coded domains; about a quarter no longer resolve, every app had at least one unreachable FQDN, some domains had changed ownership (affecting over 2,000 apps), and roughly one in nine addresses matched threat-intel blocklists for phishing, scam, spyware or malware. More than two-thirds of apps contained at least one blocklisted domain.

Apps request sensitive permissions (storage, precise location, camera) and send data mainly over Wi-Fi; 38.4% of a key abandonment-related metric highlighted persistent exposure because abandoned apps cannot adapt when endpoints break.

Who is affected

Millions of users still running outdated smart-home and IoT companion apps on Android, including those with devices expected to last a decade. Apps that once had massive install bases remain in use long after vendors stop maintenance.

Any household or organization relying on unmaintained companion apps for cameras, sensors, plugs or similar devices faces ongoing data leakage and vulnerability risk.

Why it matters

IoT devices outlive their apps, leaving sensitive location, video, storage and control data flowing to dead, transferred, or malicious infrastructure that the app can no longer update or protect.

Hard-coded endpoints and vulnerable libraries create durable attack surface. Ownership changes and blocklist hits turn abandoned apps into potential spyware or phishing vectors without any new user action.

How it could have been prevented

Uninstall abandoned IoT companion apps and replace devices or apps with actively maintained alternatives from vendors that commit to long-term support. Segment IoT devices on isolated networks, block unnecessary outbound connections, and monitor for traffic to suspicious or newly registered domains.

Prefer apps still receiving updates, revoke excessive permissions, and avoid granting camera/location/storage access unless essential. Check domain reputation of any remaining companion apps and consider factory-resetting or retiring devices whose apps are delisted.

What happened

The FBI seized domains associated with NightmareStresser (nightmare-stresser.com and nightmarestresser.org), one of the longest-running DDoS-for-hire services, as part of the international Operation PowerOFF.

Active since at least 2022 (researchers trace popularity earlier, to 2016-2019 peaks), it launched hundreds of thousands of attacks worldwide, grew toward a million users, and could fire 3,000-4,000 attacks per hour. It accepted cryptocurrency and reportedly avoided government, education, and hospital targets. Visitors now see a seizure banner.

The action continues a multi-year law-enforcement campaign that has charged facilitators, seized over 100 booter domains, and previously disrupted dozens of similar services and related botnets.

Who is affected

Operators and customers of the NightmareStresser booter/stresser service, plus the many organizations and individuals previously targeted by its DDoS attacks across the globe.

Any site or network that had been on the receiving end of its high-volume attacks, and remaining users who may migrate to other services.

Why it matters

DDoS-for-hire platforms lower the barrier for anyone to launch disruptive attacks with a few clicks and crypto payment, fueling extortion, gaming disruption, and opportunistic outages.

Removing a long-lived, high-capacity service reduces available firepower and signals continued pressure on the booter ecosystem, though new services often appear. It also aids attribution and deterrence against both admins and paying users.