Daily Cybersecurity News – September 26, 2026
SharePoint RCE and MikroTik Flaws Hit CISA KEV
CriticalWhat happened
CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog on September 25, 2026: CVE-2026-65660 in Microsoft SharePoint and CVE-2026-67279 in MikroTik RouterOS.
CVE-2026-65660 is a code injection issue (CVSS 8.8) that Microsoft initially labeled spoofing but later confirmed enables remote code execution by an authorized attacker over the network. Microsoft stated it had reliable evidence of observed attacks as of September 25.
CVE-2026-67279 (CVSS around 6.5-6.9) allows an unauthenticated client to open a session channel and send exec requests. It is chained with the earlier CVE-2026-86060 (CVSS 9.8, already in KEV) in the MikroTrick exploit for full unauthenticated administrative takeover of vulnerable RouterOS devices.
Who is affected
Organizations running on-premises Microsoft SharePoint Server (multiple supported versions) and internet-exposed MikroTik RouterOS 7.x (and some 6.x) builds.
Federal civilian agencies face a September 28, 2026 remediation deadline. RouterOS devices commonly used in networks and by smaller operators are especially at risk if left unpatched and reachable.
Why it matters
Active exploitation of a SharePoint RCE and a router full-takeover chain creates immediate risk of data theft, persistence, and lateral movement. SharePoint often holds sensitive internal documents and is widely deployed.
Internet-facing MikroTik routers can give attackers network footholds or pivot points without credentials. Operators who assumed perimeter rules or prior patches were enough may still be exposed.
How it could have been prevented
Apply the latest Microsoft SharePoint security updates immediately and follow vendor guidance for any additional mitigations.
For MikroTik, upgrade RouterOS to fixed versions such as 7.23.4, 7.24.2 or later equivalents, and restrict SSH and management interfaces to trusted networks only. Monitor for unusual session or exec activity and rotate any exposed credentials.
Relevant professional terms
- KEV catalog
- CISA's list of vulnerabilities confirmed to be exploited in the wild, which federal agencies must fix by set deadlines and which all organizations should prioritize.
- Exploit chain
- A sequence of two or more vulnerabilities used together so that the first flaw creates the conditions needed for the second to achieve full compromise, such as unauthenticated admin access.
Roundcube Pre-Auth SQLi Exploited in the Wild
HighWhat happened
The Canadian Centre for Cyber Security warned that CVE-2026-48842, a now-patched pre-authentication SQL injection in Roundcube Webmail, is being actively exploited in the wild.
The flaw (CVSS 8.1) sits in the virtuser_query plugin and stems from a preg_replace() backslash escape bypass that lets unauthenticated attackers inject arbitrary SQL. It affects versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Patches shipped in May 2026.
No detailed exploitation volume has been released, though Shadowserver observed hundreds of thousands of internet-exposed Roundcube instances with only a small number still flagged vulnerable at last check.
Who is affected
Operators of Roundcube Webmail 1.6.x and 1.7.x who have the virtuser_query plugin enabled and have not upgraded to 1.6.16 or 1.7.1.
Email systems handling sensitive communications are the primary target population; prior Roundcube flaws have drawn nation-state and criminal interest for credential and message theft.
Why it matters
Pre-auth SQL injection can expose mail account credentials and stored messages without any login. Roundcube is a common open-source webmail choice for organizations and hosting providers.
Active exploitation months after a patch shows that lagging updates leave high-value email data at risk, continuing a pattern of Roundcube targeting.
How it could have been prevented
Upgrade immediately to Roundcube 1.6.16 or 1.7.1 or later. Disable the virtuser_query plugin if it is not required.
Audit database logs for unusual queries, rotate credentials if compromise is suspected, and ensure the webmail instance is not unnecessarily exposed to the internet.
Relevant professional terms
- SQL injection
- A flaw that lets an attacker insert malicious database commands into an application's input so the database runs them instead of treating the input as plain data.
- Pre-authentication vulnerability
- A security flaw that can be triggered by an unauthenticated remote attacker before any login or session is established, greatly increasing the attack surface.
Compromised GitHub Actions Re-Enabled with Mini Shai-Hulud Malware
HighWhat happened
Two GitHub Actions from the actions-cool organization (issues-helper and maintain-one-comment) were re-enabled on September 16, 2026, still containing malicious code from the May 2026 Mini Shai-Hulud campaign.
The original compromise caused the actions to harvest credentials from CI/CD pipelines. After GitHub disabled the repos in May, they became reachable again without the malicious tags being cleaned. Workflows that reference the actions by mutable version tags automatically pulled and ran the payload on their next scheduled or event-driven execution.
GitHub later disabled the repositories a second time. Thousands of dependent repositories were potentially exposed.
Who is affected
Any project whose GitHub workflows call actions-cool/issues-helper or actions-cool/maintain-one-comment by tag rather than by immutable commit SHA.
Developers and organizations using these popular issue- and comment-automation actions in CI/CD pipelines, especially those with secrets or cloud credentials available to the runner.
Why it matters
Supply-chain reactivation of known malware requires no new attacker action and no change to victim workflow files. Credential theft from CI/CD can lead to further repository compromise, cloud account takeover, or downstream package poisoning.
Mutable tags create a persistent risk window even after an initial cleanup.
How it could have been prevented
Pin the affected actions to specific commit SHAs that predate the May 2026 compromise. Audit all workflows for references to the actions-cool packages.
Rotate any secrets that may have been exposed, review recent workflow runs and logs for anomalous activity, and prefer immutable references for all third-party actions going forward.
Relevant professional terms
- CI/CD pipeline
- The automated process that builds, tests, and deploys software whenever code changes, often running with access to secrets and production credentials.
- Mutable tag
- A version label on a software package or action that can be moved to point at different code later, so consumers who reference the tag can silently receive malicious updates.
ShinyHunters Renews Oracle PeopleSoft Exploitation
CriticalWhat happened
Mandiant and Google Threat Intelligence Group identified a renewed mass-exploitation campaign by UNC6240 (ShinyHunters) against CVE-2026-35273 in Oracle PeopleSoft.
The critical unauthenticated vulnerability (CVSS 9.8) in the Environment Management Hub component of PeopleTools 8.61 and 8.62 was first exploited as a zero-day in May-June 2026 mainly against education targets. In the new wave the actors bypass WAF rules that block the literal /PSEMHUB/ path by using a single-character URL encoding (/%50SEMHUB/), which many WAFs match before decoding while the application decodes and routes normally.
They have deployed web shells on dozens of systems across higher education, technology, healthcare, government and other sectors.
Who is affected
Organizations running unpatched Oracle PeopleSoft Enterprise PeopleTools 8.61 or 8.62, especially those that relied on WAF path blocking instead of applying the Oracle Security Alert patch.
Global multi-sector exposure, with confirmed activity beyond the earlier education focus.
Why it matters
A critical, easily exploited RCE that has already been used for data theft and is linked to ransomware activity remains effective against systems that only applied partial mitigations. WAF bypasses show that string-matching rules are insufficient.
Successful exploitation leads to web shells, credential theft, MeshCentral agents and further internal access, putting HR, finance and operational data at risk.
How it could have been prevented
Apply the Oracle Security Alert patch for CVE-2026-35273 immediately. Disable or remove the Environment Management Hub (PSEMHUB) service where possible per Oracle guidance.
Search access logs for /PSEMHUB/ and percent-encoded variants, inspect the PSEMHUB.war directory for unexpected JSP or executable files, rotate reachable credentials, and monitor for MeshCentral or anomalous outbound connections. WAF rules alone are not a substitute for patching.
Relevant professional terms
- Web shell
- A malicious script placed on a compromised web server that gives an attacker remote command execution through ordinary HTTP requests.
- WAF bypass
- A technique that crafts requests so a web application firewall fails to match its blocking rules (for example by encoding characters) while the backend application still processes the malicious payload.
Army Soldier Sentenced for Attacks on AT&T and Snowflake
MediumWhat happened
Former U.S. Army soldier Cameron John Wagenius was sentenced to 70 months in prison and ordered to pay nearly $295,000 in restitution for a multi-year cybercrime spree that included attacks on AT&T and other organizations while he was on active duty.
Wagenius and co-conspirators, including Connor Moucka, used stolen credentials to access Snowflake customer environments and other cloud platforms, stealing large volumes of data for extortion. Victims included AT&T (call and text records of nearly all customers), Ticketmaster, Advance Auto Parts and Santander. The group obtained more than $2.5 million in extortion payments combined and stole billions of records.
Wagenius also leaked non-content call detail records of a government official and sought to sell data or defect-related information.
Who is affected
Customers of the compromised organizations, particularly AT&T mobile subscribers whose call and text metadata was stolen, plus other Snowflake customers and companies targeted for extortion.
The case involves data from 2024 incidents; the sentencing closes a high-profile chapter of those breaches.
Why it matters
The case illustrates how credential stuffing against poorly protected cloud data platforms can yield massive datasets for extortion and how insider or dual-status actors (active-duty personnel) can operate for extended periods.
It underscores the real-world impact of the 2024 Snowflake campaign wave and the value of rapid credential rotation, MFA enforcement and monitoring of anomalous cloud access.
How it could have been prevented
Enforce multi-factor authentication on all cloud data platforms and administrative accounts. Continuously monitor for credential stuffing and unusual bulk data access or exfiltration.
Rotate secrets after any suspected exposure, limit service-account privileges, and treat third-party data warehouse environments with the same scrutiny as core infrastructure.
Relevant professional terms
- Extortion
- A crime in which attackers steal data or disrupt systems and demand payment in exchange for not publishing the data or restoring access.
- Infostealer logs
- Collections of stolen usernames, passwords and session cookies harvested by malware from infected endpoints and later sold or reused to access cloud and corporate accounts.
North Korean Hackers Steal $351M from Bitget
CriticalWhat happened
Cryptocurrency exchange Bitget suffered a theft of more than $351 million (later reports cited figures approaching $387 million) from its hot and warm wallets on September 24, 2026, in what is described as the largest known crypto heist of the year so far.
Attackers compromised a back-end system, spoofed transaction data, and triggered legitimate authorization processes to move funds without stealing private keys. Bitget suspended withdrawals and stated its user protection fund (over $464 million) covers the loss.
CEO Gracy Chen said the tactics and infrastructure indicators are highly consistent with known North Korean hacker groups. Blockchain firms have linked related wallets to Lazarus Group activity; North Korea is assessed to be behind the majority of crypto theft value in 2026.
Who is affected
Bitget users and the exchange itself. Hot-wallet holdings used for active trading were drained across multiple chains including Ethereum, XRP and others.
The broader crypto sector continues to face repeated high-value targeting by state-linked actors.
Why it matters
A nine-figure hot-wallet compromise demonstrates that even large exchanges with protection funds remain attractive targets. Attribution to North Korean operators reinforces the link between crypto theft and state funding priorities.
Operators of any internet-connected custody or trading infrastructure must treat hot-wallet controls, transaction authorization, and anomaly detection as critical.
How it could have been prevented
Minimize hot-wallet balances, enforce multi-party or hardware-based authorization for large transfers, and implement real-time anomaly detection on transaction patterns and internal transfer requests.
Segment wallet infrastructure, monitor for spoofed or unexpected authorization flows, and maintain rapid incident response playbooks that include chain-level freezes and user-fund coverage communication.
Relevant professional terms
- Hot wallet
- A cryptocurrency wallet that remains connected to the internet for convenient trading or withdrawals, making it more convenient but also more exposed than offline cold storage.
- On-chain analysis
- The examination of public blockchain transaction graphs, addresses and timing patterns to attribute thefts, trace funds and identify links to known threat-actor clusters.
Five Checks to Vet AI Vibe-Coded Apps
MediumWhat to watch
- Developer reputation, longevity and review history before installing
- Whether requested permissions match the app's stated purpose
- Presence of a clear privacy policy and vulnerability-reporting channel
- How the app protects credentials and whether it explains its security model
- If the app uses AI, what private data or actions that AI component can reach
What happened
ESET published guidance on how everyday users can evaluate the safety of apps built with AI 'vibe coding' tools before downloading or trusting them with data.
Vibe coding platforms let non-experts or time-pressed developers generate functional software quickly, but they often prioritize look-and-feel over secure defaults. Common resulting flaws include hardcoded secrets, missing input validation or access controls, public-by-default settings, weak encryption, absent rate limiting, and exposure to prompt injection.
A cautionary example cited multiple critical issues found in a popular app hosted on one vibe-coding platform that had already drawn large traffic.
Who is affected
Consumers and employees who install or use newly popular mobile or web apps, especially those that appear overnight or request broad permissions.
Developers and platforms that ship AI-generated code without additional security review also create downstream risk for their users.
Why it matters
The rapid drop in the skill barrier for shipping software means more apps reach users with basic security gaps that experienced developers would normally catch. Hardcoded keys or missing access controls can directly expose user data or backend systems.
As AI-assisted development becomes the norm, individual vetting habits become an important last line of defense.
Relevant professional terms
- Vibe coding
- Using AI tools to generate working software from high-level descriptions or 'vibes,' often with less manual review of security and edge cases than traditional development.
- Prompt injection
- An attack that inserts hidden malicious instructions into content processed by an AI system so the model performs unintended actions or leaks data when it has access to tools or private information.