Our weekly round-up of significant threats and actively exploited vulnerabilities. It is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
This week at a glance
Edge devices are again the main target. Critical flaws in Citrix NetScaler and Check Point VPN gateways are being actively exploited, and a WordPress core flaw is being used to compromise websites. Apple has also patched a zero-day used in targeted attacks. If you run any of these products, patching should be this week’s priority.
Actively exploited vulnerabilities
Citrix NetScaler ADC and Gateway (CVE-2026-88771, CVE-2026-88772)
Two critical flaws allow unauthenticated remote code execution. The second requires DTLS, which is enabled by default on VPN virtual servers. Citrix confirms exploitation, and the NCSC has issued an alert. Attackers have deployed web shells and moved laterally in government, financial, legal, and professional services organisations. Fix: upgrade to 14.1-73.37 or 13.1-64.23 (or the listed FIPS/NDcPP builds), then check for signs of compromise.
Sources: Citrix bulletin CTX697096; NCSC alert
Check Point Security Gateway and Management (CVE-2026-85102, CVE-2026-93616)
A certificate validation flaw in VPN negotiation allows pre-authentication remote code execution on gateways running Site-to-Site or Remote Access VPN, and a separate path traversal affects the Management web service. Both have been exploited and were added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue on 22 September. Fix: apply the Jumbo Hotfix for your branch as listed in Check Point’s advisory.
Source: Check Point advisory
WordPress core (CVE-2026-87902)
A flaw in page-template handling allows unauthenticated attackers to include local PHP files, leading to remote code execution in some configurations. It is being exploited to plant malicious files. Fix: update to WordPress 7.1.2 or the patched release for your branch; automatic background updates should already have applied it.
Source: WordPress 7.1.2 release
Microsoft SharePoint Server (CVE-2026-65660)
A code injection flaw in on-premises SharePoint Server 2016, 2019, and Subscription Edition allows remote code execution, and can be chained with an authentication bypass. Exploitation began after technical details were published, and CISA added it to KEV on 25 September. Fix: the August 2026 security updates.
Source: SecurityWeek
MikroTik RouterOS (CVE-2026-67279 and CVE-2026-86060)
An SSH authentication bypass chained with privilege escalation gives attackers full administrative access to internet-exposed routers. Fix: upgrade to the latest RouterOS 6.49 or 7.x build, as some early patches were incomplete.
Source: CERT Polska
Apple iOS, iPadOS, and macOS (CVE-2026-86950)
A CoreGraphics flaw allowing code execution through a crafted file may have been used in highly targeted attacks. Fix: iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, or macOS Sequoia 15.8.1.
Source: BleepingComputer
Notable threats and campaigns
ShinyHunters returns to unpatched Oracle PeopleSoft
Google’s Threat Intelligence Group reports that ShinyHunters has restarted mass exploitation of the PeopleSoft flaw CVE-2026-35273, targeting organisations that applied web application firewall workarounds but not the patch. A single URL-encoded character gets past those rules, after which the group deploys web shells and remote access tools and steals HR, payroll, and student data for extortion. Apply the patch, disable the PSEMHUB service, hunt for the published indicators, and rotate credentials.
Source: Google Threat Intelligence Group
Microsoft disrupts EvilTokens device code phishing
Microsoft and partners have disrupted EvilTokens, a phishing-as-a-service platform that used device code phishing to take over more than 12,000 Microsoft 365 mailboxes at over 10,000 organisations, with the UK and France among the most affected. Victims sign in on genuine Microsoft pages, which hands the attackers a token. Block or limit device code flow with Conditional Access, use phishing-resistant MFA, and watch for suspicious inbox rules.
Source: Microsoft Security blog
MemTensor npm and PyPI packages compromised
Malicious versions of MemTensor’s AI memory packages on npm and PyPI carried a credential stealer that harvests cloud, code repository, package registry, and SaaS secrets, and can add GitHub Actions workflows to spread further. Remove the affected versions, rotate secrets on any machine or pipeline that installed them, and check for unexpected workflows.
Source: StepSecurity
Also reported this week
- DarkMe RAT: Huntress reports that Water Hydra now spreads its DarkMe remote access trojan through phishing links disguised as images rather than zero-days. (Huntress)
- CARBONATO botnet: A botnet takes over internet-exposed Docker hosts without authentication and prioritises stealing AI API keys and cloud credentials. (ThreatDown)
- RemControl: A new Android banking trojan spread through fake IPTV app pages overlays fake login screens on banking apps in several EU countries. (Help Net Security)
- Storm-2570: Microsoft describes a ransomware affiliate that uses the same tradecraft whether it deploys Qilin, DragonForce, Anubis, or BERT ransomware, with victims in the US, Canada, the UK, Spain, and the Netherlands; turn on Defender tamper protection and allow only approved remote management tools. (Microsoft)
- Kapibala: GreyNoise reports a Chinese-speaking actor exploiting WordPress, Zyxel GS1900, and Ubiquiti UniFi OS flaws to steal records from government, law enforcement, and small business systems. (GreyNoise)
- Storm-3168: Microsoft reports an actor using automated tooling and stolen Azure service principal credentials to delete storage, databases, and key vaults; rotate exposed secrets and use resource locks. (Microsoft)
- Mini Shai-Hulud: Two compromised actions-cool GitHub Actions were re-enabled with their malicious payload still live; remove them or pin them to a known-good commit, and rotate any secrets the workflows could reach. (Socket)
- Ribon apps: Compromised credentials for the Ribon apps were used to take shopper data from BigCommerce stores, including a UK retailer. (SecurityWeek)
- Graphalgo: Malicious Terraform providers and Go modules deliver Go malware to developers, particularly in cryptocurrency and Web3. (Aikido)
- Exvicy: A ClickFix kit sold for use on hacked WordPress sites tricks visitors into pasting malicious commands into Windows. (Sekoia)
- ChainScript: A Node.js remote access trojan spreads through ClickFix lures and fake app installers. (Blackpoint)
- ClosedQuorum: Cisco Talos describes a Windows implant that lets a panel of AI models choose its next action; Talos has not confirmed its use in real attacks. (Cisco Talos)
Other patches worth knowing
- F5 BIG-IP APM (CVE-2026-94127) and Arista VeloCloud Orchestrator (CVE-2026-93952): added to KEV on 22 September.
- WSO2 (CVE-2026-5430) and Adobe Commerce/Magento (CVE-2026-71362): added to KEV on 24 September.
- Zyxel GS1900 switches (CVE-2026-7273): firmware available for all affected models.
- Roundcube Webmail (CVE-2026-48842): Canada’s Cyber Centre reports exploitation where the virtuser_query option is enabled; update to 1.6.16 or 1.7.1, and turn the option off if you do not use it.
Practical steps to consider
- Check whether you run any of the affected products, especially internet-facing VPN and remote access appliances, and patch as a priority.
- For exploited edge devices, patching alone is not enough: look for indicators of compromise and reset credentials where advised.
- Review how quickly critical patches reach your systems, and whether your ISO/IEC 27001 vulnerability management (control A.8.8) and Cyber Essentials security update requirements are being met in practice.
This round-up is for general awareness only and is not a monitored threat intelligence service. If you would like help reviewing your vulnerability management or incident readiness, contact us.
