# Threat Intel Brief — September 20, 2026

TL;DR

  • Critical vulnerabilities under active exploitation: Orkes Conductor pre-auth RCE (CVE-2026-58138), three Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964), and Check Point management server root RCE (CVE-2026-91843) require immediate patching.
  • North Korean cyber operations intensify: WaterPlum stole $10.7M in cryptocurrency from 30,000+ devices; Contagious Interview deployed WeaselBiscuit stealer via 13 malicious npm packages targeting developers.
  • Supply chain attacks cascade: TanStack npm compromise led to CrowdSec breach exposing 170 private repositories; abandoned CDN domain re-registration threatens thousands of sites with malicious code injection.
  • AI security incidents multiply: Google Gemini breached production systems during testing; researchers chained vulnerabilities to access OpenAI staff accounts; multiple AI coding agents vulnerable to plugin substitution attacks.
  • Pakistan-aligned APT36 deploys Rust tooling: Transparent Tribe targets Indian and Afghan government/defense entities using GitHub-based C2 infrastructure and cross-platform backdoors.

---

Critical Threats

Orkes Conductor Pre-Auth RCE Exploited in Wild

What happened: A critical pre-authentication remote code execution vulnerability (CVE-2026-58138, CVSS 9.8) in Orkes Conductor workflow platform versions before 3.30.2 is under active exploitation. Fortinet observed over 7,000 exploitation attempts between September 2-9, with attack volume increasing 132% daily by September 9. Unauthenticated attackers exploit unsandboxed GraalVM evaluators to execute arbitrary OS commands by submitting malicious workflow definitions containing JavaScript or Python expressions through INLINE, LAMBDA, DO_WHILE, and SWITCH task types.

Impact: Organizations running vulnerable Conductor instances face immediate risk of full system compromise with no authentication required. Attackers gain execution privileges of the Conductor process, enabling data exfiltration, lateral movement, and persistent access to workflow orchestration infrastructure. Attack sources span Germany, Hong Kong, Indonesia, UAE, India, France, and the United States.

Recommendations:

  • Upgrade to Orkes Conductor 3.30.2 or later immediately on all instances (0-24h)
  • Restrict external network access to Conductor workflow API endpoints via firewall rules until patching completes (0-24h)
  • Monitor logs for suspicious workflow submissions containing JavaScript/Python expressions since July 24, 2026 (24-72h)
  • Hunt for indicators of compromise including unexpected process execution or outbound connections from Conductor service accounts (24-72h)

---

Linux Kernel Vulnerabilities Actively Exploited

What happened: CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 19, confirming active exploitation in the wild. CVE-2025-39682 (CVSS 9.8) affects the TLS receive path; CVE-2026-53266 (CVSS 8.8) impacts ebtables SNAT/ARP handling; CVE-2025-39964 (CVSS 7.8) affects AF_ALG socket processing. All three enable local privilege escalation, denial of service, or memory disclosure. Red Hat acknowledges public exploits exist. Federal agencies must patch by September 21 per BOD 26-04.

Impact: Local attackers with authenticated access can achieve privilege escalation to root on unpatched systems. Critical risk exists for multi-tenant environments, shared hosting platforms, container infrastructure, and any Linux system with untrusted local users. Unknown whether vulnerabilities are being chained together in attacks.

Recommendations:

  • Apply vendor kernel security updates immediately for all three CVEs from Red Hat, Ubuntu, Debian, SUSE, or your distribution (0-24h)
  • Prioritize patching on multi-tenant systems, container hosts, and shared hosting platforms (0-24h)
  • Review authentication logs (auditd, sudo logs, dmesg) for privilege escalation attempts since vulnerabilities became public (24-72h)
  • Restrict local user access and enforce least privilege on critical Linux infrastructure until patches deploy (0-24h)

---

Check Point Management Server Root RCE

What happened: Check Point disclosed CVE-2026-91843, a critical stack-based buffer overflow in the login process affecting Security Management Server and Log Server. Unauthenticated attackers can achieve root-level remote code execution with low complexity and no user interaction. All deployments are vulnerable regardless of VPN or other configuration settings. While not currently exploited, the Dutch NCSC warns that recent patterns of Check Point zero-day exploitation (CVE-2026-50751, CVE-2026-16232) suggest imminent attacks are likely.

Impact: Full compromise of firewall management infrastructure enables attackers to disable security controls, exfiltrate logs, pivot to managed Security Gateways, and establish persistent access to network security infrastructure. All Check Point management deployments face immediate risk.

Recommendations:

  • Deploy Check Point LivePatch to all Security Management Server and Log Server instances immediately (0-24h)
  • Restrict management access to trusted IP addresses via SmartConsole Trusted Clients if patching is delayed (0-24h)
  • Monitor Audit and Admin logs for "Administrator failed to log in: Username too long" alerts indicating exploitation attempts (24-72h)
  • Review administrator access logs for unauthorized authentication events since disclosure (24-72h)

---

Microsoft Azure AI Foundry Authentication Bypass

What happened: Microsoft patched CVE-2026-85889, a CVSS 10.0 vulnerability in Azure AI Foundry allowing unauthenticated remote attackers to escalate privileges due to missing authentication on a critical function. Microsoft applied server-side fixes on September 18; no customer action required. Discovered by security researcher Rémy Marot with no evidence of active exploitation.

Impact: Maximum severity flaw granted unauthenticated network-based privilege escalation in a platform used for building and deploying generative AI applications. While Microsoft has mitigated the vulnerability, organizations should verify no unauthorized access occurred prior to patch deployment.

Recommendations:

  • Verify Azure AI Foundry audit logs for unauthorized access attempts between vulnerability introduction and September 18 patch date (this week)
  • Review Azure Activity Logs and Azure AD sign-in logs for anomalous authentication patterns in AI Foundry resources (this week)
  • Confirm no signs of unauthorized model access, data exfiltration, or configuration changes in AI Foundry workspaces (this week)

---

Threat Actor Activity

North Korean WaterPlum Cryptocurrency Theft Campaign

North Korean state-sponsored group WaterPlum compromised at least 30,000 devices globally between December 2025 and July 2026, stealing over $10.7 million in cryptocurrency and transferring funds directly to North Korea. A joint law enforcement advisory confirms the campaign's attribution and scale. The operation demonstrates continued DPRK reliance on cyber operations for sanctions evasion and regime funding.

Defensive priorities: Implement multi-factor authentication on cryptocurrency exchange accounts and wallet access points; deploy EDR solutions with behavioral analytics on systems with wallet software; establish network segmentation isolating cryptocurrency transaction systems from general networks.

---

Transparent Tribe (APT36) Deploys Rust-Based Backdoors

Pakistan-aligned APT group Transparent Tribe (also tracked as APT36, Earth Karkaddan) deployed new Rust-based malware families RUSTYSHADE and RUSTYMOVE targeting government and defense entities in India and Afghanistan. The campaign, codenamed Operation RapidRust, utilizes private GitHub repositories for command and control communications and demonstrates operational discipline with weekday-only C2 activity (04:00-11:00 UTC). Infrastructure includes typosquatted domains impersonating Indian news outlets (theprints[.]org, indiatodays[.]org). The group also deployed PowerShell and Bash file stealers (PSNATCH, BASHNATCH) indicating cross-platform targeting.

Defensive priorities: Monitor GitHub API traffic for unusual patterns to private repositories; detect PowerShell file enumeration and archiving operations via Sysmon Event IDs 1 and 4104; implement USB device control policies; block typosquatted domains mimicking trusted news organizations.

---

Contagious Interview npm Supply Chain Attack

North Korean-linked Contagious Interview campaign distributed WeaselBiscuit stealer through 13 malicious npm packages targeting software developers. The malware harvests Chrome extension storage (including cryptocurrency wallet extensions), logs clipboard contents and keystrokes on Windows, and exfiltrates data to C2 infrastructure at 103.170.217[.]184:8787. WeaselBiscuit exhibits functional overlaps with DPRK-associated BeaverTail and OtterCookie malware families. Malicious packages include @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, and process-tailwind.

Defensive priorities: Audit npm dependencies for the 13 malicious packages and remove immediately; block network connections to 103.170.217[.]184:8787; inspect Chrome extension directories for unauthorized access; rotate credentials for developers who installed these packages.

---

PhantomRaven npm Stealer Campaign

A financially motivated threat actor distributed PhantomRaven, a JavaScript-based information stealer likely developed using a large language model, through over 100 malicious npm packages between November 2022 and October 2025. The actor uses typosquatting and slopsquatting techniques, targeting CI/CD environments (GitHub Actions, GitLab CI, Jenkins, CircleCI) and developer workstations to harvest authentication tokens, GitHub credentials, and Git/npm configuration data. The actor claims to use stolen credentials for fraudulent bug bounty submissions rather than direct sale. Malicious npm accounts jpdhellonpm1 and jpd15 have been taken down as of September 2026.

Defensive priorities: Implement npm package integrity checks and block remote dynamic dependencies; rotate authentication tokens and CI/CD secrets for developers who installed npm packages between November 2022 and October 2025; monitor CI/CD logs for unauthorized access attempts.

---

Geopolitical Context

South Asian Cyber Espionage Intensifies

Transparent Tribe's Operation RapidRust reflects enduring intelligence collection priorities consistent with Pakistan's strategic interests in South Asia. The sustained targeting of Indian government and defense entities, alongside Afghan organizations, occurs within the context of long-standing India-Pakistan tensions and Pakistan's security concerns regarding Afghan border dynamics. The operational tempo and technical sophistication—including Rust-based malware development and GitHub C2 infrastructure—indicate a well-resourced, professionally managed operation likely aligned with Pakistani state interests.

North Korean Cyber Finance Operations Persist

WaterPlum's $10.7 million cryptocurrency theft and Contagious Interview's developer-focused supply chain attacks demonstrate North Korea's continued reliance on cyber operations for revenue generation and sanctions evasion. The scale of WaterPlum's compromise (30,000+ devices globally) and the sophistication of npm supply chain targeting underscore Pyongyang's investment in financially motivated cyber capabilities as a strategic economic lifeline amid international isolation.

AI Security Testing Gaps Exposed

Google Gemini's inadvertent breach of production systems during security evaluation in Israel highlights systemic risks in AI red-teaming methodologies when evaluation environments lack proper isolation. The incident, caused by a domain naming error during "capture the flag" exercises conducted by Israeli firm Irregular, follows similar breaches involving OpenAI, Anthropic, and Meta models tested by the same firm. These events intensify regulatory scrutiny of AI labs and underscore tensions between rapid AI capability development and the maturity of safety testing infrastructure.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch Orkes Conductor to version 3.30.2 or later; restrict external access to workflow API endpoints until patching completes
  • Apply Linux kernel security updates for CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 on all distributions
  • Deploy Check Point LivePatch to all Security Management Server and Log Server instances
  • Audit npm dependencies for 13 malicious WeaselBiscuit packages and remove immediately; block C2 infrastructure 103.170.217[.]184:8787
  • Update Anthropic Claude Code to 2.1.179+ and OpenAI Codex to 0.146.0+ to address Plugin4Shell vulnerability
  • Audit third-party script references for abandoned CDN domains; implement Content-Security-Policy-Report-Only headers

Within 24-72 hours

  • Hunt for Orkes Conductor exploitation indicators including suspicious workflow submissions since July 24, 2026
  • Review Linux authentication logs for privilege escalation attempts; prioritize patching multi-tenant and container environments
  • Monitor Check Point Audit logs for "Username too long" alerts indicating CVE-2026-91843 exploitation attempts
  • Rotate credentials for developers who installed npm packages between November 2022 and October 2025
  • Inspect Chrome extension directories on developer machines for unauthorized access or exfiltration
  • Review CrowdSec-related GitHub access for organizations affected by TanStack npm supply chain attack

This week

  • Verify Azure AI Foundry audit logs for unauthorized access attempts prior to September 18 patch date
  • Update WordPress core to version 7.1.1 to address Click2Shell forced theme installation vulnerability
  • Patch SolarWinds Access Rights Manager to version 2026.2.1 to address CVE-2026-28326 hard-coded key flaw
  • Implement Subresource Integrity (SRI) hashes for all third-party scripts on payment and sensitive pages
  • Establish written inventory of authorized scripts per PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1
  • Monitor GitHub API traffic for unusual patterns to private repositories; baseline legitimate developer activity

---

Watch List

Emerging Threats

  • Plugin4Shell: GitHub Copilot remains unpatched for vulnerability allowing repository owners to swap locked AI agent plugins for malicious code; restrict plugin installations to GitHub-hosted repositories only until patch released
  • AWS AgentCore Harness: Default configurations allow prompt injection attacks to exfiltrate credentials; scope allowedTools parameter and implement egress filtering
  • Abandoned CDN domains: Thousands of sites still reference re-registered CDN domain from July 2025; new owner controls all traffic to dependent sites
  • BragJack AI assistant hijacking: Proof-of-concept demonstrates malicious browser extensions can hijack AI assistants in Chrome, Edge, Opera, Perplexity, and Claude; two CVEs assigned but not yet publicly disclosed

Vulnerabilities Awaiting Disclosure

  • Four Linux kernel local privilege escalation vulnerabilities with public exploit code released September 18: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), CVE-2026-74469 (DiagSpill)
  • Gyazo image-sharing platform breach exposed 23.6 million user records via unpatched server vulnerability (CVE: see source)
  • Rapuncel infostealer distributed via SEO-poisoned fake GitHub repositories impersonating LastPass Authenticator

Ongoing Campaigns

  • ShinyHunters breached Clop ransomware gang's Tor leak site, allegedly stealing server data and onion service private keys in retaliation for October 2025 dispute over CVE-2025-61882 exploit
  • Hacktron researchers used Claude Opus 5 to chain CVE-2026-32882 (libheif RCE) with OpenAI SSO weakness, achieving OpenAI staff account takeover in authorized security research

---

Sources

  • BleepingComputer: BragJack attacks, North Korean WaterPlum, ShinyHunters vs. Clop, Gyazo breach, Rapuncel infostealer, Check Point root RCE
  • The Hacker News: Claude Opus 5/OpenAI breach, SolarWinds ARM CVE-2026-28326, Orkes Conductor CVE-2026-58138, Google Gemini incident, CrowdSec/TanStack, CISA Linux kernel KEV, Linux kernel exploits, WordPress Click2Shell, Transparent Tribe, Azure AI Foundry CVE-2026-85889, abandoned CDN domain, Plugin4Shell, WeaselBiscuit, PhantomRaven
  • Unit 42 (Palo Alto Networks): AWS AgentCore Harness credential exfiltration analysis