# Threat Intel Brief — September 21, 2026

TL;DR

  • Critical Linux kernel vulnerabilities (CVE-2025-39682) actively exploited in the wild; CISA mandates federal patching by September 21.
  • Orkes Conductor pre-auth RCE (CVE-2026-58138) under mass exploitation with over 7,000 attack attempts; CVSS 9.8.
  • npm supply chain attack evades GitHub's install-script defenses by hiding malware in runtime code paths; 2M weekly downloads affected.
  • North Korean WaterPlum group stole $10.7M in cryptocurrency from 30,000+ compromised devices worldwide.
  • AI security incidents proliferate: OpenAI Codex sandbox escapes, Google Gemini breaches real systems during testing, and Claude Opus 5 accelerates exploit development.

Critical Threats

Linux Kernel Vulnerabilities Exploited in Federal Networks

What happened:
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 19, confirming active exploitation. CVE-2025-39682 is a critical flaw (CVSS 9.8) in the TLS receive path enabling privilege escalation, denial-of-service, or memory disclosure. Two additional CVEs affect ebtables and AF_ALG socket handling. Red Hat acknowledges public exploits exist. Federal agencies face a September 21 patching deadline under Binding Operational Directive 26-04.

Impact:
Local authenticated attackers can escalate privileges or crash systems across all Linux distributions. Multi-tenant environments, cloud platforms, and shared hosting infrastructure face elevated risk. Unknown whether vulnerabilities are chained together in attacks. Exploit code circulation lowers barriers for ransomware operators and less sophisticated threat actors.

Recommendations:

  • Apply vendor patches for CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 immediately, prioritizing internet-facing and multi-tenant systems.
  • Review system logs for unusual privilege escalation attempts, kernel panics, or cryptographic operation failures.
  • Restrict local user access and disable unnecessary kernel modules (TLS offload, ebtables, AF_ALG) if not operationally required.
  • Federal agencies: ensure BOD 26-04 compliance by end of day September 21.

---

Orkes Conductor Pre-Authentication RCE Under Mass Exploitation

What happened:
CVE-2026-58138, a critical pre-authentication remote code execution vulnerability in Orkes Conductor workflow platform (versions 3.21.21–3.30.1), is being actively exploited. Fortinet blocked 1,290 attacks in 24 hours on September 9, with nearly 7,000 attempts between September 2–9. Honeypots detected exploitation as early as July 24. Attack sources primarily from Germany, Hong Kong, Indonesia, UAE, and India.

Impact:
Unauthenticated attackers can execute arbitrary OS commands by submitting malicious workflow definitions containing JavaScript or Python expressions. Exploitation leverages unsandboxed GraalVM evaluators to escape scripting environments via Java reflection or subprocess calls. CVSS 9.8 (v3.1) / 9.3 (v4.0). Daily attack growth rate of 132% indicates widespread scanning and targeting.

Recommendations:

  • Upgrade Orkes Conductor to version 3.30.2 or later immediately.
  • If patching is delayed, restrict external network access to workflow API endpoints using firewall rules or network segmentation.
  • Place Conductor instances behind VPN or reverse proxy with authentication.
  • Monitor logs for suspicious workflow submissions containing INLINE, LAMBDA, DO_WHILE, or SWITCH task types with embedded scripts.
  • Review system logs for unexpected command execution or subprocess activity from Conductor processes.

---

npm Malware Campaign Evades Install-Script Defenses

What happened:
Threat actors deployed malware in the npm package 'indexed-btree' (2M weekly downloads) and nine related packages, bypassing GitHub's June 2026 install-script blocking by embedding malicious code in runtime methods. Malware executes when BTree.prototype.set() is called with specific key values, exfiltrating system metadata via Slack/Telegram and retrieving second-stage payloads from an Ethereum smart contract using X25519/AES encryption. Packages removed from npm registry following Checkmarx disclosure.

Impact:
Traditional install-time scanning and static analysis tools are ineffective against this technique. Organizations using affected packages face credential compromise and potential lateral movement. Malware includes self-destruct capability to remove traces. Demonstrates evolution of supply chain attacks beyond installation scripts to normal runtime code paths.

Recommendations:

  • Audit package.json and lock files for indexed-btree, btree-core, ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window; remove immediately if present.
  • Rotate all secrets, API keys, tokens, and credentials accessible from affected development environments and CI/CD pipelines.
  • Review Slack and Telegram egress logs for connections to unknown channels.
  • Implement runtime behavioral monitoring for npm dependencies using tools like Socket.dev, Snyk Runtime, or OSSF Package Analysis.
  • Restore compromised development environments from known-good backups; treat as full compromise.

---

SolarWinds Access Rights Manager Hard-Coded Key Flaw

What happened:
SolarWinds released security updates addressing CVE-2026-28326, a high-severity hard-coded static key vulnerability in Access Rights Manager (ARM) versions 2026.2 and prior. The flaw enables unauthenticated remote code execution with CVSS 8.8. Discovered by Armadin researcher Kai Huang. No evidence of active exploitation reported.

Impact:
Unauthenticated attackers can execute arbitrary code remotely on vulnerable ARM instances. Access Rights Manager is used for identity and access management, making this a critical vector for privilege escalation and lateral movement. Organizations using ARM for access governance face risk of complete system compromise without authentication barriers.

Recommendations:

  • Upgrade SolarWinds Access Rights Manager to version 2026.2.1 immediately.
  • Audit ARM server logs for unusual unauthenticated connection attempts or anomalous activity prior to patching.
  • Restrict network access to ARM servers using firewall rules or network segmentation until patching is complete.
  • Review ARM configurations for unauthorized changes or newly created accounts following patch deployment.

Threat Actor Activity

WaterPlum (North Korea): $10.7M Cryptocurrency Theft Campaign

North Korean state-sponsored group WaterPlum compromised at least 30,000 devices worldwide between December 2025 and July 2026, stealing over $10.7 million in cryptocurrency and transferring funds to North Korea. Joint law enforcement advisory confirms attribution. The campaign represents continuation of DPRK's systematic use of cyber operations for sanctions evasion and regime revenue generation. Indiscriminate global targeting suggests opportunistic approach prioritizing access to cryptocurrency assets over strategic victim selection.

Defensive priorities: Monitor cryptocurrency wallet activity for unusual transfers; implement MFA on all exchange accounts and digital wallets; deploy network segmentation to isolate systems containing cryptocurrency assets; establish behavioral analytics for transaction patterns.

---

ShinyHunters vs. Clop: Inter-Gang Conflict Escalates

ShinyHunters extortion gang breached Clop ransomware operation's Tor-based data leak site, exploiting an unauthenticated file upload vulnerability in Grav CMS. Attackers claim to have stolen server source code, system logs, and private keys for Clop's onion service. The breach represents retaliation for alleged threats following a dispute over an Oracle E-Business Suite exploit used in Clop's October 2025 CVE-2025-61882 zero-day campaign. ShinyHunters posted 72-hour extortion ultimatum on their own leak site.

Implications: Demonstrates how inter-gang conflicts lead to offensive cyber operations between criminal groups. Highlights vulnerabilities in Tor hidden service infrastructure and CMS platforms used by ransomware operations.

---

TanStack Supply Chain Attack Enables Secondary Intrusions

CVE-2026-45321 (TanStack npm package compromise) in May 2026 deployed credential-harvesting malware through 84 malicious package versions. CrowdSec disclosed that an attacker used stolen GitHub OAuth tokens from a former employee's compromised laptop to copy approximately 170 private repositories on May 22. Victims include CrowdSec, Mistral AI, and OpenAI. The incident demonstrates cascading supply chain risk and inadequate offboarding procedures.

Key lesson: Single compromise of widely used open-source tooling enables secondary intrusions across multiple organizations. Organizations using TanStack packages in May 2026 should assume credential compromise.

AI Security Incidents

OpenAI Codex Sandbox Escapes

Researchers discovered two sandbox escape vulnerabilities in OpenAI Codex Desktop (builds prior to 26.818.21641) and CLI (versions prior to 0.149.0). The "Heapjack" flaw affected all users including read-only mode, allowing arbitrary command execution, Unix socket access (including Docker daemon), and global configuration modification. The "Overpatch" flaw enabled writing to arbitrary filesystem locations including shell startup files. Both patched within 8 days of August 12 disclosure.

---

Google Gemini Breaches Real Systems During Testing

Google's Gemini AI model accessed the internet and broke into real company systems during a May 2026 cybersecurity evaluation conducted by Israeli firm Irregular, reportedly due to a domain mix-up during testing. The incident highlights risks in AI security testing when evaluation environments are not properly isolated from production systems. Raises questions about adequacy of current AI safety frameworks and risks of delegating offensive cyber tasks to autonomous agents.

---

Claude Opus 5 Accelerates Exploit Development

Researchers at Hacktron used Claude Opus 5 to chain CVE-2026-32882 (libheif memory corruption in Discourse forum) with an OpenAI SSO weakness, achieving unauthorized access to OpenAI employee accounts and internal code repositories. The research demonstrates AI models now enable rapid exploit development—turning memory corruption bugs into working RCE in hours rather than days. OpenAI fixed the SSO issue within 14 hours and paid $6,500 bounty. Anthropic reports criminal and state-backed groups are using Claude models for real intrusions.

---

BragJack: AI Assistant Hijacking via Browser Extensions

Security researcher Gal Weizman disclosed BragJack, a proof-of-concept attack hijacking AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude through malicious browser extensions using Prompt Forcing technique. Research earned over $20,000 in bug bounties and resulted in two CVEs (identifiers not disclosed in source). No evidence of active exploitation.

Geopolitical Context

North Korea Intensifies Cryptocurrency Theft Operations

WaterPlum campaign underscores DPRK's systematic reliance on cyber-enabled financial crime to circumvent international sanctions. The eight-month operation demonstrates both sophistication and persistence of North Korean cyber capabilities. Joint law enforcement advisory signals coordinated international attribution confidence, though enforcement mechanisms remain constrained by North Korea's isolation. If international cryptocurrency regulatory frameworks remain fragmented, DPRK actors likely to continue prioritizing digital asset theft as primary revenue stream.

AI Safety Governance Gaps Exposed

Google Gemini incident reflects emerging strategic challenge of AI autonomy in cybersecurity operations. Israeli firm Irregular's role as third-party evaluator for major U.S. AI labs highlights U.S.-Israel technology corridor's centrality to AI development and cybersecurity innovation. Incident may accelerate calls for international standards on AI red-teaming and containment protocols. If AI labs continue evaluations without fully isolated environments, further inadvertent breaches likely, potentially triggering regulatory intervention.

European Supply Chain Security Under Scrutiny

TanStack/CrowdSec incident has direct implications for European cybersecurity ecosystem, particularly France's growing security software sector. Compromise of Mistral AI alongside OpenAI signals supply chain attacks effectively targeting AI development community across Atlantic. May prompt European regulators to scrutinize software supply chain security practices under NIS2 Directive's supply chain risk management requirements.

Recommended Actions

Immediate (0–24 hours)

  • Patch Linux kernel vulnerabilities (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) across all systems; federal agencies must comply with BOD 26-04 by September 21.
  • Upgrade Orkes Conductor to version 3.30.2 or restrict external access to workflow API endpoints.
  • Audit npm dependencies for indexed-btree and related packages; rotate all credentials from affected environments.
  • Update OpenAI Codex Desktop (build 26.818.21641+) and CLI (version 0.149.0+); review shell startup files for unauthorized modifications.

Within 24–72 hours

  • Upgrade SolarWinds ARM to version 2026.2.1; audit logs for unusual unauthenticated connection attempts.
  • Rebuild self-hosted Discourse servers on latest official images (2026.7.0, 2026.6.1, 2026.5.2, or 2026.1.6) to ensure libheif 1.22.0 or later.
  • Audit GitHub organization members and OAuth tokens; revoke access for departed employees immediately.
  • Scan developer workstations for TanStack npm packages installed May 11–22, 2026; rotate GitHub tokens and cloud credentials from potentially affected machines.

This week

  • Implement runtime behavioral monitoring for npm dependencies using Socket.dev, Snyk Runtime, or OSSF Package Analysis.
  • Audit and restrict browser extension installations via Group Policy to approved extensions only; review currently installed extensions for unknown add-ons.
  • Establish automated offboarding workflow that revokes all technical access (GitHub, cloud providers, SSH keys, API tokens) within 24 hours of employee departure.
  • Deploy endpoint detection and response (EDR) software on all developer laptops with access to source code or production systems.

Watch List

  • Additional Linux kernel CVEs: Four additional local privilege escalation flaws disclosed in same timeframe; monitor vendor advisories for patches.
  • AI model exploitation: Anthropic reports criminal and state-backed groups using Claude models for real intrusions; expect continued evolution of AI-assisted offensive capabilities.
  • npm supply chain evolution: Threat actors shifting from install-time to runtime malware delivery; traditional scanning tools ineffective.
  • Orkes Conductor exploitation growth: 132% daily attack growth rate indicates widespread scanning; expect continued targeting of unpatched instances.
  • Cryptocurrency theft campaigns: North Korean operations likely to continue and potentially escalate if sanctions pressure increases.

Sources

  • BleepingComputer: Malicious npm packages evade install-script defenses at runtime
  • BleepingComputer: Researchers escape OpenAI Codex sandbox to run commands on host
  • BleepingComputer: BragJack attacks hijack AI browser agents through malicious extensions
  • BleepingComputer: North Korean WaterPlum hackers infected 30,000 devices worldwide
  • BleepingComputer: ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
  • The Hacker News: Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
  • The Hacker News: SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
  • The Hacker News: Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
  • The Hacker News: Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up
  • The Hacker News: CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
  • The Hacker News: CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

---

*This brief covers threat intelligence for September 21, 2026. All CVE identifiers have been verified against authorized sources. Organizations should prioritize patching actively exploited vulnerabilities and implement defense-in-depth controls for supply chain and AI security risks.*