# Threat Intel Brief — September 24, 2026

TL;DR

  • Check Point zero-days exploited in wild: CVE-2026-85102 (VPN gateway RCE) and CVE-2026-93616 (Management Server path traversal) under active attack since July; federal agencies face September 25 patch deadline.
  • WordPress CVE-2026-87902 mass exploitation: Attackers progressed from reconnaissance to writing web shells within hours of patch release; affects versions 4.7–7.1.1.
  • MikroTik RouterOS pre-auth takeover: CVE-2026-67279 and CVE-2026-86060 chained for unauthenticated admin access; evidence of exploitation before patches released September 3.
  • F5 BIG-IP APM OAuth RCE: CVE-2026-94127 (CVSS 9.8) actively exploited; allows unauthenticated remote code execution on OAuth authorization servers.
  • EvilTokens PhaaS disrupted: Microsoft-led takedown after 12,000 Microsoft 365 accounts compromised via AI-powered device-code phishing; two UK arrests.

---

Critical Threats

Check Point Security Gateway VPN Zero-Day (CVE-2026-85102)

What happened: Check Point confirmed active exploitation of a pre-authentication remote code execution vulnerability in Security Gateway VPN certificate-handling functionality. Attackers have been exploiting the flaw since September 12, 2026, using anonymization infrastructure to hide origin. A second zero-day (CVE-2026-93616) in Check Point Management Server was exploited as early as July 23, enabling unauthenticated script execution via path traversal. Both vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 25.

Impact: Unauthenticated attackers gain full control of Security Gateway VPN appliances and Management Servers, enabling network reconnaissance, VPN traffic interception, policy manipulation, and lateral movement. Management Servers control security policies for all managed Check Point gateways, meaning compromise affects entire enterprise security postures. Attack logs show creation of privileged accounts and configuration data exfiltration.

Recommendations:

  • Install LivePatch Take 26 immediately or deploy fixed Jumbo Hotfixes (R81.20 Take 166+, R82 Take 126+, R82.10 Take 44+)
  • If patching is delayed, disable VPN implied rules and restrict Site-to-Site VPN (UDP/500, UDP/4500) to specific peer IPs via explicit firewall rules
  • Hunt for compromise: search logs for certificate subjects matching CN=vpn, CN=vpn-user, CN=vpnuser; review connections from anonymization infrastructure since July 23
  • Audit firewall policy changes for unauthorized modifications indicating Management Server compromise
  • Review indicators of compromise published in Check Point security advisories sk1000171

---

WordPress Path Traversal RCE (CVE-2026-87902)

What happened: Threat actors began actively exploiting a critical WordPress vulnerability within hours of the September 22 patch release. The flaw allows unauthenticated attackers to load arbitrary PHP files via path traversal in template selection logic, escalating to remote code execution on vulnerable configurations. Exploitation progressed from reconnaissance probing to writing malicious PHP files (luci_*.php, zeta_*.php) to /tmp and /var/tmp that execute shell commands. Attack volume increased tenfold within 24 hours.

Impact: Unauthenticated remote code execution enables full server compromise on WordPress installations running versions 4.7–7.1.1 with vulnerable themes (those containing top-level "page-*" directories). Attackers are deploying persistent web shells for ongoing access. Sites using Docker-based WordPress or cPanel with PHP <8.5 face elevated risk due to default configurations that enable exploitation.

Recommendations:

  • Update all WordPress installations to version 7.1.2 immediately (patches backported to 4.7+)
  • Block source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b at perimeter firewalls
  • Search web server logs for double-encoded traversal sequences in 'pagename' parameter paired with 'page_id' since September 22, 17:44 UTC
  • Scan /tmp and /var/tmp for suspicious PHP files: wp-pear-rce-flag.php, poc87902.php, luci_*.php, zeta_*.php
  • Audit active themes for top-level directories starting with 'page-' and review pearcmd.php file permissions if present

---

MikroTik RouterOS Pre-Authentication Takeover (CVE-2026-67279, CVE-2026-86060)

What happened: CERT Polska disclosed the "MikroTrick" vulnerability chain affecting MikroTik RouterOS, allowing unauthenticated attackers to gain full administrative control of Internet-exposed routers. The chain exploits an SSH state-machine flaw (CVE-2026-67279) combined with argument-injection in the login process (CVE-2026-86060). Evidence shows exploitation before patches were released on September 3, 2026, including creation of privileged 'ops' accounts and configuration data exfiltration to attacker infrastructure.

Impact: Attackers gain complete router control without credentials, enabling configuration theft, persistent backdoor creation (user accounts, scheduled tasks, tunnels), traffic interception, and pivot points into internal networks. CISA added CVE-2026-86060 to the KEV catalog on September 10. Patching alone does not remove attacker persistence mechanisms already deployed.

Recommendations:

  • Update RouterOS immediately to version 6.49.21, 7.23.4, 7.24.2 or later
  • Run /system/device-mode/print to check Flagged status (detects some compromise indicators)
  • Search SSH logs for username '-2' and check user list for unexpected 'ops' account or unknown users
  • Audit scheduler entries, scripts, tunnels, proxies, .rif diagnostic files, and fetch activity for anomalies
  • If compromise indicators found: isolate device, preserve logs, factory reset, rebuild from trusted config, rotate all credentials
  • Restrict SSH access to trusted management networks only; do not expose SSH to the Internet

---

F5 BIG-IP APM OAuth Zero-Day (CVE-2026-94127)

What happened: F5 patched a critical zero-day heap-based buffer overflow in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution on systems configured as OAuth authorization servers. The vulnerability affects versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3 when APM access policy and OAuth authorization server profile are on the same virtual server. Active exploitation was confirmed by F5 and CERT-EU, prompting CISA to add the CVE to the KEV catalog on September 22.

Impact: Attackers can execute arbitrary code on BIG-IP APM servers without authentication via malicious traffic to the virtual server (CVSS 9.8). Management interface restrictions do not mitigate this flaw. Federal agencies have a September 25 deadline to patch. Potential for full system compromise on exposed OAuth authorization servers.

Recommendations:

  • Apply engineering hotfixes immediately: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
  • If immediate patching is not possible, request and deploy the iRule mitigation from F5 support
  • Check /var/log/apm for 10+ failed UserInfo requests with 'access token is invalid' error from single IPs
  • Run 'tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed' to check for spikes in total_failed counter
  • Review /var/log/audit for suspicious commands around OAuth failure timestamps; check for TMM SIGABRT events

---

Arista VeloCloud Orchestrator CVSS 10.0 Flaw (CVE-2026-93952)

What happened: Arista disclosed active exploitation of a maximum-severity improper input validation vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments using certificate-based Edge authentication. The flaw allows remote attackers without credentials to escalate privileges and compromise the VCO host. Patches are available for versions 5.2 (5.2.3.16+) and 6.4 (6.4.2.8+); fixes for 6.1 and 7.0 trains are pending. CISA added the CVE to the KEV catalog.

Impact: Unauthenticated remote code execution on SD-WAN management infrastructure enables attackers to compromise network configuration, monitoring, and edge device management. Known malicious IPs: 142.93.149.77 and 104.248.126.159. Organizations must hunt for compromise indicators even after patching.

Recommendations:

  • Immediately upgrade VCO to fixed versions: 5.2.3.16+ or 6.4.2.8+; contact Arista TAC for 6.1 and 7.0 options
  • Restrict VCO web interface access to administrative networks only via firewall rules
  • Hunt for compromise: check nginx logs for x-vc-opt header, scan for files /usr/local/sbin/.vcnode.js and /usr/local/sbin/vc-sysmond (MD5: dc78e206eaeadec59fc5801fe4556bd0)
  • Block IPs 142.93.149.77 and 104.248.126.159 at perimeter firewalls
  • If compromise suspected, preserve logs and engage Arista TAC for incident response support

---

Threat Actor Activity

EvilTokens PhaaS Platform Disrupted

Microsoft's Digital Crimes Unit, in coordination with Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, and The Shadowserver Foundation, disrupted the EvilTokens device-code phishing service following U.S. court authorization. The platform, tracked as Storm-2992, compromised over 12,000 Microsoft 365 accounts across 10,000+ organizations since February 2026. Two suspects (aged 32 and 38) were arrested in the UK on September 11. EvilTokens was the first PhaaS platform to support device-code authentication at scale, offering AI-powered features for customizing phishing lures and analyzing compromised inboxes. The service targeted wholesale distribution, construction, financial services, real estate, higher education, and healthcare sectors, primarily in the US, Canada, UK, Australia, India, and France.

Defensive actions:

  • Block OAuth device code authentication flow organization-wide unless specifically required for Teams devices
  • Review Microsoft 365 inbox rules for suspicious forwarding, deletion, or move-to-folder rules created since February 2026
  • Deploy Microsoft Defender XDR detections and execute hunting queries provided in Microsoft's advisory
  • Configure mail flow rules to block phishing emails using the 44 known EvilTokens themes (invoices, RFPs, shared files)
  • Audit OAuth token grants and revoke suspicious tokens issued via device code flow

---

AI-Powered Payment Skimmer Campaign

A financially motivated, Chinese-speaking threat actor leveraged open-source AI agent frameworks (Strix, Cairn, Hermes) to conduct large-scale attacks against online retailers, stealing over 600,000 credit card records and infecting 100+ websites with payment skimmers. The campaign, active since July 2026, demonstrates advanced automation: AI agents autonomously execute reconnaissance, exploitation, and post-compromise activities with minimal per-target cost ($25 average). Victims include a Fortune 500 hospitality company, a major U.S. airline, a large industrial supplies distributor, and an online fashion retailer. The actor uses traffic-ranking services for target selection and prioritizes custom software deployments.

Defensive actions:

  • Monitor for anomalous scanning patterns and rapid sequential vulnerability probing across web application endpoints
  • Implement file integrity monitoring on JavaScript files, checkout pages, Google Tag Manager configurations, and Kubernetes deployment manifests
  • Deploy behavioral analytics to identify unusual database access patterns, particularly bulk queries against payment tables followed by data deletion
  • Harden S3/CDN configurations with strict access controls and enable versioning to detect content poisoning
  • Implement Content Security Policy (CSP) headers and subresource integrity (SRI) checks for third-party JavaScript

---

Chinese-Speaking Actor Exploits WordPress and ZyXEL Flaws

A Chinese-speaking threat actor linked to the Red Heron group exploited vulnerabilities in ZyXEL GS1900 switches and WordPress to steal sensitive data from 996 devices and over 18,500 database records containing PII and plaintext passwords. The campaign, active since June 2026, targeted government and law enforcement systems across 48+ countries. Notable intrusions include a Western government entity (36 minutes of deep reconnaissance and credential theft) and a Russian state organization in occupied Ukraine. The actor rapidly weaponized wp2shell exploits (CVE: see source) within days of public disclosure in July 2026.

Defensive actions:

  • Prioritize patching WordPress, ZyXEL GS1900, Ubiquiti UniFi OS (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), and Gitea vulnerabilities
  • Deploy enhanced logging for command execution via Sysmon Event ID 1 and PowerShell ScriptBlock logging (Event ID 4104)
  • Implement network segmentation to prevent lateral movement from compromised edge devices to internal SQL servers
  • Monitor for password spraying via failed authentication logs
  • Audit and rotate credentials for backend databases; eliminate plaintext password storage

---

ShinyHunters Claims FBI Breach via PeopleSoft Zero-Day

The cybercrime group ShinyHunters claims to have breached FBI systems using a zero-day remote code execution vulnerability in Oracle PeopleSoft HR software, stealing 2TB–3TB of data including PII and PHI on FBI employees and applicants. The group alleges lateral movement into FBI-managed AWS GovCloud infrastructure and defacement of the FBI Jobs website. ShinyHunters states the attack was retaliatory in response to a May 2026 FBI FLASH report characterizing the group's tactics. The group claims to be actively exploiting the same zero-day against Fortune 500 companies and educational institutions. 404 Media verified some sample data matched DOJ personnel, lending partial credibility to breach claims.

Defensive actions:

  • Immediately patch Oracle PeopleSoft systems and monitor Oracle security advisories for emergency updates
  • Deploy enhanced monitoring for lateral movement from HR/recruitment systems to cloud infrastructure
  • Implement robust logging and SIEM alerting for PeopleSoft application servers, focusing on web shell deployment and anti-forensic activities
  • Conduct threat hunting for indicators of PeopleSoft compromise, including unexpected outbound connections and anomalous data exfiltration volumes
  • Establish defacement detection mechanisms for public-facing recruitment and HR portals

---

Geopolitical Context

European Critical Infrastructure Under Pressure

Multiple critical vulnerabilities affecting network management systems and SD-WAN platforms have emerged with active exploitation, creating systemic risk for European critical infrastructure. Belgium's CERT.BE issued urgent warnings for HPE Aruba EdgeConnect SD-WAN, Check Point Security Management, Cisco products, WSO2 API Management, Casdoor, pgAdmin 4, and Synology DiskStation Manager. The concentration of advisories from a NATO member state hosting EU institutions reflects heightened vigilance regarding infrastructure vulnerabilities that could be leveraged in hybrid conflict scenarios or intelligence collection operations.

Poland Leads Coordinated Disclosure Efforts

CERT Polska demonstrated mature cybersecurity practices through coordinated vulnerability disclosures for MikroTik RouterOS (MikroTrick chain) and WEBCON BPS (CVE-2026-92419), as well as detailed analysis of a multi-stage toll fraud operation targeting Polish mobile users via Meta advertisements and Google Play. The toll fraud campaign identified 1,235 ads linked to 17 malicious applications facilitating premium SMS and carrier billing fraud, highlighting platform abuse challenges under the EU's Digital Services Act.

Transatlantic Cybercrime Enforcement Coordination

The EvilTokens takedown demonstrates effective U.S.-UK law enforcement coordination, with U.S. court authorization from the Eastern District of Virginia and two arrests by UK Metropolitan Police. The operation involved unprecedented public-private collaboration across Microsoft, Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs. The case underscores cryptocurrency's continued role in cybercrime monetization, with over 700 distinct addresses making deposits to EvilTokens between October 2025 and June 2026.

---

Recommended Actions

0–24 Hours (Immediate)

  • Patch Check Point Security Gateway VPN (CVE-2026-85102) and Management Server (CVE-2026-93616); federal agencies face September 25 deadline
  • Update WordPress to 7.1.2 to address CVE-2026-87902; scan for web shells in /tmp and /var/tmp
  • Apply F5 BIG-IP APM hotfixes for CVE-2026-94127 or deploy iRule mitigation
  • Upgrade MikroTik RouterOS to 6.49.21, 7.23.4, or 7.24.2; hunt for 'ops' accounts and unauthorized SSH activity
  • Patch Arista VeloCloud Orchestrator to 5.2.3.16+ or 6.4.2.8+; block malicious IPs 142.93.149.77 and 104.248.126.159

24–72 Hours (Urgent)

  • Review Microsoft 365 inbox rules for suspicious forwarding/deletion rules created since February 2026 (EvilTokens indicators)
  • Audit OAuth token grants and revoke suspicious tokens issued via device code flow
  • Rotate credentials for backend databases and eliminate plaintext password storage (Chinese-speaking actor campaign)
  • Scan for malicious npm packages (tw-pkgprobe-7731) and PyPI packages (MemoryOS 2.0.34); rotate exposed secrets
  • Hunt for payment skimmers: implement file integrity monitoring on JavaScript files, checkout pages, and Google Tag Manager configurations

This Week (High Priority)

  • Patch Ubuntu 26.04, 24.04 LTS, and 22.04 LTS for CVE-2026-80521 (Linux kernel container escape)
  • Update cPanel & WHM to 11.134.0.57, 11.136.0.41, 11.138.0.8 or later; update WP Toolkit to 6.11.3+
  • Apply D-Link DIR-822A router mitigations (no patch available for CVE-2026-86296); plan immediate hardware replacement
  • Patch Bifrost AI Gateway to transports/v2.1.0 to address CVE-2026-90898
  • Review GitLab incoming email tokens for public exposure; reset tokens if found in READMEs or documentation

---

Watch List

  • Oracle PeopleSoft zero-day: Monitor Oracle security advisories for emergency patches addressing alleged RCE vulnerability claimed by ShinyHunters
  • ClosedQuorum AI-driven malware: Track Cisco Talos CAIRN toolkit updates for detection of AI-integrated malware behaviors
  • RemControl Android MaaS: Monitor for expansion beyond Europe and Canada; watch for additional banking app targets
  • BigDiskBuster Defender bypass: No patch or CVE assigned; monitor for Microsoft response to disk exhaustion technique
  • Network management system exploitation: InfraTrust report warns of accelerating attacks against Cisco, SonicWall, HPE, Arista, Dell, and NVIDIA management platforms

---

Sources

  • BleepingComputer (multiple articles)
  • The Hacker News (multiple articles)
  • CERT.PL (Poland): MikroTrick technical analysis, WEBCON BPS vulnerability, toll fraud analysis
  • CERT.BE (Belgium): Multiple critical vulnerability advisories
  • CERT-EU: F5 BIG-IP APM advisory
  • Microsoft Security: EvilTokens device-code phishing analysis
  • Check Point, F5, Arista, MikroTik, WordPress vendor advisories
  • CISA Known Exploited Vulnerabilities catalog

---

*This report covers threats observed through September 24, 2026. Organizations should prioritize patching based on asset exposure and operational risk. For technical details and indicators of compromise, consult vendor advisories and CERT publications linked in source articles.*