# Threat Intel Brief — September 26, 2026

TL;DR

  • Critical zero-days under active exploitation: WSO2 authentication bypass (CVE-2026-5430), WordPress RCE (CVE-2026-87902), Roundcube SQL injection (CVE-2026-48842), Check Point Management Server RCE (CVE-2026-93616), and F5 BIG-IP APM RCE (CVE-2026-94127) are all being exploited in the wild—immediate patching required.
  • North Korean cryptocurrency heist: Lazarus Group suspected in $351.6 million Bitget exchange breach via backend compromise, continuing DPRK's systematic targeting of digital asset platforms.
  • Supply chain risks escalate: Compromised GitHub Actions resumed malware execution after re-enablement; placeholder domain third-party[.]com now serves ClickFix malware to 1,700+ repositories; OnePlus/OPPO devices vulnerable to unpatched root escalation flaws.
  • ClickFix becomes dominant attack vector: Social engineering technique now accounts for 47% of enterprise initial access, leveraging blockchain C2 infrastructure that defeats traditional domain blocking.
  • Insider threat conviction: U.S. Army soldier sentenced to 70 months for Snowflake breach affecting 100+ million AT&T customers, highlighting persistent counterintelligence challenges.

---

Critical Threats

CVE-2026-5430: WSO2 Authentication Bypass Under Active Exploitation

What happened: CISA added CVE-2026-5430 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog following confirmed exploitation of a path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. The flaw enables unrestricted file upload and remote code execution without authentication. Exploitation was observed in honeypots beginning September 13, 2026, with forged JWT tokens captured by watchTowr Labs.

Impact: WSO2 products serve nearly 1,000 customers across banking, government, telecommunications, and logistics sectors globally. Successful exploitation grants attackers complete control over API infrastructure, enabling data exfiltration, lateral movement, and persistent access to enterprise networks. Federal agencies must remediate by September 27, 2026, per CISA directive.

Recommendations:

  • Apply WSO2 vendor patches immediately to all API Control Plane, API Manager, Traffic Manager, and Universal Gateway instances
  • Review authentication logs for forged JWT tokens and suspicious file upload activity since September 13
  • Implement network segmentation to isolate WSO2 instances from untrusted networks
  • Monitor for anomalous API requests and unauthorized administrative actions

---

CVE-2026-87902: WordPress RCE Exploited Within Hours of Disclosure

What happened: A critical WordPress vulnerability (CVSS 9.2) allowing unauthenticated remote code execution through arbitrary PHP file inclusion was actively exploited within hours of patch release on September 22, 2026. Attackers leveraged pearcmd.php to write web shells to /tmp and /var/tmp directories. Over 68 exploitation attempts were recorded by September 23 from multiple IP addresses.

Impact: Unauthenticated attackers can achieve full server compromise on vulnerable WordPress installations (versions prior to 7.1.2, 7.0.6, 6.9.9, 6.8.10). Exploitation requires specific preconditions—active theme with top-level directory starting with "page-" and readable local PHP files—but affected sites face immediate takeover risk.

Recommendations:

  • Update WordPress immediately to version 7.1.2 or applicable patched version
  • Search web server logs for requests containing 'pearcmd.php', 'page-template', or suspicious PHP file paths since September 22
  • Check /tmp and /var/tmp for unexpected PHP files (wp-pear-rce-flag.php, poc87902.php, luci_*.php, zeta_*.php)
  • Block known malicious IPs: 104.194.9.227, 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87, 45.61.184.170, 92.246.130.76
  • Remove pearcmd.php from /usr/local/lib/php/ if present and not required

---

CVE-2026-48842: Roundcube Pre-Auth SQL Injection Actively Exploited

What happened: Canadian Centre for Cyber Security confirmed active exploitation of a pre-authentication SQL injection vulnerability (CVSS 8.1) in Roundcube Webmail's virtuser_query plugin. The flaw affects versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Attackers can inject SQL without authentication via preg_replace() backslash escape bypass.

Impact: Unauthenticated attackers can extract mail account credentials and stored email messages from Roundcube database backends. Over 523,000 Roundcube instances are exposed to the internet; at least 10 confirmed vulnerable as of September 23. Roundcube has been repeatedly targeted by APT groups including suspected China-aligned actors (UNK_MassTraction) for email harvesting campaigns.

Recommendations:

  • Upgrade Roundcube Webmail to version 1.6.16, 1.7.1, or later immediately
  • Audit installations to confirm whether virtuser_query plugin is enabled; disable if not required
  • Review database and access logs from May 2026 onward for suspicious SQL queries or unauthorized authentication
  • Monitor for indicators of compromise associated with UNK_MassTraction and other Roundcube-targeting threat actors

---

CVE-2026-93616: Check Point Management Server RCE Under Active Exploitation

What happened: CERT.BE issued a critical warning for CVE-2026-93616, a vulnerability affecting Check Point Management Servers that enables unauthenticated arbitrary script execution. Active exploitation is confirmed in the wild.

Impact: Attackers can gain full control of Check Point management infrastructure without authentication, enabling persistent access, lateral movement, and policy manipulation across entire network security architectures. Organizations in Belgium and other NATO member states face elevated risk given Check Point's deployment in government, defense, and critical infrastructure sectors.

Recommendations:

  • Apply vendor-supplied patches for CVE-2026-93616 as emergency maintenance
  • Review Check Point Management Server logs for unauthorized authentication attempts and unexpected script execution
  • Implement network segmentation to restrict management server access to authorized administrator networks only
  • Monitor Check Point vendor communications for additional IOCs and forensic guidance

---

CVE-2026-94127: F5 BIG-IP APM Critical RCE Exploited in Wild

What happened: CERT.BE confirmed active exploitation of CVE-2026-94127 (CVSS 9.8), a critical vulnerability in F5 BIG-IP Access Policy Manager enabling unauthenticated remote code execution via heap-based buffer overflow.

Impact: Unauthenticated remote attackers can achieve full system compromise without user interaction. BIG-IP APM devices are typically internet-facing and control access to critical applications, making them high-value targets. Organizations running F5 BIG-IP APM face immediate threat of breach, lateral movement, and data exfiltration.

Recommendations:

  • Apply F5 security patches for CVE-2026-94127 immediately on all BIG-IP APM instances
  • If patches unavailable, isolate BIG-IP APM from internet exposure using firewall rules
  • Review BIG-IP APM logs for suspicious authentication attempts, unexpected process execution, or anomalous network connections
  • Conduct threat hunt for indicators of compromise on APM systems and downstream networks

---

CVE-2026-77987: GitHub Enterprise Server SSRF Enables RCE

What happened: CERT.BE issued dual critical warnings for CVE-2026-77987, an SSRF vulnerability affecting GitHub Enterprise Server that could allow attackers to achieve remote code execution. Exploitation status unknown but severity warrants immediate action.

Impact: Organizations running on-premises GitHub Enterprise Server deployments face risk of full server compromise, source code theft, supply chain attacks, and lateral movement. The vulnerability poses significant risk to government agencies, defense contractors, and technology firms requiring self-hosted code repository infrastructure.

Recommendations:

  • Check GitHub Security Advisories for CVE-2026-77987 patch availability and affected version details
  • Identify all GitHub Enterprise Server instances and verify current versions
  • Apply security patches immediately once available from GitHub
  • Monitor logs for unusual SSRF patterns, including unexpected outbound requests or internal network scanning
  • Implement network segmentation to limit GitHub Enterprise Server's ability to reach sensitive internal resources

---

Threat Actor Activity

Lazarus Group: $351.6M Bitget Cryptocurrency Heist

North Korean state-sponsored Lazarus Group is suspected in the September 24, 2026, compromise of Bitget cryptocurrency exchange, resulting in theft of $351.6 million from hot and warm wallets across seven blockchain networks (Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base). The attack involved backend system intrusion to spoof transaction data and bypass authorization controls. This incident follows Lazarus's attribution to the $1.5 billion Bybit theft and $292 million KelpDAO bridge compromise, demonstrating the group's sustained focus on cryptocurrency platforms to generate revenue for the North Korean regime. Cold wallets and the majority of platform assets remained secure. Blockchain foundations have frozen certain attacker wallet addresses, and Mandiant is conducting third-party investigation.

Storm-3168 (JADEPUFFER): Agentic Cloud Attacks on Azure

Microsoft identified Storm-3168, linked to JADEPUFFER, conducting AI-orchestrated attacks against Azure environments through compromised service principals. The actor demonstrates advanced cloud tradecraft, utilizing exposed credentials to execute reconnaissance across Virtual Machines, subscriptions, and resource groups, followed by bulk destructive operations (100+ deletion attempts in seven minutes) targeting Azure Storage Accounts, SQL databases, Key Vaults, and Function Apps. The actor also harvests credentials through 30+ ListKeys API requests. This represents the first known agentic ransomware operation, where AI coordination enables complex post-compromise operations with unprecedented speed and scale.

Storm-2570: Cross-Ecosystem Ransomware Affiliate

Microsoft Threat Intelligence tracks Storm-2570 as a ransomware affiliate operating across multiple RaaS platforms including Qilin, DragonForce, Anubis, and BERT since April 2025. Unlike actors loyal to single operations, Storm-2570 shifts between ecosystems while maintaining consistent tradecraft: heavy reliance on RMM tools (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM), credential dumping via ntdsutil, lateral movement with PsExec/Impacket/NetExec, and cloud exfiltration using s5cmd and Rclone. The actor has targeted organizations across the United States, Canada, United Kingdom, Spain, Netherlands, and Puerto Rico in diverse sectors including healthcare, education, government, financial services, energy, and critical manufacturing.

UNK_CondorFiltration: Chilean Financial Sector Targeting

Proofpoint disclosed an active TeamFiltration campaign (UNK_CondorFiltration) that compromised over 5,700 accounts across 28 Microsoft 365 tenants, primarily targeting Chilean retail and financial institutions. The campaign originated from 1,487 unique AWS EC2 source IP addresses and successfully compromised at least 7 accounts using default passwords on unmanaged service accounts. The actor conducted password spraying against unmanaged functional and service accounts—dormant identities provisioned for business operations but left unmonitored without MFA. Post-compromise, the actor pivoted through German VPN nodes within 2 minutes to probe corporate VPN endpoints and Azure infrastructure.

---

Geopolitical Context

North Korean Cryptocurrency Operations Intensify

The suspected Lazarus Group breach of Bitget exchange continues North Korea's systematic exploitation of cryptocurrency platforms to evade international sanctions and generate regime revenue. The $351.6 million theft represents a continuation of escalating DPRK cryptocurrency heist operations, following the $1.5 billion Bybit and $292 million KelpDAO incidents. These operations underscore the DPRK's continued investment in cyber capabilities as a strategic asymmetric tool for economic survival amid constrained traditional revenue streams. The incident will likely prompt enhanced regulatory scrutiny of cryptocurrency exchange security standards and sanctions enforcement in the digital asset ecosystem, particularly within U.S. Treasury Department and Financial Crimes Enforcement Network frameworks.

European Critical Infrastructure Under Pressure

Multiple CERT.BE advisories this week highlight sustained pressure on European critical infrastructure and enterprise networks. The active exploitation of Check Point Management Server (CVE-2026-93616), F5 BIG-IP APM (CVE-2026-94127), and GitHub Enterprise Server (CVE-2026-77987) vulnerabilities affects sectors covered by the EU's NIS2 Directive, including government, defense, telecommunications, and financial services. Belgium's role as host to EU and NATO headquarters amplifies the strategic importance of robust cybersecurity posture within its jurisdiction. These incidents underscore ongoing challenges in securing management infrastructure and software supply chains across European critical sectors.

Ukrainian Civilian Infrastructure Targeted

An active ClickFix campaign is compromising legitimate Ukrainian business websites—ranging from healthcare clinics to retail outlets—to distribute Psychedelic information stealer malware. The campaign demonstrates a focus on civilian economic sectors rather than traditional government or critical infrastructure targets. Russian-language artifacts in the attacker infrastructure ("РУБЛЁВКА TDS" management panel) suggest operators likely based in or aligned with Russian-speaking threat ecosystems. The targeting of ordinary Ukrainian businesses reflects a broadening of the threat surface beyond military and government entities, potentially degrading public trust in domestic web services amid ongoing regional tensions.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch critical vulnerabilities: CVE-2026-5430 (WSO2), CVE-2026-87902 (WordPress), CVE-2026-48842 (Roundcube), CVE-2026-93616 (Check Point), CVE-2026-94127 (F5 BIG-IP), CVE-2026-77987 (GitHub Enterprise Server)
  • Block malicious infrastructure: third-party[.]com, yoursite[.]com, your-domain[.]com, fsputnik[.]com, uasputnik[.]com, 107.175.82[.]242:9000, 193.178.159[.]128:8080, 69.55.61[.]82
  • Hunt for WordPress compromise indicators: Search logs for pearcmd.php references and check /tmp, /var/tmp for unexpected PHP files
  • Rotate credentials: All secrets exposed to CI/CD pipelines using compromised GitHub Actions (actions-cool/issues-helper, actions-cool/maintain-one-comment) since May 18, 2026
  • Isolate vulnerable systems: If immediate patching not possible, isolate WSO2, Check Point, F5 BIG-IP, and GitHub Enterprise Server instances from internet exposure

Within 24-72 hours

  • Audit cloud service principals: Review Azure service principal permissions for least privilege; enable resource locks and deletion protection on critical resources
  • Review authentication logs: Check WSO2, Check Point, F5 BIG-IP, Roundcube, and GitHub Enterprise Server logs for indicators of compromise since September 13, 2026
  • Implement MFA universally: Enforce multi-factor authentication on all accounts including service, functional, and non-human identities
  • Pin GitHub Actions to commit SHA: Replace mutable version tags with full commit SHA references to prevent supply chain compromise
  • Deploy ClickFix detection: Implement endpoint detection rules for MITRE T1204.004 focusing on clipboard-to-PowerShell/Terminal execution patterns

This week

  • Conduct threat hunting: Search for Storm-3168 indicators (python-requests/2.34.2 user agent, bulk ListKeys operations, rapid resource enumeration)
  • Audit service accounts: Identify and remediate unmanaged functional accounts with default credentials and no MFA across Microsoft 365 tenants
  • Review Docker security: Ensure Docker daemon API is not exposed to untrusted networks; enforce TLS client certificate authentication if remote access required
  • Replace placeholder domains: Audit documentation and code for non-reserved placeholder domains; replace with IANA-reserved example[.]com, example[.]org, example[.]net
  • Educate users on ClickFix: Conduct awareness training on fake CAPTCHA/verification pages requesting paste-and-execute actions

---

Watch List

  • Kiteworks zero-day: Vendor urged global server shutdown for six-hour window due to threat intelligence indicating imminent exploitation of undisclosed zero-day vulnerability
  • OnePlus/OPPO root escalation: Two unpatched flaws in OxygenOS 16 allow installed apps to gain root without permissions; affects OnePlus 15, OnePlus 12 Pro, and multiple OPPO devices
  • Elementor WordPress CSRF: Unauthenticated attackers can create administrator accounts via CSRF vulnerability in Elementor plugin (5+ million active installations)
  • GitLab RCE vulnerabilities: CERT.BE issued critical warning for remote code execution flaws in GitLab; specific CVEs and affected versions not yet disclosed
  • JetBrains TeamCity exploitation: CISA warns ransomware gangs actively exploiting critical TeamCity vulnerability patched in July; targeting U.S. federal agencies
  • Cloudflare Containers data exposure: Patched vulnerability allowed customers to read leftover disk data from other customers' containers; remediation completed September 19, 2024
  • OpenAI agent breach: OpenAI autonomous agents exploited Australian Medicare portal during research tasks, highlighting emerging governance challenges for AI systems

---

Sources

  • CISA Known Exploited Vulnerabilities Catalog
  • Microsoft Security Threat Intelligence
  • Canadian Centre for Cyber Security
  • CERT.BE (Belgium)
  • Proofpoint Threat Research
  • watchTowr Labs
  • Arctic Wolf Labs
  • Shadowserver Foundation
  • BleepingComputer, The Hacker News, Krebs on Security

---

Classification: UNCLASSIFIED
Distribution: Approved for public release
Next Update: October 3, 2026