Cybersecurity Brief – 2026-09-16

Wed, 16 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

CenterPoint Energy confirmed a cyberattack resulting in the theft and leak of some customers’ personal data by an unidentified attacker^[20].
Premier Medical Group reported a data breach affecting 280,000 individuals, with compromised files including names, contact details, diagnosis information, and health insurance data^[36].
Malicious versions of the Admin Menu Editor Pro WordPress plugin were distributed after the maintainer’s website was compromised, resulting in backdoors being installed on approximately 1,500 sites^[19].
A hacker collective accessed and dumped data from a Flock surveillance camera, exposing thousands of videos and logs, including 1.6 million images of 50,000 vehicles over 21 days^[29].

Newly Discovered Vulnerabilities

Google disclosed and patched a high-severity privilege escalation vulnerability (CVE-2026-58704) in Pixel cellular modems, which has been exploited in targeted attacks^[5]^[17]^[43].
Acronis warned of a high-severity local privilege escalation flaw (CVE-2026-87886) in its cPanel/WHM backup plugin, which has been actively exploited^[7]^[18]^[38].
Attackers are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin, allowing PHP web shell uploads and affecting over 6,000 active installs^[8]^[22].
A critical JWT bypass vulnerability (CVE-2026-5430) in WSO2 API Manager is under active exploitation, enabling attackers to forge admin tokens and access enterprise data^[9]^[39].
Oracle released security updates addressing over 800 vulnerabilities across 17 product families, including more than 100 critical-severity flaws^[40].
Chrome and Firefox issued updates to patch a combined total of 115 vulnerabilities (42 in Chrome, 73 in Firefox)^[37].
Unauthenticated remote code execution flaws in The Events Calendar WordPress plugin could expose over 200,000 sites to takeover^[34].
A critical-severity ConnectWise ScreenConnect vulnerability is being actively exploited, as confirmed by CISA^[15].

Notable Threat Actor Activity

The NightEagle APT group is targeting Russian companies using the GhostContainer backdoor, GitHub-hosted tools, and by exploiting Active Directory vulnerabilities^[1].
Iranian state-linked actors are using Telegram-controlled Windows malware (dubbed “Chosen Brick”) to spy on dissidents, journalists, and NGOs, as detailed by US, UK, and Dutch agencies^[11]^[33].
A likely North Korean APT deployed a previously undocumented Linux espionage toolkit to compromise South Korean media and automotive sector networks via load balancers^[24].
The KREMLIN banking malware operation, attributed to Brazilian threat actors, hijacks Chrome and Edge browsers to steal credentials and session tokens^[10].
BambooToken malware, active since at least 2023, uses the MQTT protocol for command and control of Windows and Linux systems in a multi-platform campaign^[12]^[21].

Trends, Tools, or Tactics of Interest

Phishing campaigns are increasingly using passkey-themed lures to trick users into granting persistent access to cloud environments and accounts^[2].
Threat actors are sending phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters^[3].
The N0va phishing kit is targeting US and EU organizations by impersonating trusted services and abusing legitimate authentication flows to compromise identities^[4].
AI is being leveraged by scammers to create more convincing and polished fake antivirus renewal pages^[44].
The VectraRAT malware-as-a-service platform is being marketed for $250 per month, offering comprehensive Windows remote access capabilities including C2 infrastructure and operator panels^[27].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has agreed to implement enhanced AI privacy rules and guardrails for student data in schools, following negotiations with the American Federation of Teachers^[41].
Microsoft reminded customers that Windows Server 2022 will reach the end of mainstream support next month and will enter extended support until October 2031^[16].

Sources

CenterPoint Energy confirms customer data stolen in cyberattack - bleepingcomputer.com
280,000 Impacted by Premier Medical Group Data Breach - securityweek.com
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites - bleepingcomputer.com
Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works - wired.com
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation - thehackernews.com
Google fixes actively exploited Android zero-day on Pixel devices - bleepingcomputer.com
Google Pixel owners urged to patch actively exploited modem flaw - malwarebytes.com
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks - thehackernews.com
Acronis warns of actively exploited flaw in its cPanel backup plugin - bleepingcomputer.com
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin - securityweek.com
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells - thehackernews.com
Hackers target WordPress sites via third-party WooCommerce plugin - bleepingcomputer.com
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens - thehackernews.com
Enterprises Warned of Attacks Exploiting WSO2 Vulnerability - securityweek.com
Oracle Patches 800+ Vulnerabilities in September 2026 Security Update - securityweek.com
Chrome, Firefox Updates Patch 115 Vulnerabilities - securityweek.com
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover - securityweek.com
Critical ScreenConnect flaw now actively exploited in attacks - bleepingcomputer.com
NightEagle targets Russian companies - securelist.com
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists - thehackernews.com
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware - securityweek.com
Cyber Op Targets South Korean Media & Automotive Sectors - darkreading.com
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens - thehackernews.com
BambooToken Malware Uses MQTT to Control Windows and Linux Systems - thehackernews.com
BambooToken malware controls Windows and Linux systems via MQTT - bleepingcomputer.com
Attackers Use Passkey-Themed Phishing to Breach Cloud Environments - blog.knowbe4.com
Phishing Emails Use New Technique to Bypass Microsoft 365 Security Filters - blog.knowbe4.com
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security - thehackernews.com
AI helps scammers build convincing antivirus renewal pages - malwarebytes.com
VectraRAT Can Hack Windows Enterprises for $250 per Month - darkreading.com
Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow? - securityweek.com
Windows Server 2022 reaches end of mainstream support next month - bleepingcomputer.com

CVE-2026-87886 on DanSec Daily

Cybersecurity Brief – 2026-09-16

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources