Major Incidents or Breaches

  • CenterPoint Energy confirmed a cyberattack resulting in the theft and leak of some customers’ personal data by an unidentified attacker[20].
  • Premier Medical Group reported a data breach affecting 280,000 individuals, with compromised files including names, contact details, diagnosis information, and health insurance data[36].
  • Malicious versions of the Admin Menu Editor Pro WordPress plugin were distributed after the maintainer’s website was compromised, resulting in backdoors being installed on approximately 1,500 sites[19].
  • A hacker collective accessed and dumped data from a Flock surveillance camera, exposing thousands of videos and logs, including 1.6 million images of 50,000 vehicles over 21 days[29].

Newly Discovered Vulnerabilities

  • Google disclosed and patched a high-severity privilege escalation vulnerability (CVE-2026-58704) in Pixel cellular modems, which has been exploited in targeted attacks[5][17][43].
  • Acronis warned of a high-severity local privilege escalation flaw (CVE-2026-87886) in its cPanel/WHM backup plugin, which has been actively exploited[7][18][38].
  • Attackers are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin, allowing PHP web shell uploads and affecting over 6,000 active installs[8][22].
  • A critical JWT bypass vulnerability (CVE-2026-5430) in WSO2 API Manager is under active exploitation, enabling attackers to forge admin tokens and access enterprise data[9][39].
  • Oracle released security updates addressing over 800 vulnerabilities across 17 product families, including more than 100 critical-severity flaws[40].
  • Chrome and Firefox issued updates to patch a combined total of 115 vulnerabilities (42 in Chrome, 73 in Firefox)[37].
  • Unauthenticated remote code execution flaws in The Events Calendar WordPress plugin could expose over 200,000 sites to takeover[34].
  • A critical-severity ConnectWise ScreenConnect vulnerability is being actively exploited, as confirmed by CISA[15].

Notable Threat Actor Activity

  • The NightEagle APT group is targeting Russian companies using the GhostContainer backdoor, GitHub-hosted tools, and by exploiting Active Directory vulnerabilities[1].
  • Iranian state-linked actors are using Telegram-controlled Windows malware (dubbed “Chosen Brick”) to spy on dissidents, journalists, and NGOs, as detailed by US, UK, and Dutch agencies[11][33].
  • A likely North Korean APT deployed a previously undocumented Linux espionage toolkit to compromise South Korean media and automotive sector networks via load balancers[24].
  • The KREMLIN banking malware operation, attributed to Brazilian threat actors, hijacks Chrome and Edge browsers to steal credentials and session tokens[10].
  • BambooToken malware, active since at least 2023, uses the MQTT protocol for command and control of Windows and Linux systems in a multi-platform campaign[12][21].

Trends, Tools, or Tactics of Interest

  • Phishing campaigns are increasingly using passkey-themed lures to trick users into granting persistent access to cloud environments and accounts[2].
  • Threat actors are sending phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters[3].
  • The N0va phishing kit is targeting US and EU organizations by impersonating trusted services and abusing legitimate authentication flows to compromise identities[4].
  • AI is being leveraged by scammers to create more convincing and polished fake antivirus renewal pages[44].
  • The VectraRAT malware-as-a-service platform is being marketed for $250 per month, offering comprehensive Windows remote access capabilities including C2 infrastructure and operator panels[27].

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft has agreed to implement enhanced AI privacy rules and guardrails for student data in schools, following negotiations with the American Federation of Teachers[41].
  • Microsoft reminded customers that Windows Server 2022 will reach the end of mainstream support next month and will enter extended support until October 2031[16].

Sources#

  1. CenterPoint Energy confirms customer data stolen in cyberattack - bleepingcomputer.com
  2. 280,000 Impacted by Premier Medical Group Data Breach - securityweek.com
  3. Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites - bleepingcomputer.com
  4. Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works - wired.com
  5. Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation - thehackernews.com
  6. Google fixes actively exploited Android zero-day on Pixel devices - bleepingcomputer.com
  7. Google Pixel owners urged to patch actively exploited modem flaw - malwarebytes.com
  8. Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks - thehackernews.com
  9. Acronis warns of actively exploited flaw in its cPanel backup plugin - bleepingcomputer.com
  10. Acronis Patches Exploited Vulnerability in cPanel Backup Plugin - securityweek.com
  11. Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells - thehackernews.com
  12. Hackers target WordPress sites via third-party WooCommerce plugin - bleepingcomputer.com
  13. Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens - thehackernews.com
  14. Enterprises Warned of Attacks Exploiting WSO2 Vulnerability - securityweek.com
  15. Oracle Patches 800+ Vulnerabilities in September 2026 Security Update - securityweek.com
  16. Chrome, Firefox Updates Patch 115 Vulnerabilities - securityweek.com
  17. Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover - securityweek.com
  18. Critical ScreenConnect flaw now actively exploited in attacks - bleepingcomputer.com
  19. NightEagle targets Russian companies - securelist.com
  20. Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists - thehackernews.com
  21. US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware - securityweek.com
  22. Cyber Op Targets South Korean Media & Automotive Sectors - darkreading.com
  23. KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens - thehackernews.com
  24. BambooToken Malware Uses MQTT to Control Windows and Linux Systems - thehackernews.com
  25. BambooToken malware controls Windows and Linux systems via MQTT - bleepingcomputer.com
  26. Attackers Use Passkey-Themed Phishing to Breach Cloud Environments - blog.knowbe4.com
  27. Phishing Emails Use New Technique to Bypass Microsoft 365 Security Filters - blog.knowbe4.com
  28. N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security - thehackernews.com
  29. AI helps scammers build convincing antivirus renewal pages - malwarebytes.com
  30. VectraRAT Can Hack Windows Enterprises for $250 per Month - darkreading.com
  31. Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow? - securityweek.com
  32. Windows Server 2022 reaches end of mainstream support next month - bleepingcomputer.com