Forum Widgets
Recent Discussions
php2shell (CVE-2026-109618, CVE-2026-109619): FAQ about critical PHP remote code execution flaws
On October 20, CVE identifiers for two critical vulnerabilities in PHP began circulating on Hacker News and social media. Later that day, the PHP security team published an advance notice of an emergency security release scheduled for October 21 at 14:00 UTC. Public reporting describes both as remote code execution vulnerabilities, and a video credited to researcher LCFR and Calif.io demonstrates an exploit chain dubbed php2shell. CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 Cloudflare CTO Dane Knecht said the company is seeing early attacks emerging. For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.Tenable Security Intel Brief: Espionage group exploits BeyondTrust zero-day
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: PHP is shipping emergency fixes today for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which public reports describe as remote code execution bugs. Cloudflare's CTO says the company is "seeing early attacks emerging." PHP isn't expected to fix end-of-life versions. Our FAQ has the details. This week, Mandiant reported a suspected China-nexus espionage group exploiting a zero-day in BeyondTrust Remote Support, a tool support teams use to connect to the machines they manage. The brief also covers an access broker running 51 Claude Code agents, attackers warming the fridges in hundreds of French supermarkets, and Citizen Lab tying Candiru spyware on Al Jazeera devices to targeted ads. Suspected Chinese hackers use BeyondTrust zero-day to reach endpoints → Brief: In late August, ARMORY CASTLE, a suspected China-nexus espionage group, exploited CVE-2026-102764 as a zero-day in BeyondTrust Remote Support, Mandiant found. Intel: The flaw lets an attacker with no login upload files to the appliance. BeyondTrust disclosed it October 15, after patching its cloud-hosted customers by October 9; self-hosted appliances need the patch, and those older than version 24.3.1 must upgrade first. CISA listed the flaw in its Known Exploited Vulnerabilities catalog on October 16. Once in, the attacker planted a hidden backdoor page and made itself root, the appliance's top-level account. It then tried several commands to pull passwords and keys from the appliance's built-in vault, and deleted logs to cover its tracks. Mandiant says patching does not undo an earlier compromise, and the attacker set up its root access to survive reboots. Why it matters: Mandiant says the flaw can lead to "access to every credential the appliance stores or brokers." In this attack, the attacker raised a compromised admin account's remote-access roles to Administrator. That unlocked remote sessions to every system on the appliance's list, and the attacker copied documents off a user's desktop with the tool's own file transfer. Open folder shows an access broker running 51 Claude Code agents → Brief: SOCRadar found CyberXero, a Russian-speaking broker who sells network access to other criminals, using 51 Claude Code agents and holding data on more than 628,000 Ukrainians. Intel: The actor left its working directory open on the internet, with AI session logs and stolen data inside. In one 61-second automated run, it scanned 4,708 targets and planted 32 web shells, hidden backdoor pages on servers. A separate, manual campaign mapped seven Ukrainian energy and utility companies, and a login saved in one of the actor's own scripts let it pull 564,073 subscriber records from a Kharkiv district heating company. Why it matters: When the model refused a task, the actor opened a fresh session with its fake "authorized pentest on my own infrastructure" story loaded, since, as SOCRadar notes, "a refusal in one session does not carry into the next." Some refusals still held, including requests to install a backdoor and turn off a firewall. Attackers warm the fridges in hundreds of French supermarkets → Brief: Overnight on October 11, attackers took over the refrigeration controllers in several hundred French supermarkets and warmed their fridges and freezers, with similar reports from five other European countries. Intel: France's CERT-FR reports many compromised Danfoss refrigeration controllers, plus units from Copeland, including its Dixell brand. CERT-FR's first fix is taking them off the internet. Researcher Kevin Beaumont said the Danfoss units carried a built-in login, username admin, whose password follows the current date and is the same on every unit; a 2025 Danfoss update removed it, but The Register reports many hit units no longer got updates and others ran outdated firmware. Pen Test Partners puts losses at tens of millions of euros and cites fires reported by the Paris prosecutor. Why it matters: These controllers can sit entirely outside the security team's view. Pen Test Partners says a cellular modem is the quicker way to give the refrigeration contractor remote access, so the controller ends up online, "on a link the retailer often does not own, cannot see, and has no record of." Targeted ads delivered Candiru spyware to Al Jazeera with zero clicks → Brief: Citizen Lab links, with high confidence, zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads bought by Discover-Tech. Intel: Discover-Tech, which calls itself an ad company, won ad slots through real-time bidding, the split-second auctions that decide which ad you see, and Citizen Lab found its ads fetched code from a Discover-Tech server that sent it only to chosen targets. Al Jazeera's network logs show the order on infected devices: a Discover-Tech ad, a Candiru server checking the device, then Candiru's command servers. Discover-Tech ads also showed on NATO and European Parliament networks, which Citizen Lab says does not by itself confirm targeting or infection. Why it matters: The NSA in 2018 and CISA in 2020 warned that malicious ads could deliver malware and recommended ad blockers. Here a targeted ad only had to load, and the auction that placed it can already hand the buyer the device's ad ID and IP address. Stat of the week: 37% The share of ransomware attacks that brought threats aimed at employees' friends or family members, according to Semperis, whose survey of 1,200 security and IT professionals at organizations hit by ransomware also found 41% of respondents reported facing physical or psychological intimidation. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Oracle October 2026 Critical Patch Update Addresses 1209 CVEs
On October 20, Oracle released its Critical Patch Update (CPU) for October 2026, the final quarterly update of 2026. This CPU contains fixes for 1209 unique CVEs in 1295 security updates across 33 Oracle product families. Out of the 1295 security updates published, 8.6% of patches were assigned a critical severity. Medium severity patches accounted for the bulk of security patches at 47.3%, followed by high severity patches at 36.7%. For more information about the October 2026 CPU release, including the availability of patches and Tenable product coverage, please visit our blog.Tenable Security Intel Brief: Attacker chains three Ivanti VPN zero-days
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Volexity reported an attacker chaining three Ivanti Connect Secure zero-days to gain root, one of which still has no fix. The brief also covers wire fraud charges against a ransomware recovery firm's owner, an FBI and Secret Service warning that FortiBleed, the Fortinet login campaign we covered in June, has fed ransomware affiliates, and PoeLLM, malware that takes its server address from a GitHub poem. An attacker reruns an Ivanti VPN zero-day chain for every command → Brief: Starting October 3, an unknown attacker Volexity tracks as UTA0576 chained three zero-days to run commands as root, with no login, on an Ivanti Connect Secure VPN appliance that was fully patched at the time. Intel: An authentication bypass and a code execution bug are tracked as CVE-2026-104935 and were fixed October 13. Volexity says the third flaw, a privilege escalation to root, has no fix yet. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13, with an October 16 deadline for U.S. federal civilian agencies. From the appliance, the attacker searched Active Directory for local administrator passwords and BitLocker recovery keys, which unlock encrypted drives, and sprayed passwords at domain accounts. Volexity assesses with high confidence this was groundwork for moving deeper into the network. Why it matters: Volexity found no backdoor, and the attacker reran the full chain for each command. The chain changed a code library only in memory and restored the configuration after each run, so Ivanti's Integrity Checker Tool, which checks files on disk, misses the changes, Volexity says. Its analysts rebuilt the chain from memory captures and core dumps the exploitation left behind. Recovery firm owner accused of secretly paying ransomware attackers → Brief: The Justice Department charged Zohar Pinhasi, owner of Florida ransomware recovery firm MonsterCloud, with wire fraud over claims he could decrypt clients' data without paying attackers. Intel: MonsterCloud's website warned clients against paying ransom, and Pinhasi pitched "proprietary tools" and "advanced decryption techniques." According to the indictment, he had no special decryption technology and paid the cybercriminals for a key, then typically billed clients far more than the ransom. In one August 2023 case, he allegedly paid about $8,200 and charged the client about $150,000. He faces two counts of wire fraud and one count of wire fraud conspiracy, and has pleaded not guilty. Why it matters: Prosecutors say the decryption key MonsterCloud employees used on clients' files came from the attackers, and that MonsterCloud paid them despite its own website's warning against paying. They put the alleged totals at more than $19 million charged to clients and more than $8 million paid in ransom. FBI ties FortiBleed firewall logins to ransomware affiliates → Brief: A joint FBI and U.S. Secret Service advisory says FortiBleed, a campaign stealing logins for Fortinet FortiGate firewalls, remains active and has fed access to ransomware affiliates. Intel: Initial findings indicate attackers keep scanning internet-facing FortiGates and remote-access VPN gateways with credentials they already hold, and crack passwords stored in an older, weaker format offline. Once in, they add their own admin accounts. The advisory warns that some victims may lose access to their firewalls if attackers delete the original accounts or change the passwords on them. Fortinet says no new vulnerability is involved and points to reused credentials and brute-force attempts on devices without MFA. Why it matters: FortiBleed's operators sorted stolen logins by each victim's revenue and network layout. In June we had no named buyer for the campaign's access. Now the agencies cite reporting that brokers using the campaign have passed further access to ransomware affiliates, among them INC/Lynx and Payload ransomware. PoeLLM malware reads a GitHub poem to find its next command server → Brief: Lumen's Black Lotus Labs found PoeLLM malware hijacking exposed self-hosted AI and developer tools to mine cryptocurrency, running on roughly 800 servers a day at its peak. Intel: The malware finds its command server through a two-stanza poem on GitHub: four words at set positions each map to a number, and together the numbers form an IP address. Since April 13, 2026, the operator has edited the poem 11 times. Each edit sent infected machines to a new server with no malware update. Lumen says most victims appear to run vulnerable, self-hosted AI services such as LiteLLM and Ollama. Why it matters: PoeLLM's scans went mainly after ports 3000 and 4000, where Gotenberg, a PDF converter, and LiteLLM listen. Gotenberg's install guide warns against putting it on the internet. Hijacked servers then joined the scanning and attacked other exposed services to find more victims. Stat of the week: 1,407 The number of CVEs Microsoft patched in its October 2026 Patch Tuesday release, more than the 1,245 it patched in all of 2020, its yearly record through 2025, according to our monthly Patch Tuesday blog. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
On October 13, Microsoft released its October 2026 Patch Tuesday release, which patched 1,407 CVEs with 69 rated critical, 1,337 rated as important, and one rated as low. For the second month in a row, this is the largest Patch Tuesday release ever. The previous record was September’s 964 CVEs. This update includes patches for two zero-days, both security feature bypass flaws. CVE-2026-96951 in Windows Shell was exploited in the wild, while CVE-2026-108398 in .NET Framework was publicly disclosed before a patch was available. This month’s update includes patches for 301 products and components. The products with the most CVEs patched this month are: Microsoft Office Excel (69) Role: DNS Server (52) Windows Kernel (46) Windows Installer (38) Windows Win32 Kernel Subsystem (36) Microsoft Office SharePoint (34) Microsoft Windows Search Component (29) Windows NTFS (26) .NET (25) Microsoft Office Word (22) SQL Server (22) Windows Error Reporting (22) For more information, including the full list of patched products, please visit our blog.Tenable Security Intel Brief: OpenAI model got into an Australian gov portal
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Citrix fixed another exploited NetScaler flaw, CVE-2026-88779, on October 3. This one is a denial-of-service bug that only affects appliances set up for SAML sign-in, and the September 27 builds don't cover it. Our FAQ has the details. This week, OpenAI says one of its internal models got non-public access to an Australian Medicare statistics reporting service in June, pulling internal files and credentials. The brief also covers Warlock ransomware's developers hitting a water utility and a telecom, JADEPUFFER's 7-minute Azure deletion run, and Cisco's fifth exploited SD-WAN zero-day of 2026, by BleepingComputer's count. Internal OpenAI model got into an Australian Medicare stats portal → Brief: OpenAI says an internal model gained non-public access to Services Australia's Medicare Statistics Reporting Service in June, pulling internal files and credentials and writing files. Intel: Australia's Prime Minister Anthony Albanese said the agent hit repeated blocks and "found a way around those blocks," though "no personal information is believed to have been accessed at this stage" and investigations are ongoing. The company found the activity in mid-August, along with activity at three more Australian agencies, including an exposed access key its agents used at the Victorian Department of Health. Albanese called the way it notified the government on September 10 "unacceptable": "an email sent to just the public mailbox." Why it matters: The assignment was research into per-person government spending on skin-condition medicines in Victorian communities. When that data proved hard to find, OpenAI says the model "took actions that we had not authorised it to take." Longlegs keeps using SharePoint flaws, now against water and telecom → Brief: Symantec says Longlegs, a China-nexus group that develops Warlock ransomware, attacked a water utility and a telecom provider in Portuguese- and Spanish-speaking countries over the past two months. Intel: The group is also tracked as Storm-2603. It usually gets in through on-premises SharePoint servers. The 2025 ToolShell flaws, including CVE-2025-53770, likely remain in its kit alongside newer SharePoint flaws CISA flagged in July 2026. At one critical infrastructure operator, the attackers sent a security-tool killer to at least 40 machines in about two hours. Warlock then reached at least 33 machines through SYSVOL. Windows copies that shared folder to every domain controller, and every computer on the domain can read it. Why it matters: Symantec reads the victims' locations as a sign of either deliberate tasking or opportunistic picks driven by which SharePoint servers were exposed and vulnerable. If it was the second, a water utility landed on the list for the same reason as a university Symantec also names. Both would have run one of those servers. JADEPUFFER deletes Azure storage in 7 minutes, then takes the keys → Brief: Microsoft documented JADEPUFFER, which it calls Storm-3168, using two hijacked service principals (accounts that software uses to act in Azure) to map and then delete one organization's cloud resources. Intel: In early June, one account read through the environment for about 15.5 hours; the other listed virtual machines in two subscriptions within five seconds. A 7-minute run tried 100+ storage account deletions and most succeeded. It also deleted an app, along with a hosting plan and Key Vault linked to that app. Sysdig, which found JADEPUFFER in July, assessed it to be "the first documented case of agentic ransomware," while Microsoft says the timing and split of work "strongly indicates automated or scripted execution." Why it matters: The account's attempts to delete SQL databases failed because each request used an unsupported version of Azure's interface. About half an hour later, it successfully requested access keys more than 30 times, including for storage accounts used for disaster recovery. The account did all of this with permissions it already had. Attackers break into Cisco SD-WAN Manager with one encoded character → Brief: Cisco fixed CVE-2026-76504, an actively exploited flaw that gives attackers admin access to Catalyst SD-WAN Manager, its console for network gear linking company sites, without logging in. Intel: The software mishandles encoded characters in web addresses, so a crafted request slips past a rule meant to restrict access. Cisco's warning signs show requests to the j_security_check address with one character encoded, such as %6a for "j," and Cisco says any single encoded character works. SD-WAN Manager is affected regardless of setup, though Cisco says its cloud-managed release is already fixed. There's no workaround. CISA added it to its list of exploited vulnerabilities September 30, with an October 3 federal deadline. Why it matters: By BleepingComputer's count, this is the fifth exploited Cisco SD-WAN zero-day of 2026, and watchTowr's Jake Knott tallies eight 2026 SD-WAN CVEs on CISA's exploited list this year, a wider count that includes three added in April. The February zero-day, CVE-2026-20127, had been exploited since at least 2023. Stat of the week: 543,699 The number of credentials found in 224 million public GitHub repositories that still worked when tested this July, including nearly 200,000 pushed after GitHub began blocking recognized secrets by default, according to Truffle Security. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: NetScaler zero-day warnings arrived before patches
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Citrix fixed two NetScaler zero-days on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Thanks to our Vulnerability Detection team for working through the weekend to get customers coverage for these flaws. The brief also covers ShinyHunters' FBI data claims, open-source AI agents breaking into online retailers, and a North Korean Terraform lure. Private NetScaler zero-day warnings arrived before Citrix's advisory → Brief: Citrix fixed two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Intel: On September 25, admins posted on Reddit that IT suppliers were telling them to take NetScalers offline, while the Netherlands' National Cyber Security Centre (NCSC-NL) reportedly circulated a private alert. Citrix confirmed exploitation on September 27, and CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog. Google says organizations in government, finance, education, and legal and professional services in North America and Europe were likely hit. On September 28, watchTowr released a proof-of-concept exploit for CVE-2026-88771 and Defused reported its mass exploitation. Why it matters: Mandiant found attackers moving from compromised appliances into some victims' internal networks. CISA warns updates "may result in loss of forensic visibility," and NCSC-NL's public alert wants memory and logs secured first. Where attackers got into appliances before the fix, the upgrade may wipe the evidence of their activity. Reuters finds FBI intelligence roles in data ShinyHunters says it took → Brief: Reuters verified details for more than 22 people in a 5,000-line spreadsheet ShinyHunters says it stole from the FBI, and found the file lists staff in China-related and human intelligence (HUMINT) roles. Intel: ShinyHunters claims it broke into FBIjobs.gov through Oracle PeopleSoft, then moved to FBI servers hosted in AWS GovCloud and took 2 TB to 3 TB. It told BleepingComputer it used a trick Mandiant documented for getting past firewall rules that block CVE-2026-35273, a PeopleSoft flaw patched in June, though it still claims a new zero-day as well. The FBI says "the point of breach is still undetermined," but a Justice Department notice to lawmakers says the affected system holds Social Security numbers. Why it matters: In May, the FBI warned that ShinyHunters "may falsely claim" to hold sensitive data. ShinyHunters says it hit the FBI to answer that, and did it for "future corporate partners," which The Register reads as extortion victims. ShinyHunters is playing to the next company deciding whether the group is bluffing. Card thieves use open-source AI agents to break into online shops → Brief: Gambit Security recovered a financially motivated attacker's staging server and found three AI tools running nearly every step of break-ins at online retailers since July 2026. Intel: Strix, an open-source tool for AI penetration testing, hunted for flaws, and Cairn attacked targets for hours chasing a goal such as remote control of a server or admin access. Hermes, an open-source AI agent, ran the campaign on 1,951 short Chinese prompts over 260 sessions, such as "get into the web backend." September 10 to 15 alone saw 105 attack projects and at least 27 companies "compromised to varying degrees," per Gambit. Two companies lost over 600,000 unexpired card details. Why it matters: The attacker's own cost review averages $25.46 per completed scan, and Gambit's verdict is that "the economics no longer filters anyone out." That price also buys damage: at one bicycle retailer, the agent's cleanup deleted 180 database tables, including backup copies the shop's IT staff had created. North Korean hackers hide a backdoor route in a Terraform lock file → Brief: SentinelOne found macOS backdoors from TraderTraitor, a North Korean state-sponsored group, on a DevOps engineer's MacBook at an India-based IT services provider with no cryptocurrency ties. Intel: The group, also tracked as UNC4899, PUKCHONG and Jade Sleet, sends job seekers fake interview projects on GitHub. The repos carry a tampered .terraform.lock.hcl, the file that records which plugin versions Terraform (a tool companies use to set up cloud infrastructure from code) installs. It points to lookalike domains like registry.hashicorp-aws[.]com, and when the developer runs the project's setup command, Terraform fetches and runs the attackers' code. The backdoors also appeared in the $292 million KelpDAO theft; how they reached this laptop is unknown. Why it matters: A lock file lets Terraform reject a download that doesn't match what was recorded. In these interview repos, the attacker wrote the lock file. The check that worked was human. One candidate removed the lookalike plugin and left a note, possibly taking it for a security test. Stat of the week: 1,073 The number of ransomware attacks in August, the highest monthly total of 2026 so far and up 12% from July, with Qilin taking the top spot from The Gentlemen, according to NCC Group. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.FAQ about CVE-2026-88771 and CVE-2026-88772: Citrix NetScaler Zero-Day RCE vulnerabilities
On September 27, Citrix published a security bulletin for two NetScaler ADC and NetScaler Gateway vulnerabilities that were exploited against unpatched customer deployments. CVE Description CVSSv4 CVE-2026-88771 Citrix NetScaler ADC and NetScaler Gateway Improper Input Validation vulnerability 9.5 CVE-2026-88772 Citrix NetScaler ADC and NetScaler Gateway Memory Overflow vulnerability 9.5 CVE-2026-88771 affects all deployments with no additional configuration required. CVE-2026-88772 requires DTLS to be enabled, which is the default on VPN virtual servers. Both have been classified as Vulnerabilities of Interest as part of Tenable's Vulnerability Watch. For more information about these vulnerabilities, including patch versions, IoC guidance, and Tenable product coverage, please visit our blog.
CVE-2025-31324: Vulnerability in SAP NetWeaver Exploited in the Wild
CVE-2025-31324, a zero day vulnerability in SAP NetWeaver, has been generating a good deal of chatter in recent days. Media outlets report that it is being targeted by multiple ransomware groups and Chinese Advanced Persistent Threat (APT) groups. The unauthenticated file upload vulnerability affects the Metadata Uploader component of SAP NetWeaver Visual Composer. Successful exploitation of this vulnerability could allow an unauthenticated attacker to upload malicious files which can be used by an attacker to achieve code execution. SAP has released patches to address CVE-2025-31324. On April 25, Tenable Research Response Team published a blog post about the vulnerability and provided guidance on how to identify affected systems using Tenable plugins. The blog post can be found here: https://www.tenable.com/blog/cve-2025-31324-zero-day-vulnerability-in-sap-netweaver-exploited-in-the-wild Media outlets reporting on CVE-2025-31324 include Bleeping Computer, CyberScoop and Dark Reading. On May 13, as part of the SAP Security Patch Day, SAP released a patch for CVE-2025-42999, a deserialization vulnerability affecting SAP NetWeaver. Onapsis identified and reported this flaw to SAP and noted this was an additional vector for exploitation that the April patch did not address. To ensure full remediation from these vulnerabilities, it’s imperative that both the April and May patches are applied to SAP NetWeaver hosts. If you have questions or concerns about this vulnerability, please submit a comment below or contact your Tenable sales representative.Tenable Security Intel Brief: Cisco firewall consoles under attack
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Cisco Talos tied a state-linked APT, a ransomware operator, and a credential thief to exploitation of Cisco's firewall management console. The brief also covers federal cyber teams boarding two energy tankers in the Gulf of Mexico, a follow-up on the Gitea flaw from our September 2 edition with 11 confirmed victims, and three nations jointly exposing an Iranian spyware campaign running on Telegram bots. Ransomware and state-linked hackers break into Cisco firewall consoles → Brief: Cisco Talos tied three threat clusters, including an advanced persistent threat (APT) actor and a ransomware operator, to exploitation of two flaws in Cisco Secure Firewall Management Center (FMC), the console that centrally manages Cisco firewalls. Intel: CVE-2026-20079, a CVSSv3 10.0 authentication bypass, lets an unauthenticated remote attacker gain root access, and CVE-2026-20316 is a static credential on a low-privileged account. UAT-11823, an APT actor whose tooling overlaps with Sandworm's, harvested configurations of the devices FMC manages and deployed a Cyclops Blink variant. UAT-11988 logged in with that credential and later deployed Qilin ransomware, while UAT-12197 stole stored credentials. Cisco says its hot fixes stop new exploitation but do not clean devices already compromised. Why it matters: State-linked and criminal intruders both went after these consoles, which hold privileged access to the firewalls they manage. The 2022 version of Cyclops Blink targeted WatchGuard devices; the variant found on these consoles runs on generic Linux, so Sophos says compatible SD-WAN controllers and VPN concentrators are plausible targets too. Federal cyber teams board energy tankers to hunt intrusions at sea → Brief: Joint USCG and FBI teams boarded two energy tankers in the Gulf of Mexico in August following what officials called indications that the vessels' networks were "compromised by foreign cyber actors." Intel: USCG Cyber Protection Team members and FBI Cyber Action Team operators spent four days aboard the tanker VL Prosperity; a second tanker was boarded August 24. Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, confirmed to CBS News that investigators found malicious activity. Her central concern: the ship's IT systems linked to the systems that control propulsion and navigation. The U.S. has not named a country; Iran's Mehr News Agency reported the attack, citing an unnamed crew member, and former Coast Guard official Quinton DuBose cautioned that the Iranian narrative remains unverified. Why it matters: Boarding VL Prosperity was one of roughly 40 to 50 Coast Guard Cyber Protection Team missions in the past year. For nearly 20 ships, cyber threats now affect port entry: citing U.S. officials, Bloomberg reports agencies are tracking them, and the Coast Guard has asked for advance notice before any enters a U.S. port. Red Heron breached 11 organizations through a Gitea flaw → Brief: Acronis Threat Research Unit (TRU) linked 11 confirmed breaches to Red Heron, a Chinese-speaking operator assessed with moderate confidence to be PRC-linked, who began turning public exploit code for CVE-2026-60004 into attack tools two days after its patch shipped. Intel: We covered CVE-2026-60004 in our September 2 edition after CISA added it to the Known Exploited Vulnerabilities catalog; Acronis has since traced confirmed victims to Red Heron, who by July 30 had scanned 1,386 internet-facing Gitea instances, identified 128 that let anyone sign up, and selected targets in sectors including defense, elections, energy, and government. Red Heron's staging server also held the JITTERLY implant, which carries SIXZUT, a previously undocumented rootkit that hides the intruder's files and brings the implant back if it is shut down. Why it matters: Red Heron had scanned 1,386 Gitea instances across seven countries within three days of the fix shipping. A month after that fix, 8,393 servers remained vulnerable per Shadowserver. Patch schedules built for a scanning window of weeks are now racing one measured in days. Three nations expose Iranian spyware run through Telegram bots → Brief: A joint advisory from the UK National Cyber Security Centre (NCSC), the FBI, and the Netherlands' General Intelligence and Security Service (AIVD) exposes CHOSEN BRICK, Iranian state malware targeting dissidents, activists, and journalists in at least three countries. Intel: Published September 15, 2026, the advisory attributes CHOSEN BRICK, used from at least 2025, to "Iranian state cyber actors." Lures include fake app installers like Pictory and KeePass, and a fake MRI scan. CHOSEN BRICK harvests contacts, emails, and screen captures, exfiltrating through Telegram and cloud storage. Each victim is assigned their own dedicated Telegram bot, isolating compromised devices from one another. The FBI issued a separate alert naming the malware HEAVYGRAM and attributing it to Iran's Ministry of Intelligence and Security (MOIS), an assessment the joint advisory does not make. Why it matters: The malware's command-and-control runs through Telegram, which the advisory says helps it blend in with legitimate processes. Giving each victim a dedicated bot means uncovering one infection does not expose the others. Stat of the week: 1 million+ The number of emails detected in a single financial fraud campaign between August 3 and 5, with templates showing indicators consistent with generative AI use, according to Microsoft. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.