ControlPlane (28 September 2026), with the OpenBao community, describes a full exploit chain from unauthenticated access to remote code execution in OpenBao (and notes the same class of issues affect HashiCorp Vault / IBM remediation still pending at publication). The chain combines multiple independently reported issues patched in OpenBao v2.6.3 and v2.7.0 (shipped 23 Sep 2026), including GHSA-j6wc-jpvg-xfxq — Critical CVSSv4 9.4 remote code execution via Raft snapshot restore / plugin-catalog replacement (Raft storage backend; privileged snapshot endpoints; original to HashiCorp Vault) — plus High issues GHSA-x8fg-h69x-p28f (PKI ACME validation bypass, 8.2), GHSA-mjch-vcw3-hhmf (cross-namespace policy access, 7.7), and GHSA-fg5x-7whg-6c28 (ACL deny bypass via non-canonical URLs, 7.6). ControlPlane: second-ever remote code execution vulnerability class in Vault/OpenBao; fork-coordination gaps can leave customers exposed. Operators not using Raft storage are not affected by the snapshot RCE path per GHSA-j6wc. Cyberstack does not reproduce the chain. (sources: OpenBao GHSA-j6wc-jpvg-xfxq; ControlPlane)
WatchGuard PSIRT (published 28 September 2026) discloses three flaws in WatchGuard access-point firmware. CVE-2026-86102 (CVSS v4 9.3) — OS command injection in the internal management API: unauthenticated attacker with network reach to the AP can run arbitrary shell commands. CVE-2026-101891 (CVSS v4 9.3) — improper access control on an internal API service allowing unauthenticated access to protected functionality. CVE-2026-87969 (CVSS v4 8.6) — authenticated administrator command injection via the diagnostic CLI. Affected: WatchGuard AP 1.0 through 3.4.7. Fixed: 3.4.8. Vendor/CSN: no public evidence of active exploitation at disclosure. (source: WatchGuard PSIRT advisory list)
GitHub advisory GHSA-qx49-fqc8-xw99 (published 28 September 2026; Cycode write-up same day) covers the official Model Context Protocol Python SDK (PyPI package mcp): in affected versions the OAuth client support (mcp.client.auth) let the MCP server decide where the client’s OAuth credentials were sent — authorization-server metadata issuer was not validated on every discovery path, and stored/pre-provisioned client credentials were not bound to their authorization server. A malicious or compromised MCP server could therefore receive the client_secret, authorization code and PKCE code_verifier (or a signed client assertion under PrivateKeyJWTOAuthProvider) meant for the real login service. Affected: 1.9.1 through 1.29.1 (no issuer check / binding on any path); 2.0.0 through 2.1.1 (missing on legacy metadata fallback and 403 insufficient_scope paths); on both lines ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider had no way to name their issuer. Not affected: MCP servers built with the SDK, stdio clients, clients that attach their own tokens/headers. GHSA rates High 7.5 for unattended providers; interactive OAuthClientProvider scored 6.5 (UI:R). No CVE ID assigned on the advisory as of 29 Sep 2026. No in-the-wild exploitation stated. (sources: GitHub GHSA-qx49-fqc8-xw99; Cycode) Correction (02 Nov 2026): removed The Hacker News as a source. (source: GitHub advisory; Cycode)
Apple security content for iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (published 28 September 2026) patches CVE-2026-86950 in CoreGraphics: an out-of-bounds write addressed with improved bounds checking. Impact: processing a maliciously crafted file may lead to arbitrary code execution. Apple states it is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27 — no public detail on volume, success, or first-seen date. Credited to Meta Product Security. No Apple-published CVSS on the HT pages. Distinct from earlier February 2026 dyld CVE-2026-20700 (also noted as weaponised in sophisticated attacks). (source: Apple HT149226) UPDATE 1 Oct 2026 (added 16:00 Perth): Calif research “The Great Glyph Grift” (Dion Blazakis, Josh Maine, Anna Groza; 30 Sep) publishes patch-diff analysis and a public crash-trigger sample (TrueType/PDF via ImageIO thumbnail path) showing a controlled out-of-bounds write from glyph fixed-point conversion — crash demonstrated on macOS/iOS; authors state turning that into reliable code execution is separate work and they did not obtain the in-the-wild sample. Calif also notes WhatsApp Kaleidoscope (versions 26.37.73→26.38.74) added stricter PDF embedded-font checks, hinting a possible messaging attachment delivery path consistent with Meta Product Security credit — not confirmed as the in-the-wild vector. CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog on 29 Sep (due 2 Oct 2026). UPDATE 2 Oct 2026 (added 19:00 Perth): WA SOC advisory 20261002001 (TLP:CLEAR) restates CVE-2026-86950 as an out-of-bounds write in CoreGraphics on Apple iOS/iPadOS 26.x prior to 26.7.1 and macOS 15.x prior to 15.8.1 / 26.x prior to 26.7.1, scores CVSS 8.8 High, notes CISA KEV listing, states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing, and recommends Apple HT149226 / HT149228 / HT149229 within expected patch timeframes. UPDATE (26 Oct 2026; Apple): Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation, and its security notes list the CoreGraphics fix for CVE-2026-86950 (credited to Meta Product Security) with the same statement that Apple is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. (source: Apple)
Apple — About the security content of iOS 26.7.1 and iPadOS 26.7.1 (28 Sep 2026)
Citrix Security Bulletin CTX697096 (27 September 2026) confirms exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler ADC/Gateway. CVE-2026-88771 (CVSS 4.0 9.5) — improper input validation enabling unauthenticated arbitrary command execution on all ADC/Gateway deployments including default configuration (CWE-20). CVE-2026-88772 (CVSS 4.0 9.5) — memory overflow RCE/DoS when DTLS is enabled (default on VPN vServer; CWE-119). Bulletin also ships CVE-2026-88773–88778 (smuggling / policy bypass / memory overflow / TCP ISN). Affected: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; FIPS/NDcPP trains as in bulletin; SPA Hybrid NetScaler instances likewise. Customer-managed only. UPDATE 27–28 Sep 2026: CISA Alert (27 Sep) and CISA KEV (dateAdded 2026-09-27) list CVE-2026-88771 and CVE-2026-88772 with FCEB due 30 Sep 2026 and forensic-triage required under BOD 26-04 — preserve evidence before patching (updates can erase forensic visibility); use NetScaler Console IoC checks as supporting telemetry. UPDATE 28 Sep 2026: ASD’s ACSC Critical alert (first published / last updated 28 Sep 2026) covers the eight CVEs, states at least CVE-2026-88771 and CVE-2026-88772 were under active exploitation globally before a patch was available, and notes ACSC has not yet received reports of confirmed exploitation in Australia. UPDATE 29 Sep 2026: WA SOC advisory 20260929001 (TLP:CLEAR) restates Citrix NetScaler ADC/Gateway/FIPS CVEs including CVE-2026-88771/88772 (CVSS 9.5) through CVE-2026-88778, notes CISA KEV listing, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. (sources: Citrix CTX697096; ASD’s ACSC) UPDATE 29 Sep 2026 — BleepingComputer citing Mandiant and GreyNoise post-exploitation: attackers exploited the zero-day window (Mandiant: began at least early September; NA/EU victims across government, financials, education, legal, professional services) to deploy custom web shells and tunneling malware, gain root, steal credentials and move internally. GreyNoise observed 149.104.78.141 attempting exploitation on 24 Sep (pre-disclosure): setuid/setgid on /bin/sh, password-protected PHP webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, httpd aliases mapping receiver.min.css / receiver.min.[hex].css to the hidden PHP handler; webshell SHA-256 published in GreyNoise “Swarming Against Citrix 0-Day Exploitation”. Mandiant CTO (LinkedIn via Cybersecurity Dive): hunt compromise before/while patching — webshells can survive upgrade/HA sync. Hunt IoCs on both HA nodes; preserve evidence per CISA BOD 26-04. UPDATE 29–30 Sep 2026: watchTowr (29 Sep) published a technical analysis of CVE-2026-88772 as a DTLS handshake-reassembly / scratch-buffer memory overflow on NetScaler Packet Processing Engine paths; reiterates DTLS is enabled by default on VPN virtual servers unless administrators set -dtls OFF. Same write-up restates Citrix guidance that CVE-2026-88778 (predictable TCP ISN) is addressed by enabling Enhanced ISN Generation — not by the firmware upgrade alone. Cyberstack does not reproduce exploit construction; use vendor bulletin + watchTowr for defender context. UPDATE 30 Sep 2026: Mandiant/Google TI (via BleepingComputer 29 Sep and The Register 29 Sep) name the post-exploit toolkit as WHIPSHOT (PHP web shell disguised as a Debian package in the NetScaler VPN scripts directory; HTTP transport bridge hiding Base64 C2 in native HTTP headers) and SLAPSHOT (Python TCP tunneling tool that accepts WHIPSHOT commands and forwards arbitrary TCP streams to internal hosts — used in at least one intrusion for manual recon and credential theft). Sector impact restated: government, financial services, education, legal and professional services in North America and Europe. Mandiant CTO: examine for compromise before/while patching — patching alone may not eradicate the actor. UPDATE 30 Sep 2026 (added 1 Oct 10:00 Perth): ASD’s ACSC Critical alert (first published 28 Sep; last updated 30 Sep 2026) now states that since the 28 Sep publication it has received reports from Australian organisations confirming exploitation. ACSC recommends reviewing for evidence of compromise since at least 4 September 2026; Citrix IoCs via NetScaler Console and Security Bulletin for CVE-2026-88771 through CVE-2026-88778. Lead paragraph supersedes the still-present Background sentence that said ACSC had not yet received AU confirmation. UPDATE 3 Oct 2026: ACSC Critical alert last updated 3 October 2026 adds a newly identified NetScaler SAML authentication issue (crashes/DoS/potential exploitation; AU organisations impacted) that ACSC says is separate from CVE-2026-88771/88772 — /n/citrix-netscaler-saml-acsc-20261003. CVE-2026-88771/88772 patch/hunt guidance unchanged (hunt since ≥4 Sep; IoCs via NetScaler Console). UPDATE 13 Oct 2026 (added 19:00 Perth): Binary Defense (blog 'Platypwned', published 12 Oct US time) describes an incident-response case on two NetScaler appliances that a triage collection flagged while the customer was upgrading. One showed exploitation but no dropped files; on the other, attackers who had abused CVE-2026-88771/88772 delivered a private, modified fork of the open-source Go remote-admin tool Platypus, compiled for FreeBSD and disguised as a Perl file (one sample named .ns_09343.pl, actually an ELF binary). It was installed with a one-shot curl | sh script carrying a single-use enrolment token, which Binary Defense found in ns.log; paths included /var/tmp/, /netscaler.local/ and a .ns-cache folder under /var/core/. Binary Defense believes registration with the attacker's server failed on that appliance. The fork adds privilege-escalation, persistence disguised as a health monitor, and anti-forensic timestamp/cleanup modules that are not in the public project; agents were built on 28 Sep 2026 and the C2 ingress certificate issued the same evening. C2/staging domain: entretiensol[.]com (agent path /v1/artifacts/<os>/<arch>/latest); related infrastructure named: white-guard[.]pro, gurerasfalt[.]com, garyvard[.]com, hickoryusedauto[.]com. SHA-256 hashes are in the Binary Defense post. eSentire separately reported Platypus enrolment against three customers on 28 Sep from the same C2. Cyber Security News report 13 Oct. No new Citrix or ACSC guidance; patch builds unchanged. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Citrix)
CI-ISAC Australia has published an advisory (GCVE-123-2026-0001, coordinated disclosure 25 September 2026) for Best Practice Software's Bp Premier, the clinical and practice-management system used by Australian general practices. Affected versions use a hardcoded Microsoft SQL Server administrative password that is the same on every installation and, in those versions, could not be changed without breaking the application. Anyone who can reach the practice's Bp Premier SQL Server instance over the network can log in with it, bypass the application's own authentication, gain sysadmin rights over the database (patient records included) and run operating-system commands, typically as SYSTEM. CI-ISAC rates it CVSS 3.1 9.6 (adjacent-network vector) and notes exploitability depends entirely on how exposed the database listener is. CI-ISAC lists Bp Premier 1.12.1.1023, 1.12.3.1042, 1.13.1.1080, 1.13.1.1096 and 1.14.0.1114 as affected and 1.14.1.1129 (Oxford SP1) as fixed. Best Practice Software's Oxford SP1 release notes (released 4 September 2026) describe a 'Security Update: Best Practice Database Connector' — a new Windows service that gives every practice a unique database access password stored within the practice environment — plus a Database Password Access Manager that controls which workstations may retrieve database credentials; the vendor says sites already on 1.14.1.1128 do not need 1.14.1.1129, and warns that medical devices such as ECG, spirometry and blood-pressure integrations may need reconnecting after the update. The flaw was reported to CI-ISAC by an anonymous researcher on 26 May 2026 and independently verified by CI-ISAC's Andrew Tunnecliffe in June. A CVE identifier, CVE-2026-114119, was added to the CVE list on 21 October 2026. No exploitation has been reported. (source: CI-ISAC Australia advisory GCVE-123-2026-0001)
CI-ISAC Australia — GCVE-123-2026-0001: Bp Premier ships a hardcoded, shared SQL Server administrative credential (25 Sep 2026)
wolfSSL release 5.9.4 (25 September 2026) ships eleven security fixes. Highest-profile High issues include CVE-2026-89102 (client RFC 6961 multiple-OCSP stapling path can enable certificate forgery when HAVE_CERTIFICATE_STATUS_REQUEST_V2 / wolfSSL_UseOCSPStaplingV2 is used; 5.7.2–5.9.2), CVE-2026-89136 (TLS/DTLS client accepts unsolicited server_cert_type=RawPublicKey and may bypass authentication — RPK off by default; needs --enable-rpk / --enable-all / --enable-distro; 5.6.0–5.9.2), CVE-2026-93302 (MatchTrustedPeer / WOLFSSL_TRUST_PEER_CERT forged CA clones), and CVE-2026-11310 (OpenSSL-compat X.509 trust-chain bypass under --enable-opensslextra). Also Medium name-constraint / CertManager issues (CVE-2026-89133/89134/89135, CVE-2026-93304) and Low DoS/UAF/revocation/session-cache items (CVE-2026-15442, 94417–94419). No Critical in this 5.9.4 set on the vendor page. No in-the-wild exploitation stated. (sources: wolfSSL security vulnerabilities page; GitHub wolfSSL 5.9.4)
wolfSSL — Security Vulnerabilities (fixes in 5.9.4)
Patchstack (Dave Jong, published 25 September 2026; reporter Saggre via Patchstack 22 Sep) details an unauthenticated cross-site request forgery in Elementor Website Builder 4.3.0 and 4.3.1 only. The Editor Events module checked the raw request URI for the elementor/v1/events/ path and skipped WordPress REST nonce validation when present, so attacker-controlled query parameters could append that path to other REST endpoints. A logged-in administrator opening a single link (email/chat/comment — no JavaScript or attacker page required) performs any REST action their role allows; on default installs that includes creating a new administrator. ~2 million sites on 4.3.0/4.3.1 per WordPress.org stats cited by BleepingComputer (25 Sep). Releases before 4.3.0 lack the Editor Events proxy (not this bug). Fixed in Elementor 4.3.2 (24 Sep) by validating the resolved REST route. No CVE ID assigned as of the Patchstack/BleepingComputer reports. (sources: Patchstack; BleepingComputer)
Oracle released a Security Alert for CVE-2026-35273 on 10 June 2026, according to Google. Oracle's CVE record describes an easily exploitable flaw in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools that lets an unauthenticated attacker with network access via HTTP take over PeopleTools, on supported versions 8.61 and 8.62, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CISA's enrichment of the record shows it was added to the KEV catalog on 12 June 2026. UPDATE 25–26 Sep 2026: Mandiant / Google Threat Intelligence Group report renewed UNC6240 (ShinyHunters) mass exploitation: actors bypass literal WAF path blocks by requesting /%50SEMHUB/ (percent-encoded P) so proxies miss /PSEMHUB/ while WebLogic still routes to the vulnerable servlet; web shells (x.jsp / u.jsp and variants) and fileless command execution observed on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation, and government. On Windows hosts, trojanized Ple64.exe (masquerading as signed Light Alloy media-player installer; EV cert later revoked) loads in-memory SIDEEYE C++ backdoor (C2 162.219.30.165 TCP/3333–3334); MeshCentral agents also used for persistence. June campaign hit education as a zero-day (27 May–9 June); this wave targets orgs that WAF-mitigated but did not patch or disable EMHub. Cybernews (26 Sep) cites Google notifying 100+ organisations. (sources: Google Cloud; Google Cloud / Mandiant GTIG; Oracle CVE record; Cybernews) Correction (27 Oct 2026): Oracle's Security Alert returns 403 to Cyberstack, so the affected versions, score and description are now credited to Oracle's CVE record and the alert date to Google; a label that no readable source gives was removed. (source: CVE.org; Google Cloud) UPDATE (28 Oct 2026, Perth; Zero Day Initiative): In a write-up dated 27 October, Bobby Gould of TrendAI's Zero Day Initiative says ZDI first reported this CVE to Oracle on 10 June 2026 and that, although Oracle issued a patch under a single CVE, ZDI reported three distinct vulnerabilities across multiple PeopleSoft components; ZDI says it is coordinating with Oracle to assign separate CVEs for each issue. According to the write-up, the chain starts with a server-side request forgery in the PeopleSoft Integration Gateway (PSIGW) that lets attackers make requests satisfying the validateClient check of the PeopleSoft Environment Management Hub (PSEMHUB) and reach endpoints vulnerable to remote code execution. (source: Zero Day Initiative)
Google Cloud / Mandiant GTIG — ShinyHunters renewed PeopleSoft mass exploitation (25 Sep 2026)
Researcher Faav (blog.faav.net, published 25 September 2026) details an authentication flaw in Microsoft’s internal Titan analytics API: the service checked JWT claims (tenant, audience, app ID, user) but never verified the token signature, so a forged token with upn set to admin enabled administrator-level SQL without real credentials. Controlled testing reached 30 live routing targets → 17 ClickHouse analytics databases (~9,863 table names) with metadata totaling an estimated 17.3 trillion stored rows (Bing search analytics among them); Faav states only metadata and bounded one-row samples were accessed and no customer PII was taken. Reported to MSRC (case 144051); MSRC asked testing to stop 6–8 Sep and locked the API endpoint on 9 September 2026. Microsoft statement in the write-up: coordinated disclosure helped harden services under the Bug Bounty program. Impact described as hypothetical for a malicious actor; no public CVE assigned in the write-up. (sources: Faav blog; Cyber Security News)
Faav — How I Could’ve Accessed 17 Trillion Microsoft Records (25 Sep 2026)
BleepingComputer (25 September 2026) reports ShinyHunters compromised and defaced the Clop ransomware data-leak site by exploiting an unauthenticated path-traversal / arbitrary file-write flaw in Grav CMS core FormFlash. Grav told BleepingComputer that the vulnerability and exploitation details shared with it were accurate and tracks the issue as CVE-2026-42608 (GHSA-hmcx-ch82-3fv2; advisory 27 Apr 2026): unauthenticated manipulation of form identifiers (e.g. __unique_form_id__ / __form-flash-id) lets attackers traverse out of tmp/forms and write under the Grav install. Fixed in Grav 2.0.0-beta.2 earlier; the 1.7 line lacked the backport until Grav released 1.7.53.4 after BC shared exploitation details (BC: “yesterday” relative to 25 Sep). Bug is in Grav core, not the Form plugin. CVE.report / GitHub CNA: CVSS 4.0 8.8 HIGH (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/…). (sources: Grav GHSA and 1.7.53.4 release; BleepingComputer; CVE.report) Correction (26 Oct 2026): removed statements made only by the Clop and ShinyHunters gangs (the Grav version on Clop's server, the move to a new Tor address, what was or was not stolen, and contact between the groups); this Cyberstack does not publish gang statements. Grav's confirmation to BleepingComputer that the exploitation details were accurate is kept. (source: BleepingComputer)
BleepingComputer — ShinyHunters hacked Clop leak site via Grav path traversal (25 Sep 2026)
Patchstack (public 25 September 2026; reported by Saggre 22 Sep; fixed 24 Sep) documents CVE-2026-62062 in Elementor Website Builder 4.3.0 and 4.3.1 only: the Editor Events module disabled WordPress REST CSRF/nonce protection whenever the literal string elementor/v1/events/ appeared anywhere in the raw request URI (including attacker-controlled query string). A one-click link opened by a logged-in administrator can force any REST action that account may perform — on a stock install, creation of an attacker-controlled administrator. No JavaScript or attacker-hosted form required. Patchstack CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); ~2M sites on the two affected versions per WordPress.org stats cited by Patchstack/BleepingComputer. Fix 4.3.2 checks resolved rest_route instead of raw URI. (sources: Patchstack advisory; Patchstack database; BleepingComputer)
