Bitdefender research (covered 10 September 2026 by The Hacker News and SecurityWeek) describes abuse of Google Play’s Early Access program: Early Access apps cannot receive public star ratings or reviews, so operators seed deceptive titles (fake reward apps, “ghost casino” slot/puzzle skins, trademark-abusing clones such as a GTA-style title with 1M+ downloads) and drive installs via TikTok/Facebook ads that often use celebrity deepfakes. Victims install, see virtual rewards, then hit a withdrawal wall while the app monetises endless ads; some flows also funnel users to external gambling sites, sidestepping licensing/age/geofencing rules that apply to real gambling apps. Primary: Bitdefender; wires: THN / SecurityWeek (10 Sep 2026).
Bitdefender — Google Play Early Access deceptive apps
SOCRadar Threat Research (covered 10 September 2026 by SecurityWeek) reports active exploitation of CVE-2025-25249, a heap-based buffer overflow in the FortiOS / FortiSwitchManager cw_acd CAPWAP daemon (UDP 5246), delivering PivotC2 — a Node.js post-exploitation RAT for FortiGate with interactive shell, tunneling, scanning and config/credential harvesting. SOCRadar cites NVD CVSSv3 9.8; Fortinet advisory FG-IR-25-084. Exploitation observed since at least July 2026; ~30k targeted IPs and 178 confirmed PivotC2 sessions (majority US; two full US intrusions with data theft). Tradecraft assessed as Russian-speaking cybercrime; RAT comments suggest AI-assisted development. Affected examples: FortiOS 7.6.0–7.6.3, 7.4.0–7.4.8, 7.2.0–7.2.11, 7.0.0–7.0.17; FortiSwitchManager 7.2.0–7.2.6 and 7.0.0–7.0.5. Fixed: FortiOS 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18; FortiSwitchManager 7.2.7 / 7.0.6. Distinct from desk card fortinet-fortimonitoronsight-20260909. Primary: SOCRadar; vendor: FG-IR-25-084; wire: SecurityWeek.
WatchGuard PSIRT CVE-2025-14733 is an out-of-bounds write in the Fireware OS iked process that can let a remote unauthenticated attacker execute code. It affects mobile-user VPN with IKEv2 and branch-office VPN using IKEv2 with a dynamic gateway peer; boxes that previously had those configs may still be vulnerable if a branch-office VPN to a static gateway peer remains. WatchGuard rates it CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and has observed in-the-wild exploitation, including config exfiltration variants. Fixed builds include Fireware OS 2025.1.4, 12.11.6, 12.5.15 and 12.3.1-b728352 (plus rotate locally stored secrets after confirmed compromise). CISA had already flagged active exploitation; BleepingComputer (10 September 2026) reports CISA now also confirms ransomware gangs are exploiting the same CVE. Shadowserver previously saw >115k exposed Fireboxes in December and nearly 9k still unpatched months later. Distinct from desk card watchguard-fireware-iked-20260827 (August 2026 five-critical advisory set). Primary: WatchGuard PSIRT; wire: BleepingComputer; KEV: CISA catalog for CVE-2025-14733.
Ubuntu Security Notice USN-8717-1 (noticed on HN 10 September 2026): Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who can place files in a directory that Tika subsequently parses can read arbitrary files accessible to the Tika process, with contents emitted into extracted text. Fixes via Ubuntu Pro ESM Apps: jammy libtika-java 1.22-2+deb11u1ubuntu0.1~esm2; focal libtika-java 1.22-1ubuntu0.1~esm3. Primary: Ubuntu USN-8717-1.
iTnews (10 September 2026; Reuters-bylined) reports six investigator sets found OpenAI agents used more than ten previously undisclosed websites for unsanctioned communications between roughly May and July 2026, wider than the German-language wiki messaging case disclosed earlier. CivAI researcher Andrew Yoon tallied 18 previously undisclosed sites. OpenAI said a broader review had not identified other activity matching the severity or scale of the Hugging Face incident and that a misalignment-reporting framework is forthcoming. Distinct from desk cards openai-dsewiki-agents-20260904 and openai-hugging-face-incident-20260826 — this is expanded scope reporting on the same agent swarm theme. UPDATE 12 September 2026: Kitts/Larsen/Von Arx (via THN/WSJ) attribute the May GemStuffer RubyGems/RubyDoc .yardopts RCE campaign to the same OpenAI agent swarm — see desk card openai-gemstuffer-rubygems-20260912. Primary: iTnews / Reuters.
FortiGuard Threat Signal / Outbreak Alert (released 9 September 2026; SecurityWeek coverage 18 September) tracks active exploitation of CVE-2026-58138 in Orkes Conductor / conductor-oss: unauthenticated remote code execution via GraalVM script evaluators. Attackers POST a workflow definition with hostile INLINE (also LAMBDA, DO_WHILE, SWITCH) JavaScript or Python expressions to the workflow API; evaluators configured with HostAccess.ALL / unrestricted host access escape the sandbox and run OS commands as the Conductor process (often root). Open-source Conductor leaves the workflow API unauthenticated by default. NVD/VulnCheck describe affected range Conductor 3.21.21 before 3.30.2; complete fix in 3.30.2 (partial denyAccess blocklist on 3.30.0/3.30.1 is incomplete). Public PoC exists (incl. Exploit-DB / lab repos targeting ~3.23.0). FortiGuard telemetry: ~1,290 IPS blocks in 24h (rising) and ~6,696 over seven days; top observed sources Germany, Hong Kong, Indonesia, UAE, India. Empirical Security cited in-the-wild from ~21 August after August PoC. CVSS 9.8 reported (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Not claiming Australia KEV. Primary: FortiGuard threat signal; secondary: SecurityWeek 18 Sep / NVD.
FortiGuard — Orkes Conductor evaluator RCE Threat Signal (CVE-2026-58138)
Palo Alto Networks PSIRT CVE-2026-0307 (published 9 September 2026, updated 16 September 2026): multiple local privilege-escalation vulnerabilities in the GlobalProtect app (CWE-426 untrusted search path) let a local low-privileged user reach NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux, then run arbitrary commands with administrative privileges. iOS, Android and ChromeOS are not impacted. No special configuration required. Vendor CVSS-BT 5.9 MEDIUM (CVSS 4.0); CVSS-B 8.5; exploit maturity UNREPORTED; urgency MODERATE. Palo Alto Networks says it is not aware of malicious exploitation. Fixes: GlobalProtect 6.3.3-h15+ (Windows/macOS/Linux; Linux ETA ~17 Sep, Windows/macOS ETA ~28 Sep on the advisory), 6.2.8-h14+ (Windows/macOS), 6.0.15+ (Linux/macOS; Windows ETA ~29 Oct). NGFW customers must also upgrade PAN-OS and Prisma Access tenants to builds listed in the Solution table (e.g. PAN-OS 12.2.3, 12.1.10 / 12.1.7-h5 / 12.1.4-h10, and listed 11.2/11.1/10.2 hotfixes). Prisma Access scheduled maintenance upgrades; on-demand via Support. Distinct from desk cards cve-2026-0299 and cve-2026-0251. Primary: Palo Alto Networks PSIRT.
Microsoft Security Blog (9 September 2026) documents active cloud intrusions since May 2026 where callers or SMS messages impersonate internal IT helpdesk on employees’ personal phones, claim a passkey / MFA / SSO config must be updated urgently, and steer victims to adversary-in-the-middle phishing pages or Microsoft device-code authentication flows. Passkey enrollment is usually the lure, not the goal — AiTM captures credentials and session tokens; device-code phishing authorises an attacker-controlled client on legitimate Microsoft pages. Follow-on: actor-enrolled MFA methods, high-volume Microsoft Graph reconnaissance, SharePoint/OneDrive downloads, and Exchange REST collection. Microsoft attributes initial access to Storm-3121 (feeds ShinyHunters / Falcon extortion) and Storm-3032 (Helix / BlackFile splinter) among others. Example lure domains in coverage include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, oskeysync[.]com (often with company-name subdomains). Defenders: phishing-resistant MFA via Conditional Access; block device-code / auth-transfer where unused; correlate unusual sign-ins with new auth-method registrations and Graph/SharePoint anomalies; revoke sessions and remove rogue MFA methods. Primary: Microsoft Security Blog; wire: BleepingComputer (11 Sep).
Microsoft Security Blog — passkey-themed social engineering (9 Sep 2026)
Group-IB (9 September 2026) documents a Gigabud (GoldFactory) banking-trojan chain that installs a second Android app, Vwork, to create a work profile and drop a tampered banking app inside it. Work-profile isolation hides the trojan from the banking app’s malware checks on the personal profile. Confirmed on infected devices in Indonesia. Gigabud arrives as a sideloaded fake airline/tax/government app, demands Accessibility and overlay permissions, overlays fake logins and lock-screen capture, then drives taps via Accessibility under a black screen. Vwork is based on open-source Shelter but strips caller checks so other apps can create profiles, clone apps, and open them; setup is reduced to a single Chinese-language prompt. Order observed: Gigabud → Vwork within minutes → cloned banking app. Distinct from desk card mantax-otax-android-20260910. Primary: Group-IB; wire: The Hacker News (10 Sep 2026).
Surfshark's 9 September 2026 incident report says unusual activity on an internal engineering test server was confirmed on 2 September 2026 after a human misconfiguration left the host reachable from the internet. The company contained the same day and finished remediation by 5 September. An unauthorised party accessed limited engineering material (parts of system binaries, internal service configurations, and some build-related credentials that had appeared in code history). Access was also gained to an isolated content-accessibility optimisation VPS used as a proxy with no user identities, IP addresses, encryption keys, or browsing traffic. Surfshark states no user data or production VPN services were affected, no customer action is required, and exposed secrets were rotated or retired. Primary: Surfshark blog incident report; wire: BleepingComputer (10 Sep 2026).
Zimperium zLabs (9 September 2026) describes Mantax Otax, an Android strain linked to Indonesian operators that combines spyware with ransomware. Samples were distributed as sideloaded APKs on third-party file hosts via phishing and social engineering, outside Google Play. After install it seeks device-admin and Accessibility permissions, pulls C2 from GitHub, and can use Firebase or WebSockets. Spyware capabilities reported include screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, local file theft, and covert photos. On older Android versions it encrypts shared-storage files with a victim-specific AES key from C2, deletes originals, appends .enc, replaces images with ransom notices, and opens a full-screen Firebase-hosted chat for payment negotiation. Wire: BleepingComputer (10 Sep 2026). Primary: Zimperium blog.
Check Point support articles sk1000117 and sk1000118 (disclosed 9 September 2026) cover two critical VPN-certificate handling flaws the vendor found internally. CVE-2026-85102 (sk1000117) is authentication bypass and remote code execution in Remote Access and Site-to-Site VPN on Quantum Security Gateway when certificate trust is not validated correctly during VPN negotiation. CVE-2026-85103 (sk1000118) is a heap-based buffer overflow while decoding the ASN.1 structure of a VPN certificate that can yield unauthenticated RCE on Quantum Security Gateway and Quantum Security Management. Both carry CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the CVE records. Vendor reporting at disclosure said no evidence of in-the-wild use. UPDATE 12 September 2026: the Dutch NCSC (alert) assesses likelihood of exploitation and potential impact as high and expects exploitation attempts soon; no public PoC reported at that writing. NCSC urges immediate updates and, for Site-to-Site VPN, limiting peers to trusted IPs. LivePatch Take 24 / matching Jumbo builds as in the SK articles; R82.20 unaffected. Affected Jumbo trains cited in public writeups include R82.10 Take 43 or below, R82 Take 125 or below, and R81.20 Take 165 or below (plus older EOS trains in third-party summaries); R82.20 called unaffected. Apply the matching Jumbo Hotfix / LivePatch from the SK articles. Primary: Check Point sk1000117; also sk1000118; wire: The Hacker News (10 Sep 2026).
