Socket (24 September 2026; update 25 Sep) documents that GitHub Actions actions-cool/issues-helper and actions-cool/maintain-one-comment — compromised in the May 2026 Mini Shai-Hulud campaign and disabled by GitHub on 19 May — became downloadable again on 16 September 2026 without cleaning release tags. Tags still pointed at the May 18 malicious commits, so workflows referencing either action by mutable version tag (e.g. @v2.2.1) resumed fetching and executing the payload (Bun install + obfuscated index.js; credential harvest / exfil cluster overlap with t.m-kosche[.]com). issues-helper alone has ~15,000 dependent repositories on GitHub's dependency graph; housekeeping workflows often run daily or on issue/PR events, so many repos likely re-ran the payload within a day of re-enablement with no further attacker action. SHA-pinned clean pre-May-18 commits were not affected. Socket update 25 Sep: both repositories disabled again by GitHub Staff (ToS); tag-referenced workflows now fail at job setup instead of running the payload. (sources: Socket; The Hacker News)
Flare Research (blog dated 24 September 2026) documents TWEAKOS, a Telegram-native credential theft and monetization workflow recovered after source appeared on Pastebin. Two co-designed Python components share one bot token and admin IDs: a Windows-oriented stealer that persists via Startup / user Run key (no admin needed), harvests Discord tokens from Discord / Discord PTB / Chrome default-profile LevelDB (.log/.ldb), validates them against Discord’s API, drives an interactive Telethon sign-in to mint a fresh Telegram .session, and exfils validated tokens/sessions to hardcoded admin IDs; plus a single-process Telegram bot backend (SQLite) that inventories victims/products/orders and sells “telegram” and “discord” accounts under the TWEAKOS brand with 5%/day time-decay pricing settled in Telegram Stars. Flare assesses this as the first documented case of a stealer and its own storefront running inside the same bot process. Delivery lure and victim count unknown; bot reachability at disclosure not confirmed. No CVE. (sources: Flare; Cyber Security News)
ServiceNow September 2026 CVE Advisory (KB3159623; CNA records published 24 September 2026) remediates five ServiceNow AI Platform flaws. Lead criticals: CVE-2026-13016 (CVSS 4.0 9.3) — unauthenticated SQL injection enabling arbitrary SQL against the instance database and unintended data read/modify; CVE-2026-86860 (CVSS 4.0 9.3) — missing authorization / unauthenticated sensitive data disclosure with privilege escalation. Highs: CVE-2026-86858 (8.7) improper access control via GraphQL allowing unauth create/modify/delete of instance data; CVE-2026-86859 (8.7) unauthenticated authorization bypass / arbitrary record disclosure; CVE-2026-86857 (8.4) authenticated authorization bypass within AI Platform data. ServiceNow states no evidence of malicious exploitation; hosted instances received vendor updates (August Patching Program participants already covered); self-hosted/partners must apply patched releases. (sources: ServiceNow KB3159623; CVE.org/NVD CNA metrics)
ServiceNow — KB3159623 September 2026 CVE Advisory
Microsoft Threat Intelligence (24 September 2026) details Storm-2570, a ransomware affiliate observed since April 2025 whose final payload rotates among Qilin, DragonForce, Anubis, and BERT while post-compromise tradecraft stays consistent. Victims span US, Canada, UK, Spain, Netherlands and Puerto Rico across healthcare, education, energy and manufacturing. After access (initial vector not established in the post), operators install remote-management tools (MeshAgent/MeshCentral often renamed; also Atera, NinjaRMM, ScreenConnect, Splashtop, Remotely_Agent), tunnel with Cloudflare Tunnel or ngrok, harvest credentials (Mimikatz, LaZagne, pypykatz, AD database copy), disable AV/real-time protection, move laterally via PsExec/Impacket/NetExec/RDP, then exfiltrate and encrypt. Microsoft urges defenders to hunt affiliate behaviours before ransomware deployment rather than by payload name alone. (source: Microsoft Security Blog)
Microsoft — Beyond the ransomware: Tracking Storm-2570 (24 Sep 2026)
GitLab’s critical patch release (docs: 19.4.1, 19.3.3, 19.2.7) remediates two CVSS 9.9 flaws that let an authenticated user achieve arbitrary code execution on the GitLab server via specially crafted regular expressions in CI/CD configuration. CVE-2026-89078 is a double-free in the regular-expression parser (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L); CVE-2026-93577 is an integer overflow in the regex compiler (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Both affect GitLab CE/EE from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. GitLab.com is already on the fixed build; GitLab Dedicated customers need no action; self-managed admins must upgrade immediately. Reported via HackerOne by joaxcar. (sources: GitLab critical patch release notes; Cyber Security News)
Payy (@payy_link) said on X at 14:04 UTC on 24 September 2026 that at 4:21 UTC that day its bridge contract on Ethereum 'was exploited and drained of its full balance', and that while it investigates 'all Payy Network transactions are paused including deposits, withdrawals, transfers and card transactions'. In follow-up posts that day Payy said it had notified law enforcement and was working with multiple incident response organisations (14:35 UTC); that 'Law enforcement, exchanges, blockchain analytics companies and other relevant parties have been notified of attacker addresses' (16:02 UTC); that 'We have paused functionality on Payy Wallet' (16:04 UTC); and that 'the stolen funds were users' non-custodial deposits to Payy Network / Payy Wallet' (17:58 UTC). Those posts did not give the amount stolen, the vulnerability class or the attacker addresses. (source: Payy posts on X)
Payy (@payy_link) on X — bridge contract exploited and drained; Payy Network transactions paused (24 Sep 2026, 14:04 UTC)
Crypto casino Duelbits co-founder Joe (@DuelbitsJoe) wrote on X on 24 September 2026: "Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline. User funds are safe." The next steps he listed were to finish the investigation, re-top hot wallets and bring Duelbits back online. In a follow-up post he wrote: "We’ve identified what happened. An official statement will follow within 24 hours." He said the site should be back up within about 15 hours and that Duelbits was rebuilding its deposit and withdrawal servers. Duelbits has not published a technical root cause in these posts. (source: Duelbits co-founder Joe on X) Correction (27 Oct 2026): removed on-chain outflow figures credited to Scam Sniffer, Ethereum flow details, a researcher assessment of a private-key or signing compromise and a comparison with the Bitget incident, all of which came only from Cyber Security News, which does not serve its pages to Cyberstack; that link and credit are removed too. (source: Duelbits co-founder Joe on X)
Cloudflare Blog (published 24 September 2026 15:00 UTC; joint write-up with Accomplish) and Accomplish (24 Sep) document a cross-tenant data-exposure flaw in Cloudflare Containers (also affecting Sandboxes / Browser Run that share the disk stack). Oren Yomtov (Accomplish) reported via HackerOne on 4 September 2026. Root cause: Linux device-mapper thin provisioning (dm-thin) pools used skip_block_zeroing; when a container’s writable /dev/vdc thin disk was deleted, 64 KiB physical blocks returned to a multi-tenant pool uncleared. A Workers Paid tenant could force allocation of a recycled block with a 4 KiB write into free ext4 space then raw-read residual bytes (directory structures, DB pages, SQLite) left by prior tenants on the same host — opportunistic (no victim/host targeting; placement automatic). PoC saw residual material on 18/24 placements across four continents. No CVE / no vendor CVSS in the posts. Cloudflare removed skip_block_zeroing fleet-wide, retired running container disks and pre-mitigation OCI image snapshot caches, drained/restarted hosts, and built disk-I/O detection for the 4 KiB-write / large-read pattern; retained telemetry showed only researcher and authorized validation activity — no evidence of malicious exploitation. No customer-side config change required. (sources: Cloudflare Blog; Accomplish)
Cloudflare Blog — cross-tenant data exposure in Containers (24 Sep 2026)
Bitget Support Center security notice (24 September 2026) confirmed unauthorized transfers from portions of its hot and warm wallet layers. Initial figure ~US$351.6 million; later reconciliation ~US$387.5–388 million across multiple chains. Cold wallets and private keys stated intact; User Protection Fund covers impact. Updated 28 Sep 2026: Bitget's Academy timeline (first published 27 Sep, 6:04 pm Perth) and CEO Gracy Chen's 28 Sep AMA say the attacker exploited a vulnerability in an unnamed third-party security product to obtain high-level internal credentials, then injected fraudulent withdrawal commands; BTC withdrawals resumed 28 Sep 08:00 UTC with phased restore. Updated 30 Sep 2026: BleepingComputer (7:11 pm Perth), citing SlowMist and Mandiant forensics, reports threat actors compromised two unnamed third-party security appliances ("Product A" and "B") with zero-day exploits; earliest malicious activity in available logs 31 August; hidden scripts under a Product A service process read DB password env vars; on 24 Sep privileged access to appliances A/B, webshell on appliance B, C2, lateral move to Bitget production wallet job server, malicious packages and a custom withdrawal tool; theft window ~02:31–05:23 UTC+8 spanning ETH/XRP/BNB/AVAX/USDT/USDC and multiple chains. North Korean tradecraft still suspected. Products remain unnamed publicly. (sources: Bitget Support; Bitget Academy; BleepingComputer)
Bitget Support — [SECURITY NOTICE] hot wallets incident (24 Sep 2026)
Datadog Security Labs (published 24 September 2026; GHSA published 24 Sep 2026 13:36 UTC) documents GHSA-632h-h47v-g4x4 in Anomaly OpenCode, an open-source AI coding agent (≥200k GitHub stars / ~16M monthly users per vendor site). A content-type confusion on the /global/upgrade HTTP API made an underlying code-injection path reachable cross-origin: a malicious webpage can submit a top-level HTML form POST that installs an attacker-controlled npm/pnpm/Bun package tarball (lifecycle scripts → RCE) when the victim is running opencode serve (or opencode web) with an npm-managed install. Default serve has no auth; HTTP Basic helps only until the browser caches credentials. Browser CORS / Local Network Access prompts do not block top-level navigations. Affected: OpenCode ≥1.14.30 through 1.18.21 (npm/pnpm/Bun installs). Not this path: curl/Homebrew/Chocolatey/Scoop installs; users not running the HTTP server. Fixed in 1.18.22 (Anomaly patched 24 Aug 2026; publication delayed ~1 month). Anomaly declined a CVE. GHSA CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (High; score 7.5). (sources: Datadog Security Labs; GitHub GHSA)
Kaspersky Securelist (Sergey Puzan; datePublished 24 September 2026 10:00 UTC) documents a new MacSync macOS stealer infection chain first spotted in the wild in September 2026. MacSync is a Swift/Objective-C crypto/infostealer family first advertised on the dark web around April 2025 (earlier builds resembled AMOS). Delivery includes ClickFix-style lures (fake Homebrew / macOS disk-space tools) and fake apps such as a promoted crypto wallet branded Toria. Complex chain: a downloader pulls commands from the DESCRIPTION: field of a public iCloud calendar event, pipes the calendar text into zsh -s (most lines error; post-DESCRIPTION commands run), then fetches an archive from iCloud containing an APP-bundle dropper that stages MacSync. Infostealer module still harvests browsers, crypto-wallet extensions/apps, Telegram, Keychain, SSH/AWS/Kubernetes/Git/shell configs, and device info. New Objective-C backdoor disguises as Finder; persistence via LaunchAgent com.apple.finder.agent, .zshrc / Git-hook injection, and killing macOS notification processes. C2 AppleScript tasks include deploy_ledger (replace Ledger wallet with C2 copy), browser-extension deploy, regrab exfil, and mystery live_browser → sn_relay component (purpose not determined). Kaspersky detections: HEUR:Trojan.OSX.MacSync.* / Trojan-PSW.OSX.MacSync.*. No CVE. (sources: Kaspersky Securelist; BleepingComputer)
CISA added CVE-2026-71362 to the Known Exploited Vulnerabilities catalog on 24 September 2026 (FCEB due 27 Sep) as an incorrect-authorization flaw in Adobe Commerce and Magento Open Source that can elevate access to sensitive resources without user interaction. Sansec (11 August 2026) reviewed Adobe APSB26-92 isolated patches and confirmed the bug lets an unauthenticated attacker switch a customer session to another customer account (account takeover / private customer data). APSB26-92 is a multi-CVE isolated-patch package (seven flaws; five Critical including this CVSS 9.1 item) — not a full Composer security release; merchants must be on the latest -p line for their release before applying the isolated patch. Affected, per Adobe's CVE record: Adobe Commerce through 2.4.9-2026-jul / 2.4.8–2.4.4-2026-aug lines; Magento Open Source through corresponding -jul lines; Adobe Commerce B2B through listed -jul lines — patched in the matching 2026-aug isolated/security levels per APSB26-92. (sources: CISA KEV alert; Adobe APSB26-92; Sansec) Correction (27 Oct 2026): removed a claim that Previdian sensors saw exploitation attempts from an Australia-geolocated IP on 10 September, and a line crediting The Hacker News, because neither source is linked; Adobe's APSB26-92 bulletin returns 403 to Cyberstack. The affected versions are now credited to Adobe's CVE record. (source: CISA; Sansec; CVE.org)
CISA — Adds Two Known Exploited Vulnerabilities to Catalog (24 Sep 2026)
