Astrana Health, Inc. Form 8-K Item 1.05 (date of earliest event 22 September 2026) reports a material cybersecurity incident at subsidiary Astrana Health Management, Inc. Threat actors used social engineering — impersonating company personnel and spoofing the main corporate telephone number — to contact employees and obtain unauthorized access. The company detected and responded, engaged a third-party cybersecurity/forensics firm, notified law enforcement, and is notifying state/federal regulators and payer partners. Remediation includes resetting affected credentials, restricting remote-access tools, rebuilding certain systems from clean backups, and improving monitoring/logging/detection. Investigation determined threat actors accessed and exfiltrated certain private and confidential information; assessment continues on whether patient, employee, credentialed-provider, business/financial, IP, or other data was involved; patient notifications to follow findings. Incident judged material as of 22 Sep 2026 due to potential sensitivity of data; company states it does not currently expect material impact on financial condition or operations. (source: SEC 8-K)
SEC EDGAR — Astrana Health Form 8-K Item 1.05 (22 Sep 2026)
Jamf Threat Labs (22 September 2026) documents a third PamStealer macOS infostealer variant distributed as a fake multichain crypto wallet “Wavel”. Lure site wavel[.]app serves Wavel.dmg from y32me8[.]com; the DMG drops a nameless .scpt that opens in Script Editor and runs compiled JXA (JsOsaDAS1.001.00 magic) which only base64-decodes a carrier into /bin/zsh. The zsh dropper downloads a purpose-built pkgunpack Mach-O, completes a live X25519/ECIES key exchange with wavel.apple03cloudstore[.]com, and decrypts CoreUpdate.pkg.enc — without server cooperation the payload cannot be recovered statically. Stage 2 is rewritten from Rust to Swift while retaining PAM-based credential validation that names the family. (sources: Jamf Threat Labs; Cyber Security News)
Jamf Threat Labs — PamStealer adapts again (Wavel / Swift / server-side decrypt, 22 Sep 2026)
Aikido (published 22 September 2026; THN 23 Sep) reports Graphalgo-linked Go malware distributed via two Terraform providers (gocommunity-io/dockerd and typosquat kreuzwenker/docker of popular kreuzwerker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex) — described as the first use of HashiCorp’s centralized Terraform Registry as a malware distribution vector in this campaign. Providers hide an encrypted ZIP (examples/resources/docker_container/import-resource.sqlite3) decrypted with a SHA-256-derived AES key then executed via detached go run. Implant is a Go port sharing Slack bot + Arbitrum Sepolia smart-contract dead-drop C2 (contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C) with prior npm Graphalgo (ReversingLabs Feb 2026; also Checkmarx/JFrog/SafeDep). Aikido observed plaintext Slack check-ins from 18 unique hostnames (mix of macOS/Linux/Windows). (sources: Aikido; The Hacker News)
Aikido — Graphalgo malware spreads to Terraform and Go (22 Sep 2026)
AWS Security Bulletin 2026-115-AWS (Publication 22 September 2026 10:00 AM PDT) documents CVE-2026-94384: missing authorization in Amazon Connect Salesforce Lambda (AmazonConnectSalesforceLambda) sfExecuteAWSService before 5.26. Any IAM principal with lambda:InvokeFunction on the function can escalate and call AWS APIs allowed by the function's privileged execution role even when their own IAM policy denies those actions — the Lambda becomes a privileged parameter-dispatch proxy. Amazon CVSS 3.1 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); CVSS 4.0 6.4 Medium. Affected SAR app versions 5.15 through <5.26 (CSN also cites through 5.24.16). Remediation: upgrade to 5.26 or later; after setup delete or disable sfExecuteAWSService, or restrict InvokeFunction to the intended CTI Adapter IAM user only. Credit: Chang Li (Xidian University) via CVD. (sources: AWS bulletin 2026-115-AWS; CVE.report)
Adobe Connect security update APSB26-150 (CVE records published 22 September 2026) fixes nine defects including six Critical issues enabling arbitrary code execution / privilege escalation: CVE-2026-75682 (SQLi, Adobe CVSS 3.1 9.9), CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698 (SQLi / XSS / improper input validation family), plus High path-traversal, certificate-validation and XSS issues. Affected: Adobe Connect 12.11 and Android Mobile App 4.4. Unaffected/fixed: Connect 12.11.1 and 12.12; Android app 4.5. Priority 2 (apply within 30 days). Adobe states no known in-the-wild exploitation for these flaws. Same Tuesday drop also shipped AEM Forms JEE APSB26-151 (separate card).
cPanel support advisory (22 September 2026) documents CVE-2026-87899: an authenticated cPanel account holder can escalate through CalDAV/CardDAV functionality to code execution as root and full server control. Affects cPanel/WHM v120 or later; patched in 11.134.0.57+, 11.136.0.41+, 11.138.0.8+, and WP Squared 11.138.1.11+. Same-day related advisories (not separate cards): CVE-2026-87900 (WP Toolkit ≤6.11.2-10794 — authenticated cPanel user can modify other accounts' databases; fix WP Toolkit 6.11.3+) and CVE-2026-68490 (CalDAV/CardDAV — local user can read other accounts' calendar/contacts; same cPanel/WHM patched trains; no root). Vendor advisories do not publish CVSS and do not state exploitation. Credited to Ali Mustafa (rz1027). (sources: cPanel support CVE-2026-87899; The Hacker News) UPDATE (24 Oct 2026): The CVE record (HackerOne as CNA) scores CVE-2026-87899 at 9.4 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). (source: CVE record CVE-2026-87899)
Swedish Authority for Privacy Protection (IMY) press release (22 September 2026) imposes an administrative fine of SEK 1.8 million (~US$183k) on system supplier Miljödata i Karlskrona AB for inadequate technical/organisational security (GDPR Art. 32.1) after an August 2025 intrusion. Per IMY/Miljödata: ~2.2 million people affected; stolen data included personal identity numbers, contact details and sensitive fields (sickness absence, rehabilitation, school incidents involving minors) later published on darknet; customers included a majority of Sweden’s municipalities plus regions, agencies and private firms. IMY finds insufficient checks when installing new software and no automated real-time monitoring for intrusions/suspicious activity; agency also opened related reviews of two municipalities and one region (ongoing). (sources: BleepingComputer; IMY pressmeddelande)
IMY — Sanktionsavgift mot Miljödata för bristande säkerhet (22 Sep 2026)
Vercel GitHub advisory GHSA-vcvr-r3jv-pc5j (published 22 September 2026; CVE-2026-94545) documents remote code execution in the Node.js ImageResponse implementation from next/og when apps pass attacker-controlled values into SVG content, attributes, or styles during Open Graph / social-preview image generation (upstream Satori path). Vercel rates Critical with CVSS 4.0 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Affected: Next.js >=16.2.0 <16.3.6 on the Node.js runtime (default). Not affected per advisory/industry coverage: Edge ImageResponse and Next.js 15. Patched: 16.3.6 (22 Sep). Inventory routes importing ImageResponse from next/og that echo request/URL input into SVG; prefer not placing untrusted input in SVG title/attrs/styles until patched. No in-the-wild exploitation claimed in the 22–23 Sep Vercel/THN materials. (source: The Hacker News)
UPDATE 23–24 Sep 2026: BleepingComputer reports threat actors moved from probing to exploiting CVE-2026-87902 to write files that execute shell commands when accessed. Patchstack saw first malicious requests at 17:44 UTC on 22 September 2026 (under five hours after WordPress 7.1.2 shipped), then ~10× traffic increase delivering payloads. Flaw: unauthenticated get_page_template() path traversal to include a chosen readable local .php outside active theme dirs; RCE needs theme top-level page-* dir plus a readable include target (e.g. pearcmd.php with register_argc_argv). WordPress/GHSA rate Critical (~9.2 CVSS 4.0 UI; NVD/CISA secondary CVSS 3.1 8.1 High). Official PHP Docker image and default cPanel on PHP <8.5 called out. Fix: 7.1.2 with backports through eligible branches to 4.7 (pre-4.6 unfixed). Distinct from click2shell/comment2shell (7.1.1). UPDATE 25 Sep 2026: CISA added CVE-2026-87902 to KEV (dateAdded 2026-09-25). (sources: WordPress 7.1.2; GHSA-7hp8-65ch-5whp; BleepingComputer)
Gambit Security Threat Intelligence (blog dated 22 September 2026; interim report) reconstructed an ongoing financially motivated campaign from an exposed staging server: three open-source AI harnesses — Strix (autonomous vuln discovery), Cairn (end-to-end exploitation until shell/admin), and Hermes (orchestration / tactical guidance) — attacked hundreds of online retailers with human operators limited to brief Chinese-language prompts. Marginal cost cited at mean ~US$25.46 across 101 completed scans (range ~US$3–US$79); OpenRouter model spend estimated ~US$12k–US$18k over the observed window. Impact Gambit accounts for includes >600,000 unexpired card records from two victims (Overwatch Data: ~79% US issuers), skimmer scripts ordered against ≥27 named shops and confirmed on 19, and in some cases agent cleanup wiping Magento payment fields or dropping staging/backup tables. Example chain: unauth SQLi → plaintext OTP MFA bypass → web shell → sudo → NFS → AWS Secrets Manager → Magento card DB. Still running as of report; Shadowserver and partners helped notify victims and take down infrastructure. (sources: Gambit Security; Cyber Security News)
F5 (CVE published 22 September 2026; advisory K000162605) documents CVE-2026-94127: when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server and BIG-IP APM is configured as an OAuth Authorization Server, specific malicious traffic can lead to unauthenticated remote code execution. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization-server profiles) are not affected. Data-plane issue (no control-plane exposure); Appliance mode is also vulnerable. F5 CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 Critical. CISA added CVE-2026-94127 to KEV on 22 September 2026 (due 25 September 2026; forensic triage under BOD 26-04); known ransomware campaign use Unknown. Temporary mitigation: vendor-provided iRule, then install final vendor hotfixes. (source: NVD)
