Twilio says it has not been breached: a Twilio spokesperson told The Hacker News that 'Twilio has not experienced a security incident, and our systems and customer data remain secure and uncompromised' and that 'the npm packages have been removed.' ReversingLabs (report covered 22 September 2026) details the malicious npm package tw-pkgprobe-7731 (publisher twdepprobe7731; 11 different versions published back to back on 14 August 2026; account later removed). Early versions claimed to be an “Authorized bug-bounty research probe (Twilio HackerOne program)” running only in Twilio’s serverless packager sandbox; behaviour instead fingerprints Twilio developer environments, exfiltrates host/process context and environment variables via webhook, later versions specifically target Twilio ACCOUNT_SID/AUTH_TOKEN and inject into node_modules, and some builds probe Twilio-related hosts plus AWS instance metadata. Not affiliated with Twilio; RL assesses it almost certainly violates Twilio HackerOne rules of engagement (no customer/employee data exfiltration). Package no longer present under that publisher as of RL write-up. (sources: ReversingLabs blog; The Hacker News) Correction (24 Oct 2026): an earlier version said the 11 versions were published over about 45 minutes; neither ReversingLabs nor The Hacker News gives that figure. ReversingLabs says they were published back to back on 14 August. (source: ReversingLabs)
ShinyHunters (22 September 2026) claims it breached FBI systems using an alleged Oracle PeopleSoft remote-code-execution zero-day and stole employee and applicant data. The group shared a screenshot of apply.fbijobs.gov allegedly defaced with its Umbreon logo; the jobs/special-agent portals later showed maintenance. 404 Media reports receiving a sample of agent names, home addresses, and phone numbers (including spouses) and verifying a portion against public records; TechCrunch and BleepingComputer relay the claim. BleepingComputer states it has not independently verified the alleged zero-day, lateral movement, or volume of stolen data. UPDATE 26 Sep 2026: BleepingComputer reports the FBI confirmed it is investigating the claims without confirming a breach or data theft. Separate Google Mandiant/GTIG report the same week documents renewed UNC6240 mass exploitation of already-patched CVE-2026-35273 (PeopleSoft PeopleTools PSEMHUB) with WAF-bypass encoding and SIDEEYE — that campaign is covered on /n/cve-2026-35273; unclear if the FBI claim is that CVE or a distinct flaw. (sources: BleepingComputer; TechCrunch) Switch primary_url if FBI or Oracle publishes a confirmed notice. CORRECTION (21 Oct 2026): we removed two later updates, a 30 September update quoting ShinyHunters' statements to the media and a 6 October update saying the FBI removed an Accenture contractor, because the stories they relied on were not linked or could not be read. They will return only with readable linked sources. Correction (23 Oct 2026): removed ShinyHunters' own claims about data volume, systems reached and other targets; BleepingComputer says it has not verified them. (source: BleepingComputer)
Cisco Talos (22 September 2026), via its CAIRN AI-malware research toolkit, documents CLOSEDQUORUM: a Go-based Windows implant that after deployment queries up to four commercial LLMs (DeepSeek, Qwen, Mistral, Google Gemini), tallies votes, and executes the winning tactical action without a human operator or attacker-run C2 server. Constrained actions include steal (LSASS dump; Chrome/Edge/Firefox credentials; MetaMask/Exodus/Ethereum wallets), inject (shellcode via process hollowing or Early Bird APC), persist, and move (lateral-movement option present but handler absent in analysed build). Stolen material is forwarded via Discord webhook. Talos states it does not have confirmation of in-the-wild deployment; binary artifacts linked a developer to carding-forum activity from 2025. Talos frames this as effort displacement in AI-enabled offence and the first publicly documented Windows implant to delegate tactical C2 decisions to an LLM panel. (sources: Cisco Talos blog; BleepingComputer)
Cisco Talos — The Closed Quorum / CLOSEDQUORUM (22 Sep 2026)
Microsoft On the Issues / Digital Crimes Unit (22 September 2026) and Microsoft Threat Intelligence (“Unmasking EvilTokens”) detail disruption of EvilTokens, a phishing-as-a-service platform Microsoft tracks as Storm-2992. The service abused OAuth 2.0 device-code authentication against Microsoft’s legitimate sign-in flow (MFA-bypass style session/token theft without password capture) and centred an AI-style chatbot that analysed compromised mailboxes to pick BEC targets, impersonation paths, and fraud plays. Microsoft links >12,000 compromised inboxes across >10,000 organisations since the Feb 2026 launch; highest victim concentrations include the United States, Canada, the United Kingdom, Australia, India, and France. Partners helped seize ~50 operator sites and disable 150+ related domains; UK Metropolitan Police arrested two suspected administrators. Sold via Telegram (~US$1,500 init + US$500/month). (sources: Microsoft On the Issues; BleepingComputer)
Microsoft On the Issues — Disrupting EvilTokens (22 Sep 2026)
Check Point sk1000171 (approved/created 20 September 2026; last modified 22 September 2026; CVE published 22 Sep) documents CVE-2026-93616: directory traversal plus file upload lets an unauthenticated attacker upload and execute arbitrary scripts on Quantum Security Management / Multi-Domain / Log Server / Multi-Domain Log Server / SmartEvent. Check Point CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-22. Vendor states the vulnerability is exploited in the wild and a handful of customers have been attacked. Smart-1 Cloud already patched; firewall appliances / Spark not affected. LivePatch Take 28/29 does not fix this issue (no LivePatch for this fix). (sources: Check Point sk1000171; CVE.report)
Check Point sk1000171 — CVE-2026-93616 Management Server path traversal (22 Sep 2026)
Arista Security Advisory 0183 (CVE published 22 September 2026) documents CVE-2026-93952 in on-premises VeloCloud Orchestrator (VCO): a remote attacker with network access to the VCO web interface and the public part of an Edge authentication certificate may reach privileged internal functionality and impact the VCO host when certificate-based Edge→VCO authentication is configured. Arista/CNA CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 9.5; Arista states the issue was discovered externally and is known to be actively exploited. Hosted/Dedicated VCO already patched. On-prem trains: 5.2.3.15 and earlier → fix 5.2.3.16+; 6.4.2.7 and earlier → fix 6.4.2.8+; 6.1.3.7 and earlier and 7.0.0.2 and earlier — no fix listed as of 22 Sep 2026 (Arista says supported-train fixes forthcoming). Distinct from July exploited VCO CVE-2026-16812. (sources: Arista SA-0183 URL; CVE.report)
BleepingComputer (Sergiu Gatlan; coverage of weekend disclosure) reports security researcher Abdelhamid Naceri (MSNightmare / Nightmare Eclipse) released BigDiskBuster, a local proof-of-concept that prevents Microsoft Defender Antivirus from completing platform and security-intelligence updates while it runs. The tool watches Defender Platform/Definition Updates directories on the C: volume and starves the installer by creating a hidden delete-on-close temp file sized to remaining free space, with worker threads reclaiming capacity if files change; it may also open MRT.exe with restrictive sharing to interfere with staging. No CVE assigned in the BleepingComputer write-up; Microsoft initially had not commented. PoC: github.com/MSNightmare/BigDiskBuster. Correction (24 Oct 2026): BleepingComputer's article, updated 26 September, carries a Microsoft statement that Microsoft Defender Antivirus detects BigDiskBuster and includes detection and prevention for observed activity; Microsoft did not say a CVE had been assigned and told customers to keep Defender security intelligence and platform updates current. (source: BleepingComputer) Correction (25 Oct 2026; revised 27 Oct 2026): the card date is 22 September 2026, the date BleepingComputer's report visibly shows (it describes the disclosure as happening over the weekend). A repository-creation time taken from GitHub API metadata has been removed because that page could not be read. A Cyber Security News link dated 21 September has been removed because we can no longer read that site, so its date could not be checked. (source: BleepingComputer)
BleepingComputer — New Windows Defender zero-day blocks antivirus updates (BigDiskBuster)
DriveWealth says the incident was contained on 5 September 2026 (DriveWealth notice of data breach, filed with the California Attorney General; see the DriveWealth update below). Stake, the Sydney-founded investing platform, told customers on 21 September 2026 that DriveWealth, the US broker that provides execution, custody and clearing for Stake Wall St accounts, had a cyber incident that affected some Stake customers' personal information. Stake says the information involved varies by person and may include name, email address, phone number and postal address; W-8 or W-9 tax status and country of taxation; the DriveWealth (Stake Wall St) account number; and aggregate snapshots of portfolio value, cash balance and buying power. It says Stake login credentials, tax file numbers and other government ID numbers, bank account details, identity documents, individual holdings and trading history were not accessed, that Stake's own systems were not affected, and that DriveWealth reported no unauthorised trading, transfers or withdrawals. People who opened a Stake Wall St account but no longer use it may also be affected. Stake is emailing affected customers. New Zealand's Hatch and the UK's Freetrade (for former Stake UK customers) have issued similar notices about the same DriveWealth incident. Stake has not said how many Australians are affected. (sources: Stake; DriveWealth breach notice) Updated 25 Sep 2026 (Nine.com.au, 10:28 am Perth): Nine reported that Stake apologised to customers and said it was working with DriveWealth to understand the extent of the incident. Updated (DriveWealth notice of data breach, filed with the California Attorney General): DriveWealth's own breach notice says unauthorised access to its network took place on 4 and 5 September 2026, that it contained the compromise that day, and that its investigation and document review concluded on 28 September. Correction (26 Oct 2026): Nine.com.au's report and DriveWealth's notice, both later than Stake's 21 September statement, now carry Updated lines. (source: Stake; Nine.com.au; DriveWealth) Correction (26 Oct 2026): the card now leads with DriveWealth's statement, in its linked breach notice, that the incident was contained on 5 September 2026; no linked source gives a different date. (source: DriveWealth)
Stake — DriveWealth Data Security Incident (21 Sep 2026)
Qantas is investigating a possible security breach after some Qantas Hotels customers were targeted by WhatsApp phishing messages, Australian Aviation reported on 21 September 2026. Qantas said it was investigating reports of phishing attempts targeting some Qantas Hotels customers, that anyone who receives a suspicious WhatsApp message claiming to be from a hotel should ignore it, that Qantas Hotels and its accommodation partners will never ask customers to verify a booking or provide personal details via WhatsApp, and that customers concerned about a booking should check Qantas.com or the Qantas app; it also said it never asks customers for passwords. Capella Sydney said it was aware of reports from guests who had received suspicious WhatsApp messages requesting payment and credit card details in relation to their reservations, and confirmed the messages did not come from the hotel. According to Australian Aviation, the Australian Financial Review broke the news the previous week, and neither Qantas nor Capella Sydney had any further update. No threat actor has been identified, and neither company has said how the senders knew who had a booking. The campaign follows the 2025 breach in which more than five million Qantas customers' data was compromised. (source: Australian Aviation) Correction (26 Oct 2026): the card date has moved from 17 to 21 September 2026, the date of Australian Aviation's report; the Financial Review report the card was first dated by is not linked. Qantas's scams page cannot be read by Cyberstack, so details only it gave (a September 2026 entry for the campaign and its mention of countdowns and cancellation threats) have been removed, along with a description of the messages quoting hotel names and booking dates, which Australian Aviation does not give. (source: Australian Aviation)
A Canva spokesperson told Capital Brief on 21 September 2026 that unauthorised access to Canny, a third-party customer-feedback tool Canva used, 'allowed access to limited enterprise customer information through its connection to our Salesforce account, including business contact details and contract information'. Canva said it immediately removed Canny's access and took steps to notify affected customers, and that its own platform was not compromised and Canva accounts, passwords, designs and content were not accessed. Capital Brief reported that Canny told Canva on 29 August that it was investigating unauthorised access to its systems. On 19 October Cyber Daily reported that Canva had disclosed that 'some enterprise customer records' were exposed in an incident affecting one of its third-party data tools. The Seven Deadly Sins claimed the attack, according to Cyber Daily. (sources: Capital Brief; Cyber Daily) Correction (30 Oct 2026): removed material from VRChat's notice and from the login-only part of Cyber Daily's report; card date moved to 21 Sep 2026, the date of Capital Brief's report. (source: Capital Brief)
Capital Brief — Canva enterprise customer data exposed in third-party breach (Canva statement, 21 Sep 2026)
MariaDB published advisory GHSA-m5gf-432r-g5jw, 'Insecure $HOME in MariaDB rpm packages' (CVE-2026-107814, High, CVSS 3.1 8.4, CWE-732), on 21 September 2026. MariaDB says its rpm packages created a dedicated mysql user to run mariadbd with its home directory set to the data directory, so a malicious user with FILE privilege could create dot-files in $HOME; for example a .bash_profile would run when someone does su - mysql -s /bin/bash. Deb packages are not vulnerable because the home there is /nonexistent. Affected: 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2 and 13.0.1; fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. No exploitation is reported in the advisory. (source: MariaDB) Correction (27 Oct 2026): this card covered a batch of MariaDB advisories and has been cut back to CVE-2026-107814, the one its id names. Removed: seven other server advisories, one Connector/C advisory and one Connector/Node.js advisory; plus the advisory-list and 11.8.9 release links. The card date has moved from 9 October to 21 September 2026, the date the advisory visibly shows. (source: MariaDB) Correction (29 Oct 2026): the CVE ids of the removed advisories were taken out of the correction note above so they are no longer listed or linked on this card. (source: MariaDB)
IBM Security Bulletin ibm17288641 (node 7288641; Initial Publish 21 September 2026; Modified 21 Sep) addresses a large set of vulnerabilities in Financial Transaction Manager (FTM) for Red Hat OpenShift. Highest scores: CVE-2026-18169 CVSS 9.9 (authenticated symlink/path validation → sensitive data / integrity, scope changed), CVE-2026-18163 CVSS 9.8 (unauth remote deserialization RCE), CVE-2026-18162 CVSS 9.8 (unauth code injection via JS Function constructor), plus further Critical/High issues (e.g. CVE-2026-17635 9.1 HTTP security-header misconfig; CVE-2026-18872 9.3 stored XSS; CVE-2026-17645 9.1 priv escalation). Affected: FTM for OpenShift 4.0.6.0 through 4.0.10.0 (incl. 4.0.6.0 iFix6 / Operator 4.4.6+20260807.081800). Remediation: upgrade to FTM 4.0.11.0. No exploitation-in-the-wild claim in the bulletin. (sources: IBM bulletin; CVE.report)
IBM Security Bulletin — FTM for Red Hat OpenShift multiple vulnerabilities (21 Sep 2026)
