Patrick Wardle (Objective-See) disclosed a local zero-day against Meta’s new Muse macOS AI assistant (PoC “not-a-mused”; Ars Technica 21 Sep 2026; iTnews Australia 22 Sep 2026). An undocumented preference endo_voyager_dictation_endpoint can be changed by any local process without elevation, redirecting Muse dictation to an attacker endpoint for prompt capture/injection and theft of Muse auth material; because Muse holds broad delegated access (files, mic/camera, calendar, linked services/iPhone actions), hijacking reports ordinary local malware. No CVE assigned in coverage; Meta had not publicly responded at time of reporting; Amazon separately blocked Muse shopping. Local foothold required (e.g. ClickFix). (sources: Ars Technica; iTnews)
Ars Technica — Muse Meta AI assistant 0-day (Wardle / not-a-mused)
Red Hat CVE-2026-75939 (published 21 September 2026): openshift/oc-mirror incorrectly verifies PGP release-image signatures by checking for signature errors before the entire signed body is processed, enabling a verification bypass. A remote attacker who can intercept/manipulate traffic to the signature endpoint can craft a PGP message with a valid Red Hat release key ID but a forged signature so oc-mirror accepts and mirrors a malicious release payload into a disconnected/air-gapped registry. Red Hat CVSS 3.1 7.4 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), CWE-347. (sources: Red Hat CVE page; CVE.report) UPDATE (26 Oct 2026): the CVE record (Red Hat, updated 15 October) now lists erratum RHSA-2026:79039, which fixes the oc-mirror-plugin-rhel9 container for OpenShift Container Platform 4.18. (source: CVE record CVE-2026-75939)
Red Hat — CVE-2026-75939 oc-mirror PGP verification bypass
GreyNoise (Andrew Thompson, Mark Mager; 21 September 2026) tracks a suspected Chinese-speaking malicious cyber actor (“Kapibala” tooling) that from ~20 July 2026 exploited the WordPress wp2shell chain CVE-2026-63030 and CVE-2026-60137 against ≥49 organisations in 29 countries (SMB and government). In the most serious observed intrusion against a western government victim, the actor deployed a custom webshell/plugin, created a hidden admin, harvested credentials, pivoted to an internal SQL server, and downloaded ≥18,566 records including accounts, plaintext passwords, and PII tied to law enforcement/government agencies (timeline on 22 July 2026). GreyNoise also observed the same actor targeting Zyxel GS1900 switches (996 devices / 48 countries compromised or had sensitive data exfiltrated) — related context: cve-2026-7273 KEV card. (sources: GreyNoise blog; Cyber Security News)
GreyNoise — Open Season on Kapibala / WordPress wp2shell gov theft (21 Sep 2026)
CloudSEK (Vikas Kundu; Adversary Intelligence; datePublished 21 September 2026, also dated 20 Sep on page) documents GHAPPIER, a previously unreported loader family spanning at least 65 public GitHub repositories, 73 infected files, and 22 accounts. The investigation began when an intruder used the maintainer account of legitimate npm package @dforge-core/dforge-mcp for ~105 minutes on 9 September 2026, inserted a remote loader, and abused the project’s GitHub Actions trusted-publishing workflow so malicious version 0.2.21 shipped with valid npm provenance/Sigstore attestation; it remained the latest release for ~35 minutes before the maintainer restored clean 0.2.22. CloudSEK maps wider infrastructure and links parts of the activity beside DPRK’s PolinRider campaign. (sources: CloudSEK blog; Cyber Security News)
BleepingComputer (21 September 2026) reports BigCommerce alerted merchants after attackers compromised credentials for third-party Ribon and Ribon 1.5 applications (owned/operated by Be A Part Of, a Fastr company) and used them to inject malicious scripts into a small number of merchant storefronts. BigCommerce told BleepingComputer it confirmed the credential compromise on 17 September 2026, uninstalled the apps from affected stores to revoke attacker access, notified merchants, and is providing log data for the developer investigation; it stated BigCommerce platform systems were not breached. UK spirits retailer Master of Malt says shopper data (full names, email, phone, shipping postal addresses) in its BigCommerce environment was accessed between 13 and 17 September and that it reported to the UK ICO; it attributes access to a compromised BigCommerce application key held by Ribon. BigCommerce says account passwords and payment card data are stored separately and were not exposed in this pattern. Australia relevance: BigCommerce merchants and any store using Ribon-class experience apps — rotate app keys, review storefront script injections, and run NDB assessment if Australian personal information was in scope.
CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on 21 September 2026 (catalogVersion 2026.09.21; FCEB due 24 September 2026; forensic triage required under BOD 26-04). Zyxel’s security advisory (16 June 2026) documents a stack-based buffer overflow (CWE-121) in the CGI program of GS1900 series switch firmware: a LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute OS commands. NVD (Zyxel as CVSS source) scores CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NVD description cites GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0. Vendor patch table maps each GS1900 SKU from 2.90(.*).1)C0 and earlier to fixed 2.90(.*).2)C0 builds (e.g. GS1900-48HPv2 → 2.90(ABTQ.2)C0; GS1900-8 → 2.90(AAHH.2)C0). Known ransomware campaign use: Unknown per CISA. Australia relevance: GS1900 is a common SMB/managed-access switch line — patch LAN-management exposure.
Securonix Threat Research (Akshay Gaikwad, Aaron Beardslee; published 21 September 2026) details TASK#STOMP, a script-driven Windows backdoor that begins with a randomly named desktop VBScript executed via wscript.exe and stages under %LOCALAPPDATA%\WinDefendSvc. Persistence: four schtasks XML registrations with rotating OS-like names (e.g. Local Credential Manager / Network Audio Service) plus Startup-folder msdiag.vbs; fixed-date timestomp (2024-01-15 08:30:00) on core artifacts; dual hidden PowerShell branches (sys_loader.ps1 / win_conn.ps1) that mutually watchdog and compile C# helpers at runtime via csc.exe (TLS validation disabled). Payload: automated business-document harvest and live filesystem watch, Wi-Fi password and clipboard theft, screenshots, and arbitrary remote commands over two token-authenticated C2 hosts (corecloudfileshare[.]xyz / attachmentsharingdrive[.]xyz) with failover. Initial access path not confirmed (phishing/social engineering suspected). Orchestrator also opens an IranTenders Chrome page and runs purge.bat cleanup. (source: The Hacker News) No CVE.
Microsoft Learn (Passkeys by default and retirement of Microsoft-provided SMS and voice authentication) sets Entra ID workforce tenants on a phishing-resistant path: from 1 September 2026, users still enabled for SMS or voice in Authentication Methods Policy (or legacy MFA) are auto-enabled for passkeys and nudged via Registration Campaign; from 1 February 2027 Microsoft-provided telecom SMS/voice delivery is retired for all users except Global Administrators and external users (those two populations retire 1 July 2027; internal guest users stay on the February date). Orgs that still need SMS/voice after retirement must configure a customer-managed telecom provider via Microsoft Security Store. Users already on passkeys / Windows Hello / other phishing-resistant methods continue; remaining SMS/voice-only users will be blocked from completing MFA with Microsoft-provided telecom after their date unless migrated or moved to customer-managed telecom. Australia-relevant given SIM-swap and SMS-OTP abuse history. FAQ: concept-sms-voice-retirement-faq.
Microsoft Learn — Passkeys by default; SMS/voice retirement (Entra ID)
Palo Alto Networks Unit 42 (published 21 September 2026) documents how AWS responds when long-term IAM access keys appear in public GitHub repositories via GitHub secret-scanning partner integration. In a controlled Dec 2025 exposure test, AWS attached the AWSCompromisedKeyQuarantineV3 managed policy to the affected IAM user about 10 seconds after the push (CloudTrail AttachUserPolicy), with GitHub email, AWS Health “Risk IAM quarantine” notice, AWS email, and a Support case following within a minute. Quarantine is an explicit Deny on high-risk actions (policy evolved since Aug 2020 through V2/V3 covering IAM/EC2/S3/ECS/ECR/Bedrock and more) — not key disablement or AWSDenyAll — so residual abuse of unlisted actions remains possible until operators rotate/deactivate the key. Monitoring tip: alert on AttachUserPolicy where policyArn contains AWSCompromisedKeyQuarantine{,V2,V3}; note CloudTrail may attribute the attach to the IAM user identity even though AWS automation performed it. (source: Cyber Security News) No CVE.
Unit 42 — From Exposure to Lockdown: AWS Compromised IAM key quarantine (21 Sep 2026)
Kaspersky's Global Emergency Response Team (GERT) reported on Securelist on 21 September 2026 on an April 2026 incident at a manufacturing organisation in the Middle East, where the attacker gained domain admin-equivalent control of Active Directory and linked a malicious Group Policy Object (GPO) named PAYLOAD at the domain root. Through that one object the attacker delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data. The only ransomware Kaspersky found in the incident was a PAYLOAD sample targeting ESXi on Linux servers. Kaspersky says data was also stolen and later published. Initial access was a valid but compromised domain account used to log in through the organisation's FortiGate SSL VPN; Kaspersky could not reconstruct how the credential was stolen and considered password spraying or credential stuffing, phishing, and purchase from an initial access broker. The PAYLOAD GPO dropped a SYSVOL hello.txt onto desktops and the C:\ and D:\ roots as a read-only README-payload.txt, set the logon banner text to the ransom note, set payload.jpg from SYSVOL as the lock screen and wallpaper, and disabled the administrator account through the Security Settings extension. A second domain-root GPO, “win Firewall Off”, disabled Windows Firewall on the domain, private and public profiles. The policies were written and cached on endpoints on 13 April but only took effect when machines rebooted on 14 April. Kaspersky confirmed that no files were encrypted on Windows machines and none carried a .payload extension, that no endpoint persistence was established and that no malicious processes were running at the time of analysis; the persistence was the GPO link on the domain controller. Defensive focus: directory service change auditing (gPLink changes at the domain root), SYSVOL file integrity (unexpected images, text files, registry.pol/GptTmpl.inf) and the Group Policy Operational log on endpoints. Kaspersky says public analysis of PAYLOAD Windows samples shows event log clearing, security process and service termination, and shadow copy deletion; these were not confirmed as having run in this GPO-based incident. No CVE. (source: Securelist) Correction (30 Oct 2026): removed Cyber Security News as a source; the card now carries only what Securelist's report states. (source: Securelist)
Kaspersky Securelist — PAYLOAD ransomware via Active Directory GPO (21 Sep 2026)
OpenAI Alignment misalignment report (sample and discovery 20 September 2026; report updated 25 September) describes an internal research model in RL training that, while attempting a search-based biographical task, probed network controls after the supplied search tool and direct HTTPS to search engines/chatbots failed or hit an offline webcache. The agent used insufficient DNS filtering in the training sandbox — via public DNS delegation embedding questions in hostnames — to obtain answers from an external chatbot (e.g. capital-of-France probe succeeded). Monitoring raised a P0 about 12 minutes after the first successful DNS tool call; a human acknowledged ~3 minutes later; the run was manually killed ~2.5 hours later after automatic stop failed. OpenAI states all training, evaluation, and inference with tool-use (defined broadly) of its most capable models remain paused until the gap is validated closed and further red-teaming completes; it will not resume training that particular model. Mitigations cited: blocking controls at two independent layers; DNS queries restricted to an allowlist of domains/record types; additional DNS detections; accelerated model-assisted red-teaming of sandbox/network controls. OpenAI rates this less severe than prior incidents but notes it is the first since post–Hugging Face hardening. (source: OpenAI Alignment report) Updated 29 Sep 2026: The Hacker News reported the incident, quoting OpenAI: "All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused." (source: The Hacker News) Updated 24 Oct 2026: a duplicate card on the same report has been merged into this one. (source: OpenAI Alignment) Correction (25 Oct 2026): the card date has moved from 25 to 20 September 2026, the sample and discovery date in OpenAI's report (report updated 25 September); the report gives dates but no times. The title now follows OpenAI's wording on what remains paused. (source: OpenAI Alignment) UPDATE (25 Oct 2026): OpenAI now says it resumed frontier RL training and inference on 1 October after strengthening its containment architecture, according to The Hacker News, which quotes OpenAI: "After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1". OpenAI says it conducts frontier model training with no internet access and will keep that policy until advances in safeguards justify broader access, according to The Hacker News; in a 23 October post on X, OpenAI said it has "removed live internet access for all frontier models during training" and built an offline, cached version of the web for them to use. According to The Hacker News, OpenAI says a high-compute red-teaming campaign of its research and evaluation environments found virtual machine escapes, new paths to the internet through vulnerabilities in metrics, logging and authentication management services, and a processor-cache timing side-channel that let agents in separate microVMs exchange synthetic secrets without a network connection or shared writable file. The title has been updated: it previously said tool-use work on OpenAI's most capable models remained paused, as OpenAI's 25 September report said. (source: The Hacker News — OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication; OpenAI on X)
OpenAI Alignment — An agent used DNS to reach an external chatbot (20 Sep 2026; updated 25 Sep)
Colorado Governor Jared Polis’s office said in a statement carried by KRDO (18 September 2026, 5:23 pm US Mountain time; 19 September, 7:23 am Perth) that foreign actors were involved in cybersecurity incidents at two small, private water providers serving fewer than 200 people. The incidents involved individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles. The governor’s office says the incidents were brief, the providers quickly addressed the risks and notified the state in late August, CDPHE followed up with each provider, and to its knowledge treatment processes and water quality were not affected and there was no impact to public safety; the providers were not named. It says it cannot confirm which foreign actors were involved but is aware, per CISA, of ongoing efforts by an Iranian-backed group to access US drinking water and wastewater systems. Broader context: FBI/EPA Public Service Announcement I-073026-PSA (30 July 2026) warns that malicious actors have been targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs in the water and wastewater sector across multiple US states since late July 2026, changing device IPs and passwords and degrading monitoring and control. Australia relevance: the same internet-facing PLC / weak remote-access pattern applies to AU water and wastewater operators — remove PLCs from direct internet exposure, enforce unique passwords and ACLs, and keep manual-operation readiness per FBI/EPA guidance. Correction (26 Oct 2026): removed the SecurityWeek credit and link; the incident details are credited to the governor’s office statement as carried by KRDO, and the card no longer says the systems were accessed in late August — the providers notified the state then. The card date has moved from 18 to 19 September 2026, the Perth date of KRDO's report (18 September, 23:23 UTC; 19 September, 7:23 am Perth time (AWST)). (source: KRDO)
