Linux Kernel Out-of-Bounds Write Vulnerability. Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Linux Kernel Race Condition Vulnerability. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
The Hacker News (18 September 2026), citing OpenSourceMalware / Paul McCarty, reports a cluster of 13 npm packages delivering WeaselBiscuit, a previously undocumented JavaScript stealer. Triggered on npm import (not a full RAT): resolves C2 from an Npoint URL, profiles the host, and harvests Chrome extension storage across Windows, macOS, and Linux — financially relevant for wallet-extension state and other extension-held secrets, without the crypto-drainer / InvisibleFerret secondary-payload features of BeaverTail-class tooling. Researchers note meaningful overlap with DPRK Contagious Interview / BeaverTail tooling but state there is no definitive operator-infrastructure or victimology attribution to WaterPlum/DPRK yet — keep distinct from the ACSC WaterPlum joint advisory already on Cyberstack. Developers: audit unexpected npm deps; revoke compromised extension sessions; align with Contagious Interview interview-tool hygiene.
ASD’s ACSC (18 September 2026) republishes a joint advisory with Japan’s NPA/NCO, US FBI and DC3, and Germany’s BND/BfV on the North Korean “WaterPlum” cyber actor group (commonly Contagious Interview). Actors pose as employers (often fake AI, cryptocurrency, or NFT companies / recruiters) to target software developers and IT professionals, then deliver loaders leading to RATs and infostealers including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle variants. Advisory cites ≥30,000 infected devices in 100+ countries and credentials/funds stolen from >7,000 cryptocurrency wallets; ~¥1.7 billion JPY (~USD 10.71M) in crypto assessed transferred to DPRK. WaterPlum actors and some DPRK IT workers assessed under the 313 General Bureau (Munitions Industry Department). Japan dismantled a domestic “laptop farm” enabler; FBI continues US facilitation prosecutions. Audience: IT professionals and organisations that outsource/crowdsource development. No CVE. (source: ACSC advisory page)
WordPress 7.1.1 (17 September 2026) fixes an unauthenticated stored XSS in core wpautop() that Patchstack tracks as CVE-2026-93485 (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and industry coverage dubs Comment2Shell. An anonymous visitor submits a comment with a line break inside an allowed HTML attribute; comment sanitisation (wp_kses) accepts it, then display-time reformatting turns the payload into a live event handler. When a logged-in administrator later opens the page, the script runs in their browser session and can upload a malicious plugin (web shell) — server RCE requires that admin session and a theme that renders comments in the vulnerable path (block themes / compatible classic themes). WordPress wording: exploitable “subject to comment approval”; Patchstack notes moderation is not a security control (default first-comment hold can be bypassed). No in-the-wild exploitation claimed; not on CISA KEV. Affected: WordPress 4.7 through 7.1 before the 17 Sep security builds. Fixed: 7.1.1, 7.0.5, 6.9.8, and matching backports through 4.7.36. (sources: WordPress 7.1.1 release; Patchstack analysis)
The crates.io team and Rust security response working group (blog.rust-lang.org; 17 September 2026) warn of an ongoing social-engineering campaign against rust-lang members and owners of popular crates aimed at compromising developer devices and accounts to publish malware. Lure: positive-sounding video calls (job / project / contract), then pressure to install a “missing audio codec” or run a clipboard-pasted command. Attackers stand up new but plausible company profiles including LinkedIn pages to pass cursory checks. Linked prior activity: similar targeting of prominent Rust developers in June 2026, and the brief August 2026 compromise of the arrayref crate via similar attacks (SecurityWeek previously tied arrayref to North Korean operators). The project notes the style is known DPRK tradecraft and has been seen outside the Rust community, without naming a specific actor for the current wave. Guidance: be suspicious of cold outreach; prefer calls on platforms you already trust (ideally self-scheduled); re-check MFA and unexpected logins; contact help@crates.io / security@rust-lang.org if concerned. (source: SecurityWeek) No CVE.
Rust Blog — Be alert: targeted attacks on prominent Rustaceans (17 Sep 2026)
GuidePoint Security (blog 17 September 2026; Cyber Security News report 21 September) documents a multi-month EtherHiding campaign on Polygon: at least 31 compromised legitimate websites and 15 smart contracts underpin C2 rotation so operators change backends with a low-cost chain transaction without updating earlier stages. Victims hit via Google/Bing land on injected fake-CAPTCHA ClickFix overlays (Windows+R → paste → Enter); a scheduled task named Enter retrieves next-stage scripts, Registry reboot persistence is set, and a script queries Polygon for the active control server. The backdoor later installs a fake browser extension that intercepts credentials and two-factor codes from roughly 479 financial and cryptocurrency sites. (source: GuidePoint Security)
Checkmarx Zero (report dated 17 September 2026) documents an ongoing npm malware campaign: package indexed-btree typosquats/mimics the legitimate sorted-btree B-tree library and does not use preinstall/install/postinstall lifecycle scripts. Instead a loader in BTree.prototype.set() fires at runtime when called with a specific key (key == 100), spawning obfuscated sharedLoad.min.js. Stage-1 fingerprints the host (arch, hostname, CPU/memory/uptime) and exfiltrates via hardcoded Slack and Telegram channels; C2 uses a Sepolia-testnet smart contract with X25519 ECDH → AES to decrypt a second-stage payload, plus self-clean capability. Checkmarx notes ~2 million weekly downloads and an attacker wallet holding ~109 ETH (does not claim those funds are from theft). Sidesteps npm v12 lifecycle-script approval controls that defenders may treat as a clean install signal. No CVE assigned in the source write-up. Developers: remove indexed-btree, pin/verify sorted-btree from the legitimate maintainer, audit lockfiles for unexpected btree deps, rotate any secrets on hosts that imported the package.
SolarWinds Trust Center advisory CVE-2026-28326 (first published 17 September 2026) documents an unauthenticated remote code execution flaw in Access Rights Manager (ARM) stemming from a hard-coded static key. CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent network). Affected: ARM 2026.2 and all previous versions. Fixed: ARM 2026.2.1. Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. The Hacker News (19 Sep) also notes earlier July WHD SAML bypass CVE-2026-28323 (9.8; fix WHD 2026.2.1) and Serv-U fixes — those are separate advisories; this card is ARM only. (source: SolarWinds Trust Center)
SolarWinds — CVE-2026-28326 ARM unauthenticated RCE (17 Sep 2026)
CrowdSec statement (17 September 2026; informed 16 Sep) confirms a May 2026 leak of its private GitHub repositories (SaaS console, AWS cloud routines, connectors, automations). Public Security Engine repos are out of scope by design. CrowdSec says reports of ~300 repositories are accurate when 130+ intentionally public repos are included, and that the figure reflects code subdivision rather than 300 separate sensitive systems. Company assessment: TanStack npm supply-chain compromise (CVE-2026-45321; TanStack postmortem 11 May 2026 — 84 malicious versions across 42 @tanstack/* packages) is the very likely vector, similar to Mistral AI’s related case; a backdoored component appears to have extracted a CI/CD API key with read access to the private codebase during a short May window. CrowdSec says no client data, login/password, name, organisation, or PII/client logs were leaked; hunting for lateral-movement credentials found none so far; tokens/credentials rotated after confirmation. Thanks Fuites Infos for disclosure. The Hacker News (19 Sep) summarises later CrowdSec reporting: about 170 private repositories were copied on 22 May via a former employee's GitHub OAuth token, and the archive held 83 user emails and investor details. (sources: The Hacker News; CrowdSec; TanStack postmortem for CVE-2026-45321) Updated 19 Sep 2026 (The Hacker News): The Hacker News's report is dated 19 September 2026; details credited to The Hacker News on this card come from that report.
CrowdSec — Source Code Exposure in May 2026 (17 Sep 2026)
WordPress 7.1.1 maintenance and security release (17 September 2026) fixes a core flaw pwn.ai calls Click2Shell: a specially crafted theme-preview / theme-install URL, when opened by a logged-in administrator, can automatically install an attacker-selected theme from the official WordPress.org catalog without the admin clicking Install (release wording: “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”). Root cause is divergent interpretation of the theme value — WordPress.org Themes API canonicalises it to a real slug, while wp-admin JavaScript reuses the original punctuation inside a jQuery selector and triggers Install. On its own the core bug only installs a real catalog theme (site appearance unchanged while inactive). pwn.ai demonstrated chaining with a separate unprotected AJAX installer in the then-current Mobile Repair Zone 2.5.4 catalog theme (and noted similar patterns in 40+ third-party themes): Customizer preview loads inactive-theme PHP, then an unauthenticated AJAX handler fetches and runs attacker-supplied package code. Researcher severity: CVSS 3.1 7.1 (forced-install alone, High) and CVSS 3.1 9.3 (full chain with UI:R). No CVE assigned at disclosure (WordPress indicated one forthcoming); no in-the-wild exploitation claimed. Fix: WordPress 7.1.1 (security fixes also backported through supported older branches to 4.7). (sources: WordPress 7.1.1 release; pwn.ai)
WordPress — 7.1.1 maintenance and security release (17 Sep 2026)
Microsoft Security Update Guide lists CVE-2026-85885 (NVD published 17 September 2026): command injection (CWE-77) in M365 Copilot allowing an authorized (low-privilege) attacker to elevate privileges over the network. Microsoft CVSS 3.1 base 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). NVD cveTags: exclusively-hosted-service — same September 2026 MSRC cloud-transparency release train as cards cve-2026-85887 (Copilot info disclosure 7.7) and cve-2026-85889 (Azure AI Foundry). Expect Microsoft’s hosted-service pattern: CVE published for transparency with mitigation already applied in the service (confirm on MSRC for customer action). Distinct CVE from 85887. (sources: MSRC; NVD)
