Trend Micro Zero Day Initiative advisory ZDI-26-708 / ZDI-CAN-29849 (published 16 September 2026; CVSS 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) documents an unpatched Microsoft Windows privilege-escalation issue in HTTP proxy authentication handling. A low-privileged local attacker who can change the user proxy setting to an attacker-controlled server can coerce NTLM authentication in the machine-account context (commonly via Network Connectivity Status Indicator / WinHTTP connectivity checks running as NETWORK SERVICE). Microsoft acknowledged the report (May 2026), initially indicated a September fix, then on 31 August 2026 said the issue did not meet the Windows security servicing bar; ZDI published as a 0-day on 16 Sep. No CVE assigned. ITRESIT Labs (28 Sep) describes a pentest chain using the coercion into AD CS Web Enrollment relay when EPA/HTTPS are not enforced — that chain is environmental, not part of ZDI’s scored impact. (sources: ZDI-26-708; ITRESIT)
ZDI-26-708 — Microsoft Windows HTTP Proxy Privilege Escalation (0-day, 16 Sep 2026)
Varonis Threat Labs (Elad Ghvarh; blog 16 September 2026) documents TrustSink: a post-compromise technique that registers a rogue External Authentication Method (EAM) so the provider-controlled MFA step shows a pixel-accurate Microsoft-style password page and captures plaintext passwords (with timestamp and source IP) while returning a valid signed token so Entra still treats MFA as satisfied. Builds on the EAM trust boundary Dirk-jan Mollema highlighted (x33fcon 2025 “Bringing Your Own Identity”). Requires Global Administrator or Authentication Policy Administrator to change Authentication Methods Policy / app / service principal / consent — not an unauthenticated phishing kit. Password reset alone does not remove the rogue provider; it keeps capturing replacements on the next sign-in. Demo used a minimal FastAPI OIDC provider; real attackers need a public HTTPS endpoint. Defenders: audit EAMs and unexpected authentication-method policy changes before mass resets; remove rogue providers first. (sources: Varonis; Microsoft Entra external method providers; BleepingComputer)
oss-security disclosure by Hyunwoo Kim (17 September 2026; embargo lift) and CVE published 16 September 2026: CVE-2026-89775 is a guest-to-host escape in KVM/arm64 when nested virtualization is enabled. Type truncation of the stage-1 walk level can make VNCR pseudo-TLB size computation return 0 (“size unknown”); invalidation treats that as an empty range and skips, leaving a freed host page mapped writable so a malicious guest gets 64-bit R/W without trap/VM-exit. Introduced mainline 7270cc9157f47 (14 May 2025); fixed 8053393680d4 (6 Aug 2026). Red Hat rates Important, CVSS 3.1 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). On hosts with nested virt and world-writable /dev/kvm (e.g. some RHEL configs), also a local root LPE path. (sources: oss-security; Red Hat CVE page)
Veeam KB4852 documents CVE-2026-32996, a local privilege escalation in Veeam Agent for Microsoft Windows: a low-privileged local user can obtain SYSTEM by abusing elevated session UIDs cached against a client-controlled session UID on the local gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe (UIDs readable from C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log). Vendor CVSS 4.0 score 7.3 High (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). KB4852 says the flaws it lists affect Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds. Fixed starting with Veeam Backup & Replication 13.0.2.29; Veeam's Agent for Windows fix list (KB3108) shows CVE-2026-32996 fixed in Agent build 13.0.3.1220. Arctic Wolf warned of active exploitation after a public proof-of-concept (PoC) exploit was posted on GitHub, as reported by The Hacker News (22 September 2026) — prioritise shared workstations, admin endpoints, and multi-user hosts. Same KB also ships CVE-2026-32997 (Backup Administrator arbitrary file write on Linux Veeam Software Appliance; CVSS 4.0 8.6) fixed in the same 13.0.2.29 build. (sources: Veeam KB4852; Veeam KB3108; Arctic Wolf via The Hacker News) Correction (24 Oct 2026): KB4852 gives the affected range as Veeam Backup & Replication 13.0.1.2067 and earlier version 13 builds, not Agent builds; the fixed Agent build 13.0.3.1220 is now sourced to Veeam KB3108 because the Arctic Wolf post no longer loads. (source: Veeam KB4852)
Dexus (ASX: DXS) ASX release (16 September 2026) confirms Australian Data Centres (ADC; Dexus 85% interest) holds a 25% interest in a consortium with Zerra DC and Macquarie Capital developing a hyperscale data-centre campus in Queensland’s Western Downs region for an Australian subsidiary of Anthropic. The consortium has entered lease documentation for delivery of the first stage, subject to customary approvals (incl. Dexus board for ADC funding obligations). ADC is raising capital for additional partners; Dexus has not decided whether to participate. Developer Zerra DC's project page lists up to 1.44 GW of proposed IT capacity across four stages, anchored by a long-term lease commitment from Anthropic, with the development application under assessment. ABC News (16 Sep) reports the facility will be built near Dalby, that Anthropic aims to start using it in 2027, that the ABC understands Anthropic would use it to power Claude to answer user questions rather than to train models, and that the lease is subject to Foreign Investment Review Board approval; Queensland Premier David Crisafulli said the deal was a direct result of his recent trade mission to the US. (sources: Dexus ASX/EQS release; Zerra DC; ABC News) Correction (26 Oct 2026): removed details credited to Reuters and iTnews that no readable source supports (a 2.16 GW campus about 250 km from Brisbane, cooling and power-purchase details, and a confirmation 'in state parliament'); the capacity now comes from developer Zerra DC's page and the timing, use and approval details from ABC News. (source: ABC News)
Dexus ASX/EQS — Australian Data Centres / Western Downs Digital Park (16 Sep 2026)
Zscaler ThreatLabz (blog 16 September 2026; The Hacker News report 18 September) tracks Pakistan-nexus APT36 (Transparent Tribe / Earth Karkaddan) activity in August 2026 as Operation RapidRust against government and defence entities in India and Afghanistan. New tooling: RUSTYSHADE — 64-bit Windows Rust backdoor using attacker-controlled private GitHub repos via REST API for C2 (hardcoded PAT; AES-256-GCM with key from SHA256(PAT)); RUSTYMOVE — post-compromise copier that stages malware onto removable media to reach air-gapped networks; PSNATCH — PowerShell file stealer exfiltrating matched extensions to private GitHub; BASHNATCH — bash analogue for Linux. Delivery includes typosquatted Indian news domains staging PowerShell; sample post-compromise wget of DriverInstaller.zip from Backblaze B2. Related to earlier GOGITTER/GITSHELLPAD GitHub-C2 tradecraft but Rust + encrypted C2. (source: Zscaler ThreatLabz)
Check Point advisory sk1000155 (disclosed 16 September 2026; NVD published same day) documents CVE-2026-91843, a stack overflow (CWE-121) in the unauthenticated login process on Security Management and Log Servers. Check Point CVSS 3.1 base 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker without credentials can run arbitrary code as root over the network; Check Point states the vulnerable path runs through the Trusted Clients setting (hosts allowed to connect via SmartConsole). Vendor and CISA SSVC: no indication of in-the-wild exploitation; not in KEV as of mid-September catalog checks. Affected branches by Jumbo Hotfix Take (or older): R82.20 (apply Take 29+), R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below; R81.10/R81/R80.x End of Support (ticket Check Point for fix or upgrade). Standalone, Log Server, and Multi-Domain deployments also vulnerable per vendor confirmation (THN update 18 Sep). Smart-1 Cloud hosted management is not affected (fix already deployed). Remediation: LivePatch per sk1000155; customers with automatic updates (sk175504) already protected. (sources: Check Point sk1000155; NVD)
Check Point sk1000155 — CVE-2026-91843 Security Management/Log Server (16 Sep 2026)
Zimperium zLabs (16 September 2026) details RatHat, an Android malware strain they link to China-operating actors. Distribution is primarily smishing and malvertising to third-party APK portals (outside Google Play). Once installed it abuses Accessibility permissions, enables Developer Options / Wireless Debugging for local ADB self-pairing, and stages native Go agents (liblocal-service.so persistence/keylogging; libmedia_codec.so FRP reverse-proxy tunnel) with shell-level privileges and mutual self-restore if either component is removed. Credential theft: banking/crypto HTML overlays, SMS/OTP interception, browser URL capture, and hardware-level reconstruction of lock-screen PIN/password/pattern from touch input. Distinctive: an AI UI-automation engine serialises the live Accessibility tree to XML and queries a generative AI assistant (unnamed in the Zimperium report; prompts observed in Chinese) for element coordinates, on-screen text, and navigation actions (e.g. SCROLL_DOWN), making automation more adaptable than fixed scripts. Anti-removal: intercepts uninstall confirmation and shows a fake Google Play error overlay; anti-analysis includes bloated manifest and invalid DEX tricks. UPDATE (Cleafy TIR “From BlackCat to Panda Workshop”; The Hacker News 28 Sep 2026): implant stayed largely static late-2025→Sep 2026 while the C2 panel was replaced — Fisher → BlackCat Remote Control Management (Apr 2026) → Panda Workshop V5 → hardened Panda Workshop V6 (Gemini-only AI config; obfuscated; phishing download-page host). Panel is a malware factory (build/sign/publish; scheduled rebuilds for hash evasion; S3/CloudFront or BaoTa publish). ~100 deployments since April 2026 (Europe, LATAM, SE Asia) consistent with MaaS. Gemini used on both sides: on-device UI navigation when automation fails, and panel-side SMS analysis to estimate victim bank balances and prioritise high-value phones — not to move money in analysed samples.
The Hacker News (16 September 2026), citing ANY.RUN threat-intelligence material, describes N0va — a phishing kit targeting organisations in North America and Europe across government, technology, consulting, healthcare and related sectors. Campaigns impersonate trusted services and abuse legitimate authentication flows so successful hits yield valid account access without obvious malware. ANY.RUN publishes a characteristic URL pattern for TI Lookup: /api/verification/init?session=*&flow=*prompt_profile=. Impact once an identity is taken includes payment fraud, data exposure, and lateral move into cloud apps depending on the user’s privileges. Australian operators: watch for lookalike SSO / MFA-prompt pages and enforce phishing-resistant MFA where possible.
CVE-2026-65388 (GHSA-mx96-5vvg-x2mg; Apple/containerization Swift package) covers RegistryClient following the WWW-Authenticate realm without validating host or scheme. A remote attacker who controls a container registry can redirect the client’s token request to an attacker-chosen host and disclose the victim’s registry credentials. GitHub advisory severity Moderate; published on the advisory 30 August 2026; Tenable/NVD indexing lists CVE published ~16 September 2026 with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). GHSA lists affected versions ≤ 0.41.0 and patched versions > 0.41.0; Tenable text says the issue is addressed in containerization 0.41.0 — confirm the exact fixed build against GHSA before closing. No public exploitation claim on the Tenable/GHSA material reviewed this pass. Australia relevance: Apple container tooling / Mac container workflows pulling from untrusted registries.
CISA said in a notice on 16 September 2026 that on 28 September it would discontinue the weekly Vulnerability Bulletin as part of its shift from severity-based vulnerability management to a risk-based approach. CISA said the change aligns with Binding Operational Directive (BOD) 26-04, which directs federal agencies to prioritise vulnerabilities based on real-world risk factors, including evidence of exploitation and exposure, rather than severity scores alone. CISA will continue to provide risk-focused vulnerability information through the Known Exploited Vulnerabilities (KEV) catalog, CISA cybersecurity alerts and advisories, and CVE, and encourages organisations to consult vendor and provider advisories directly. Practical takeaway for AU SOCs that mirrored the bulletin: shift intake to KEV plus vendor PSIRTs and ASD-ACSC alerts. (source: CISA bulletin notice (GovDelivery)) Correction (25 Oct 2026): CISA's own notice of 16 September 2026 said it would discontinue the weekly Vulnerability Bulletin on 28 September 2026, so when SecurityWeek reported on 17 September the change had been announced but had not yet taken effect. The notice names the KEV catalog, CISA cybersecurity alerts and advisories, and CVE as the continuing sources. The earlier note that no CISA page could be found has been removed. (source: CISA bulletin notice (GovDelivery)) Correction (31 Oct 2026): replaced SecurityWeek, which this desk cannot read, with CISA's own notice as the card's source and moved the card date from 17 to 16 September 2026, the notice's date. (source: CISA bulletin notice (GovDelivery))
CISA — CISA to Sunset Weekly Vulnerability Bulletin on September 28, 2026 (16 Sep 2026)
NLnet Labs advisory dated 16 September 2026 (covered by The Hacker News 17 Sep) assigns CVE-2026-81642 to a Critical heap overflow in Unbound’s DNSSEC validator when digesting a DNSKEY whose owner name is a compression pointer into its own RDATA. An attacker who controls a malicious zone and queries a vulnerable resolver can cause denial of service and possible remote code execution through attacker-controlled data. NLnet Labs rates Critical with maintainer CVSS 9.1 (CVSS:4.0 network/no privileges/no UI; NVD still awaiting analysis per THN). Affected: Unbound up to and including 1.26.0 (includes 1.25.2 and 1.26.0). Fixed: Unbound 1.26.1 (source + Windows binaries) or apply NLnet Labs patches (minimal or complete for CVE-2026-81642; combined patch covers nine CVEs in the release, including high CVE-2026-82717 CNAME-synthesis heap corruption). NLnet Labs reports no known exploitation; CISA exploitation “none” on disclosure day per THN. (sources: NLnet Labs CVE-2026-81642.txt; THN)
