CrowdStrike Counter Adversary Operations (blog 15 September 2026; THN report 18 September) details PhantomRaven, a JavaScript information stealer distributed via typosquatted npm packages that use remote dynamic dependencies (HTTP URL deps + preinstall) to fetch the payload. High-confidence assessment that the code was LLM-generated (verbose redundant comments, placeholder WebSocket URL wss://yourserver.com/socket, statistical token patterns). Operator profiled as a self-described bug bounty hunter active since November 2022 (Bugcrowd/Intigriti/YesWeHack/HackenProof/HackerOne claims); CrowdStrike has not seen PhantomRaven logs on stealer shops and assesses stolen CI/CD and developer data is used to find bounty opportunities rather than sell logs. Harvests OS/host/IP, Git/npm emails, and CI/CD env vars (GitHub Actions, GitLab CI, Jenkins, CircleCI). Example packages cited: transform-jsbi-to-bigint, sort-imports-es6-autofix; C2 domains include npm.jpartifacts.com and related *.storeartifact.com / *.storageartifact.com. Mitigations: private npm registry, npm --ignore-scripts / install-scripts controls, upgrade npm (v12+ blocks dependency install scripts by default). (source: CrowdStrike blog)
Docker security announcements (Sandboxes 0.42.0; NVD received CVE-2026-77179 on 15 September 2026) document two sandbox-escape flaws. CVE-2026-77179 (Critical, Docker CVSS 4.0 base 9.4): on macOS the virtio-fs host server followed symlinks when reopening an unlinked file from a stored path, so malicious guest code (e.g. a compromised AI coding agent inside sbx) could escape the shared project workspace and read/modify arbitrary host files as the VMM user — potentially host code execution. Affects Sandboxes 0.28.0 up to but not including 0.42.0 on macOS. Companion CVE-2026-79994 (High, CVSS 4.0 8.7): guest-to-host Unix-domain socket relay TOCTOU symlink race; affects 0.37.0 up to but not including 0.42.0. Both fixed in 0.42.0 (release notes / sbx-releases tag). CISA's CVE-record enrichment lists exploitation as 'none', and neither CVE is in CISA's KEV catalog as of 27 October 2026. Workaround if unable to upgrade: use clone mode and avoid additional host mounts. Category vulnerabilities with AI-agent sandbox tag. (sources: Docker security announcements; NVD; GitHub sbx-releases v0.42.0) Correction (27 Oct 2026): the affected range for CVE-2026-79994 is now given as Docker states it, 0.37.0 up to but not including 0.42.0, rather than 'through 0.41.9'; a line saying Docker reports no exploitation was removed because Docker's announcement does not say so. (source: Docker security announcements; CVE.org)
JFrog (15 September 2026) documents ParaShells: an unprivileged local user on macOS can get root via Parallels Desktop's prl_disp_service (world-writable Unix socket, weak local-client auth, appliance-extract argument injection into tar --use-compress-program). Lab-proven on Desktop 26.4.0 build 57513 (Apple silicon); treat installs that still expose the same InstallAppliance extract template and dispatcher socket as in scope. CVE-2026-90894. Fixed in Parallels Desktop 27.0.0 (JFrog: fix shipped 1 Sep; CVE/blog 14–15 Sep). THN notes Intel Macs cannot install Desktop 27 — those hosts need interim local-account lockdown / vendor guidance. No in-the-wild exploitation reported by JFrog. (source: JFrog research blog)
Mozilla's advisory MFSA 2026-90 (announced 15 September 2026) lists 73 vulnerabilities fixed in Firefox 156, with an overall impact of high; Mozilla rates 27 of them high, 26 moderate and 20 low. Mozilla notes that it no longer rolls all internally identified memory-safety vulnerabilities into a single CVE and now issues an advisory entry for every individual bug. Entries include a use-after-free in Audio/Video: Web Codecs (CVE-2026-92005), privilege escalations due to incorrect boundary conditions in Graphics: CanvasWebGL (CVE-2026-92006 to CVE-2026-92013), a sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) and a sandbox escape in DOM: Core & HTML (CVE-2026-92018). Mozilla does not say any of them is being exploited in the wild. (source: Mozilla MFSA 2026-90)
Mozilla MFSA 2026-90 — Security Vulnerabilities fixed in Firefox 156 (15 Sep 2026)
Google’s September 2026 Pixel update (patch level 2026-09-05) addresses CVE-2026-58704 in the Cellular Modem: improper authorization / logic error enabling remote (proximal/adjacent) privilege escalation with low privileges, no user interaction. NVD (published 15 September 2026; Google as source) scores CVSS 3.1 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). BleepingComputer (16 September 2026) cites Google’s Pixel bulletin warning of indications the flaw “may be under limited, targeted exploitation.” Same bulletin set covers 110 Pixel issues including additional critical/high RCE and privilege-escalation fixes. Apply Pixel Security update to 2026-09-05+. (sources: NVD CVE-2026-58704; BleepingComputer) UPDATE (26 Oct 2026): CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog on 16 September 2026, with a 19 September due date for US federal agencies. The CVE record now also carries a CISA score of 8.8 (CVSS 3.1, no privileges required). (source: CISA KEV catalog; CVE record)
Google's Stable Channel Update for Desktop (15 September 2026) promotes Chrome to 153.0.8010.47/.48 on Windows and Mac and 153.0.8010.47 on Linux, with 42 security fixes. Google rates three Critical: an out-of-bounds read in WebGL (CVE-2026-91726) and use-after-free flaws in Internals (CVE-2026-91721) and Workers (CVE-2026-91749). It rates 28 High, including use-after-free, race-condition and type-confusion flaws in components such as V8, Skia, ServiceWorker, Extensions and Core, plus ten Medium and one Low. Google's post does not say any of the flaws is being exploited in the wild. (source: Chrome Releases) Correction (29 Oct 2026): this card previously covered both Chrome 153 and Firefox 156; Firefox 156 now has its own card, and a combined defect count from a news report that is no longer linked here was removed. (source: Chrome Releases)
Australian dealer management software maker Auto-IT says a “small number of Auto-IT customer environments” were impacted by an unauthorised external party, according to Cyber Daily (15 September 2026). Cyber Daily reports that Auto-IT is the third-party IT supplier several car dealers had pointed to as the source of their compromise. Storm claimed the attacks, according to Cyber Daily. (source: Cyber Daily) Correction (30 Oct 2026): removed material from the login-only part of Cyber Daily's report and removed Webber Insurance's data-breaches list as a source; the card now carries only what the readable part of Cyber Daily's report states. (source: Cyber Daily)
Apple Security Engineering and Architecture (SEAR) with Camera & Photos (blog 15 September 2026) introduce Apple Reference Image, an opt-in camera mode that creates a securely timestamped reference image reflecting what the iPhone camera sensor captured, aimed at distinguishing real photographs from AI-generated or heavily altered images. Apple contrasts the approach with C2PA-style post-capture provenance metadata, arguing those chains can be compromised in editing and can create privacy risks by tying images to device or personal identity. The mode debuts on the main camera sensor of iPhone 18 Pro and iPhone 18 Pro Max, using dedicated secure hardware on device and Private Cloud Compute for verifiable algorithmic steps without Apple seeing the image content. (source: Apple Security Research blog)
Apple Security Research — Apple Reference Image (15 Sep 2026)
Accomplish / Boundary-Bench researchers (public write-up dated 15 September 2026) disclosed two escapes from the OpenAI Codex agent sandbox, reported to OpenAI on 12 August 2026 and fixed within eight days. Overpatch (Codex CLI, open-source harness): the apply_patch tool grants write access to the parent of each path named in a patch; including a no-op path under /tmp widens the grant to /, so a crafted patch can append to ~/.zshrc (via symlink) without an approval prompt in normal agent/workspace-write mode, then run unsandboxed on the next shell. Heapjack (Codex Desktop): install writes an [mcp_servers.node_repl] block into ~/.codex/config.toml (no opt-out), spawning a Node REPL with trusted and untrusted V8 contexts sharing one heap; the trusted-context token was readable from the shared heap, enabling unsandboxed command execution even from read-only mode. (source: Accomplish blog) Operators running Codex CLI/Desktop should ensure they are on post-fix builds from OpenAI after mid-August 2026.
Zimperium (blog; reported by BleepingComputer 15 September 2026) documents Mantax Otax, an Android strain combining ransomware, spyware, remote control, and harassment. Distributed as sideloaded APKs off Google Play via phishing/social engineering (Indonesian operators). After install it seeks Accessibility (and device-admin in analysed samples), resolves C2 from GitHub (domain cited as apimantax[.]otax[.]fun), registers device telemetry, and takes commands over Firebase/WebSockets. Ransomware module: victim-specific AES key from C2, encrypts shared-storage files on Android 9 and older (Scoped Storage limits impact on Android 10+), deletes originals, .enc extension, ransom UI via Firebase-hosted chat. Spyware: lock-screen PIN, SMS/OTP, calls, contacts, browsing history, Google account, location, WhatsApp/Telegram via Accessibility, MediaProjection screen capture/stream, camera stills. v2 adds jumpscare overlays and remote TTS harassment. Play Protect detects current samples via App Defense Alliance partnership. (sources: Zimperium; BleepingComputer)
Zimperium — Mantax Otax Indonesian mobile ransomware/spyware
Acronis security advisory SEC-10986 / update UPD-2609-3d72-20a7 (reported by BleepingComputer 15 September 2026) covers CVE-2026-87886, a high-severity Linux local privilege escalation in Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Acronis assigns severity 7.8. A low-privileged attacker can raise privileges on a vulnerable Linux host without user interaction; further exploit detail withheld while patches propagate. Acronis says exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM plugin deployments (assessment based on a single report from a potentially affected customer; no public IoCs released). Affected: cPanel & WHM plugin builds earlier than 1.9.3.1021 (fixed 1.9.3 HF3); Plesk extension builds earlier than 1.8.11.638 (fixed 1.8.11). Apply those updates immediately. (sources: Acronis SEC-10986; BleepingComputer) UPDATE 16 September 2026: CISA added CVE-2026-87886 to KEV (same alert as Cisco ISE CVE-2026-76460).
Developer Janis Elsts's incident notice for Admin Menu Editor Pro (published 14 September 2026, last updated 20 October) says a malicious admin-menu-editor-pro.zip was uploaded to adminmenueditor.com on 14 September 2026 and showed up as a version 2.35 update; it included a new file, includes/wp-user-consent.php, that installs a web shell. A clean 2.36 was released the same day, but later on 14 September 2.36 was also compromised; the developer says the attacker may have had root-level access to the server, which he took offline. He says anyone who installed 2.35 should treat the site as compromised and anyone who installed 2.36 as potentially compromised, particularly if downloaded after 19:00 UTC; 2.34 should be clean. He estimated that about 230 customers were affected in the initial compromise, often with multiple sites each, and identified about 300 more potentially affected customers from downloads in or near the window. Signs he lists from user reports: a new /wp-content/object-cache directory holding a hex-named web shell, wp_ocache or _wp_ocache_ options, a hidden user named wp_ followed by hex characters, hex-named MU-plugins and a _wp_cconsent_tick WP-Cron event. He advises restoring from a backup made before 14 September, or deleting the plugin and those artefacts, then changing all WordPress passwords, regenerating keys and salts and rotating other credentials stored on the site. According to BleepingComputer (15 September), Elsts said 2.35 was available from about 06:00 to 13:00 UTC, its code also created a hidden user account, the malicious build was installed on at least 1,500 sites, and the free Admin Menu Editor does not appear to be affected. Updated 25 Oct 2026: the developer says the update server has been rebuilt, downloads, licence activation and renewals are working again, and version 2.37.1 (based on the last known safe version, 2.34) adds optional checksum and signature verification for plugin updates. (source: BleepingComputer) Correction (25 Oct 2026): the card now leads with the developer's incident notice, which says 2.36 was also compromised and gives about 230 customers in the initial compromise plus about 300 more potentially affected; the 06:00–13:00 UTC window, the 1,500-site count and the free-edition note are credited to BleepingComputer. (source: Admin Menu Editor Pro developer incident notice)
Admin Menu Editor Pro — Security Incident Affecting Customers 2026-09-14 (developer notice; last updated 20 Oct 2026)
