Joint advisory published 15 September 2026 by the UK NCSC, US FBI, and Netherlands AIVD details Windows malware the FBI calls HEAVYGRAM and NCSC calls CHOSEN BRICK, attributed to Iran's Ministry of Intelligence and Security (MOIS). Operators build rapport on messaging apps, then deliver trojanised installers (lures include Pictory, KeePass, Telegram, RunwayML, Norton, Adobe Flash, and MRI-scan themed files), often starting on work devices before pivoting to personal ones. Malware is controlled via Telegram and can copy emails/chat messages, take screenshots, and activate the microphone; NCSC dates use from at least 2025 against people in the UK, US, Netherlands and elsewhere (FBI dates the wider campaign to autumn 2023). Victim details have appeared on pro-Iranian leak sites, raising personal-safety risk. FBI IC3 CSAs (260915 / 260915-2) expand a March 2026 alert with further TTPs and IoCs. (sources: NCSC advisory; FBI/IC3; The Hacker News)
BleepingComputer (15 September 2026) relays Wordfence/Defiant telemetry that attackers are actively exploiting CVE-2026-27540 in the premium WooCommerce Wholesale Lead Capture WordPress plugin. Unauthenticated AJAX action wwlc_file_upload_handler accepts a user-controlled file_settings allowlist, letting attackers permit .php uploads and drop webshells (researcher: Teemu Saarentaus). Affected: versions 2.0.3.1 and older; fixed in 2.0.3.2 (released 20 February). Wordfence reports 100,000+ blocked attacks with spikes around 4–17 June, 1 July, and 30 August 2026; The Hacker News (16 September) cites CVSS 9.8 and lists recent attacker IPs (including 92.241.13.213, 31.59.129.150, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209 and IPv6 2a0f:85c1:840:5389::1). Hunt admin-ajax.php calls to wwlc_file_upload_handler, unexpected PHP under uploads (e.g. shell.php), and unknown admin accounts; upgrade to 2.0.3.2+. (source: BleepingComputer) UPDATE 17 Sep: CVSS + IoCs from THN/Wordfence. Correction (26 Oct 2026): the CVE record for CVE-2026-27540, published by Patchstack as the assigning authority, scores it 9.0 under CVSS 3.1 (attack complexity high); the 9.8 shown before is the figure The Hacker News cited. (source: CVE record CVE-2026-27540)
BleepingComputer — WooCommerce Wholesale Lead Capture CVE-2026-27540 (15 Sep 2026)
Lumen Black Lotus Labs (report titled “The Banana Stand…”, summarised by The Hacker News and BleepingComputer on 15 September 2026) documents BambooToken, a previously under-reported malware family active since at least February 2023, with activity seen through July 2026 against organisations in Asia and South America (mobile apps, legal/financial, software development). Operators abuse DLL sideloading via Tendyron OnKey-related binaries (OnKeyToken_KEB.dll) without evidence the vendor’s code-signing cert/build was compromised; later variants use MQTT brokers (including Cloudflare-routed paths) for C2 plugin load/stop and host control on Windows and, from late 2025, Linux. Initial access vector undetermined. Hunt for unexpected OnKey-related DLL sideloads, MQTT client beacons to unfamiliar brokers, and related IoCs in the Lumen write-up. (source: Lumen Black Lotus Labs)
Lumen Black Lotus Labs — The Banana Stand / BambooToken MQTT C2
WA Cyber Security Unit advisory 20260915001 (15 September 2026, TLP:CLEAR) highlights CVE-2026-69829, a Critical remote code execution flaw in Microsoft Windows Shell with CVSS 9.8. WASOC states successful exploitation could allow an unauthenticated attacker to execute arbitrary code and potentially fully compromise affected systems. Affected products/versions are as listed by Microsoft on the MSRC update-guide entry for CVE-2026-69829 (JS-rendered; versions not mirrored here beyond vendor listing). WASOC reports no exploitation observed on Western Australian Government networks at time of writing and recommends applying Microsoft’s fixes per normal patch timeframes. (sources: Microsoft MSRC CVE-2026-69829; WASOC 20260915001)
Microsoft MSRC — CVE-2026-69829 (Windows Shell RCE)
WA Cyber Security Unit advisory 20260915003 (15 September 2026, TLP:CLEAR) relays Canonical LXD updates for eight Critical issues (CVE-2026-66897, CVE-2026-66898, CVE-2026-63300, CVE-2026-63299, CVE-2026-63297, CVE-2026-63296, CVE-2026-63294, CVE-2026-62420), each listed at CVSS 9.9. Successful exploitation can let a remote attacker achieve root command execution on the LXD host. Affected lines per WASOC: LXD 6.x prior to 6.10; 5.21.x prior to 5.21.7; 5.0.x prior to 5.0.9; all versions prior to 4.0.13. Canonical GitHub advisory GHSA-q39m-8fx9-42fv (CVE-2026-66897 example) documents instance template path traversal to arbitrary host file write as root, with patched versions including 4.0.13, 5.0.9, 5.21.7, 6.9-ab8fad2, and 6.10; related LXD GHSAs cover further path-traversal / privilege issues in the same wave. WASOC reports no exploitation observed on Western Australian Government networks at time of writing. Patch to vendor-fixed LXD builds; review Canonical LXD security advisories for the full set. (sources: Canonical LXD GitHub Security Advisories; WASOC 20260915003)
BleepingComputer (15 September 2026) reports five alleged leaders of the Black Axe cybercrime syndicate — Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru — were extradited to the United States to face wire fraud and money-laundering charges. Prosecutors allege a South Africa-based internet fraud campaign (about 2011–2021; the defendants were arrested in South Africa in 2021 at the US request and extradited on 11 September 2026, per BleepingComputer) using romance and advance-fee scams, aliases, dating sites, and VoIP numbers to target US victims, including coercion via threats to publish sensitive photos. US Attorney’s Office for the District of New Jersey press release linked from the report: “Five Prominent Black Axe Members Extradited for Conspiring to Engage in Internet Scams and Money Laundering.” Law-enforcement action / charging story; not a fresh organisational data-breach notice. (sources: DOJ USAO-NJ PR; BleepingComputer) Correction (26 Oct 2026): the campaign was earlier described as Cape Town-based; BleepingComputer places it only in South Africa. (source: BleepingComputer)
DOJ USAO-NJ — Black Axe members extradited (15 Sep 2026)
Clover Health Investments Corp., a PPO and HMO organisation with a Medicare contract, says in a notification letter filed with South Carolina's Department of Consumer Affairs that on 4 July 2026 it determined it had experienced a cybersecurity incident involving unauthorised access to certain company applications and data. Its investigation found that between 3 and 4 July 2026 an unauthorised party gained access to credentials belonging to three non-managerial employees and used them to access company applications and data; Clover says it detected the incident on 4 July, ended the access within hours, engaged third-party cybersecurity experts and notified law enforcement. Certain data was accessed and acquired, and a review completed on 28 August 2026 identified personal information about the people being notified; the published letter template does not list the types of data. Clover says it is unaware of any attempted or actual misuse. The US Department of Health and Human Services breach portal lists Clover Health (Minnesota, health plan) with 138,677 individuals affected, submitted on 14 September 2026, as a hacking/IT incident involving a network server and other locations. (sources: Clover Health notification letter; HHS OCR breach portal) Correction (25 Oct 2026): the card now rests on Clover's notification letter and the HHS portal; a social-engineering description, a list of data types and a note about attribution from a press report we cannot verify have been removed. (source: HHS) Correction (25 Oct 2026): the card date has moved from 5 October to 14 September 2026, the breach report submission date the HHS portal lists; HHS gives a US date with no time. (source: HHS)
Clover Health — Notice of Data Security Event (consumer letter, South Carolina Department of Consumer Affairs, PDF)
St James’ Anglican School (Alkimos, Western Australia) published an incident update dated Monday 14 September 2026 (9:00am): it identified a cyber security incident involving unauthorised access to its computer systems, contained and secured systems, and is auditing. Personal information relating to members of the school community was involved; families were notified with protective steps. The school says it reported to ASD’s ACSC and the OAIC; investigation ongoing; no technical commentary. The West Australian (15 September) reported that student medical records, photos and bank details were stolen; Insurance Business (17 September), citing The West Australian, says the data belongs to current and former students dating back to 2015 and includes names, addresses, email addresses, phone numbers, bank account details, student medical records and photographs. The school’s public statement does not itemise the data. The school’s statement does not name a threat actor. UPDATE 1 Oct 2026: according to Cyber Daily (David Hollingworth), the ThreeAM ransomware group claimed responsibility for the attack in a 28 September post to its darknet leak site; a school spokesperson told Cyber Daily experts have not identified evidence that any school information has been published or released online, investigation and dark-web monitoring continue, learning undisrupted, ACSC and OAIC informed at first discovery. (sources: St James’ Anglican School; Cyber Daily; The West Australian; Insurance Business) Correction (25 Oct 2026): removed a quote from the ransomware group and a leak-site tracker reference; the group’s claim is now credited to Cyber Daily. (source: Cyber Daily) Correction (26 Oct 2026): the data categories are now attributed to The West Australian and Insurance Business, which are linked; a 'NewsWire' and DataBreaches.net credit and a breach-list reference that no linked source supported have been removed. (source: Insurance Business)
St James’ Anglican School — Incident Update (14 Sep 2026)
Apple security content for iOS/iPadOS 26.7 (support 149041, released 14 September 2026) and macOS Golden Gate 27 (149035) lists CVE-2026-86869 in ImageIO: out-of-bounds write addressed with improved bounds checking; Apple impact text on 26.7 is “Processing a maliciously crafted image may lead to unexpected app termination” (credits: Niels Hofmans, Meta Red Team X, Geonha Lee, Chris Bailey — Short Circuit). UPDATE 26 Sep 2026: ironPeak blog EX-ARRR publishes full technical disclosure — heap overflow in libAppleEXR.dylib / CompressedInterleave4 when decoding crafted OpenEXR; researcher states Apple triage classified the report as 0-click code execution via iMessage EXR image payload, with BlastDoor not decoding EXR and Spotlight/ImageIO thumbnailing providing the side-door reach; PAC/MIE still constrain reliable exploitation on modern Apple silicon. Reported May 2026; fixed across iOS/iPadOS/macOS 27 family builds as CVE-2026-86869 per researcher timeline. No CVSS from Apple. Patch: current iOS/iPadOS 26.7+ / macOS 27 (Golden Gate) / equivalent trains. (sources: Apple iOS 26.7 security content; ironPeak)
Apple — iOS 26.7 and iPadOS 26.7 security content (CVE-2026-86869 ImageIO, 14 Sep 2026)
JFrog Security Research (CVE published 14 September 2026; industry report 22 Sep) documents CVE-2026-90898 in MaximHQ Bifrost (open-source AI gateway / HTTP transport): with default governance.auth_config.is_enabled=false, an unauthenticated POST /api/mcp/client registering a stdio-type MCP client starts attacker-chosen command+args as the Bifrost process user before any MCP handshake. JFrog/CNA CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-306/284. Stock binary binds management API to localhost by default; official Docker image binds 0.0.0.0 so published ports expose the management API. Fix: transports/v2.1.0 returns 403 for unauthenticated stdio registration (PR #6757). Affected: Bifrost HTTP transport < 2.1.0; 1.6.x through 1.6.11 and transports/v2.0.0 lack the fix. Workaround: enable management auth and firewall the listener; treat previously exposed unauth instances as compromised and rotate virtual keys/provider credentials. (sources: JFrog advisory; CVE.report)
JFrog — Bifrost unauth RCE via MCP stdio (CVE-2026-90898)
Spain’s Agencia Española de Protección de Datos (AEPD) blog (14 September 2026; Francisco Pérez Bes) reports the agency’s first notification of a personal-data breach in which the incident was allegedly executed by an AI agent using a known large language model. Per the notifier: the agent searched generic files for vulnerabilities, successfully logged in, then autonomously hunted application flaws, modified personal data, and accessed invoices. AEPD stresses the claim is from the organisation’s notification, has not yet been independently verified by the agency and still requires analysis; use of a given model does not imply the provider’s model or infrastructure was compromised or purpose-built for crime. Framing: shift from AI-assisted attacker tools (phishing copy, vuln search) toward agentic chaining of attack phases at machine speed — with implications for identity/credential controls, detection, and response timing. According to BleepingComputer, AEPD said AI can increase the speed, scale and adaptability of attacks and reduce defenders’ response-time margins, a paradigm shift recently highlighted by Spain’s National Cryptologic Center. (source: AEPD blog) Updated 16 Sep 2026: BleepingComputer reported the AEPD post on 16 September. Correction (27 Oct 2026): a second card on the same AEPD notice has been merged into this one and removed; an earlier Perth conversion of BleepingComputer's time has been dropped because the page states no time zone. (source: BleepingComputer)
AEPD — primera notificación brecha por agente de IA (14 Sep 2026)
Brevo's status write-up says that on 14 September 2026 an attacker used a compromised long-lived Cloudflare API key (stored in Brevo application source code; Brevo says it was first misused in late August) to deploy a Cloudflare Worker that rewrote responses at the CDN edge. Brevo gives the impact window as 15:01 to 20:30 UTC (5h29): the Worker was routed to all of brevo.com at 15:01, and at 16:07 it was updated to also append a loader to the three embedded JavaScript files and routed to sibforms.com; Brevo says the ClickFix was active on the listed URLs from 16:07 until 20:30 UTC. Affected: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com, plus Brevo forms script, Conversations widget, and SDK loader that customers embed. The Worker stripped CSP and served a fake Cloudflare “verify you are human” ClickFix lure (Win+R / Ctrl+V / Enter) downloading malware on Windows; Brevo says that on WordPress sites embedding a Brevo widget, if the visitor was logged in as an administrator, the script also attempted to silently install and activate a plugin. Not affected per Brevo: app.brevo.com, API, email delivery, and customer account data held in Brevo. Remediation: Worker/routes/hostnames removed, key revoked, hardcoded credential removed, Vault + Cloudflare audit alerting planned. Distinct from Brevo’s earlier 9–10 September SSO boundary incident (Trezor phishing wave). (source: Brevo status write-up) Updated 17 Sep 2026: BleepingComputer reported that Sansec, which first reported the attack, said it may have affected up to 100,000 websites, gave the malicious window as 16:05 to 20:13 UTC, and that BleepingComputer found the plugin, named 'Web Media Optimizer', on VirusTotal. (source: BleepingComputer) Correction (24 Oct 2026): an earlier version paired 'about five and a half hours' with 16:07–20:30 UTC; Brevo's 5h29 is its 15:01–20:30 UTC window. (source: Brevo status write-up)
