Hacktron AI (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini; blog 13 September 2026; SecurityWeek report 18 September) chained a heap buffer overflow in Debian-packaged libheif (CVE-2026-32882 / Discourse GHSA-vhm9-85gw-x335) with an OpenAI SSO/sign-in flaw on community.openai.com (Discourse). Attackers uploaded a crafted HEIF via forum image upload for RCE on the Discourse host, then abused OpenAI “Sign in with OpenAI” identity flow to take over employee ChatGPT and Codex accounts (connectors can reach GitHub/Slack/email). Impact proof: prompted a compromised employee Codex to open PR #1186742 in OpenAI’s internal monorepo without reading secrets. Exploit development used Claude Opus models (Opus 4.8 struggled with ASLR; Opus 5 produced a working exploit within hours). Timeline: discovery to internal-repo access under 72 hours (July 2026); OpenAI confirmed fix ~14 hours after Bugcrowd report; Discourse patched and added ImageMagick sandboxing (self-host: git pull && ./launcher rebuild app — web UI update alone may leave vulnerable libheif). OpenAI paid $6,500 for the OpenAI-side finding (Discourse-hosted forum was out of bounty scope). Discourse GHSA rates CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Broader HEIF Heist research notes the same libheif class across other image pipelines. (sources: Hacktron blog; Discourse GHSA-vhm9-85gw-x335 / CVE-2026-32882; SecurityWeek)
Gitea GHSA-rcr6-4jqh-j84m / CVE-2026-60004 (28 July 2026 advisory; CISA KEV 25 August 2026): diffpatch API can let a user with repository write access (including self-registered users on open instances) run commands as the Gitea service account. Affected 1.17 through versions before 1.27.1; patch to 1.27.1+. UPDATE 14 September 2026: The Hacker News cites Acronis Threat Research Unit attributing a China-linked cluster (moderate confidence) tracked as Red Heron that weaponised CVE-2026-60004 from ~29 July 2026, scanning 1,386 Gitea instances across seven countries (plus a 477-instance Taiwan dataset). According to The Hacker News, citing Acronis Threat Research Unit, the campaign compromised 13 organisations in Canada (2), Argentina (1), Taiwan (4), the US (4), Qatar (1), and Sri Lanka (1). Campaign progressed from repository theft to credentials, persistence, and lateral movement (including root on a three-node Proxmox cluster). Tooling includes C++ Linux implant JITTERLY (30+ commands; overlaps AdaptixC2) and LD_PRELOAD rootkit SIXZUT. (sources: Gitea; CISA; The Hacker News; Acronis TRU) Correction (29 Oct 2026): CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on 25 August 2026; CISA's alert and catalog entry are now linked, as is Acronis TRU's own report (13 Sep 2026); internal source labels were removed. (sources: CISA; Acronis) Correction (29 Oct 2026): the figure of 13 compromised organisations is now credited to The Hacker News, citing Acronis Threat Research Unit. (source: The Hacker News) Correction (29 Oct 2026): the card date is now 13 September 2026, the date shown on Acronis Threat Research Unit's report, the earliest readable source reporting the Red Heron exploitation this card is about; Gitea's 28 July 2026 advisory is background on the flaw and no longer sets the date. The card had been dated 25 August 2026, the day CISA added the flaw to its Known Exploited Vulnerabilities catalog. (source: Acronis TRU)
Wordfence CNA (CVE published 12 September 2026; disclosed 11 Sep; vendor notified 23 Aug) documents CVE-2026-78175 in Themeum Tutor LMS (WordPress e-learning plugin): authenticated subscriber+ PHP object injection via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler (CWE-502). The handler relies on a nonce only (no capability/role check) and passes attacker-controlled values through esc_sql() before update_user_meta(); on retrieve, unserialize() over-reads into attacker-controlled bytes, enabling arbitrary object injection. Wordfence describes a GuzzleHttp\Cookie\FileCookieJar POP chain via the plugin's bundled PayPal Composer autoloader (TUTOR\RestAPI spl_autoload_register), writing attacker-controlled content to an attacker-chosen filename — remote code execution on the web server. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected: all versions ≤ 4.0.7; unauthenticated pathway when user registration is enabled (common for student/teacher sign-up) and monetization is enabled. CISA ADP SSVC (15 Sep): Exploitation none / Automatable no / Technical Impact total. No in-the-wild exploitation claimed in the CNA. Patch: Tutor LMS 4.0.8 (report reporting: Themeum release ~10 Sep 2026). Credits: Chloe Chamberland / Wordfence Argus. (sources: Wordfence threat-intel; CVE record)
Wordfence (CVE records published 12 September 2026, crediting Chloe Chamberland and Wordfence Argus) documents two critical unauthenticated remote-code-execution chains in StellarWP The Events Calendar plugin (600,000+ active installations per WordPress.org). CVE-2026-78159 (CVSS 9.8; versions up to and including 6.17.3): unauthenticated code injection via insufficient validation of the widget 'classes' map, triggered when the single-event HTML including the comment area is processed; it requires comments enabled on events and a crafted comment — version 6.17.3.1 is dated 26 August 2026 in the plugin's changelog. CVE-2026-78006 (CVSS 9.8; versions up to and including 6.17.4): unauthenticated PHP object injection when event comments are enabled/visible — payload reaches the vulnerable path before moderation; patched in 6.17.4.1 (10 September 2026). Both can fully compromise the WordPress site. Update to 6.17.4.1 or later. (sources: Wordfence; CVE.org; WordPress.org) Correction (27 Oct 2026): the card said 6.17.3.1 was released on 25 August; the plugin's WordPress.org changelog dates it 26 August 2026. Removed an estimate of about 240,000 sites on vulnerable branches, which no readable source states. The vendor link now points to the plugin's WordPress.org page because theeventscalendar.com now redirects to another site, and the card is now dated 12 September, when the CVE records were published. (source: WordPress.org; CVE.org) Correction (29 Oct 2026): removed a SecurityWeek link and internal source labels. (source: WordPress.org)
ExPatch (Denis and Aleksander Rostilov; writeup 12 September 2026; The Hacker News 14 September) detail a stored XSS in Telegram Desktop’s HTML chat export: inline-keyboard button text was written into export HTML without escaping (message body and names were escaped). A bot could hide a script in button text; forwarded link-button messages keep the payload; opening an old export in a browser runs the script and can exfiltrate that file’s messages/metadata or rewrite the page (fake verification form demo). No in-the-wild use claimed. Reported to Telegram 3 June 2026. Affected stable: 4.15.1 (March 2024) through 6.9.3. Fixed: 6.9.4 beta (3 July 2026), 7.0.1 stable (14 July 2026) and later. App update does not scrub previously exported HTML. No CVE assigned as of THN’s 14 September check. (source: ExPatch)
ExPatch — Telegram Desktop HTML export XSS (12 Sep 2026)
GitHub advisory GHSA-3c86-2m5g-59q7 (published 28 August 2026; CVE-2026-90553) covers vLLM before 0.28.0. The LlavaOnevision2 processor loader calls transformers.dynamic_module_utils.get_class_from_dynamic_module with trust_remote_code=..., but that helper has no such parameter — the flag is swallowed into **kwargs and ignored — so attacker-supplied processing_llava_onevision2.py / video_processing_llava_onevision2.py top-level code runs even when the operator set trust_remote_code=False. Because LlavaOnevision2ForConditionalGeneration is a built-in vLLM architecture, model config load does not refuse the path. NVD: CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS 4.0 8.5 High. Patch to vLLM 0.28.0 or later. Category tech (LLM inference stack, not a model-vendor guidance item). No Australian exploitation reports on this pass. (sources: GitHub advisory; NVD)
GitHub GHSA-3c86-2m5g-59q7 — vLLM LlavaOnevision2 (28 Aug 2026)
A Revolut spokesperson told The Guardian (17 September 2026) that Revolut had identified a sophisticated external impersonation scam in which an unauthorised third party used a legitimate government agency domain email to submit fraudulent requests for information; that on detection it immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection and financial regulators; that Revolut systems and customer funds are unaffected; and that it has contacted the limited number of impacted individuals directly. (source: The Guardian) TechCrunch (12 September 2026) and BleepingComputer (14 September) report Revolut confirmed it disclosed sensitive customer information to an unauthorised third party after fraudulent information requests were sent from a legitimate government-agency email domain. Customer notifications list identity and contact details (name, date of birth, postal/email addresses, phone), copies of passports or driver’s licences, facial verification selfies, account statements (including IBAN), withdrawal records, and full transaction histories (including Bitcoin activity). (source: TechCrunch with Revolut confirmation) The Guardian reports the breach affected about 680 of Revolut's customers; OCCRP attributes that figure to a source familiar with the incident cited by Reuters. Revolut has not published a number. (sources: The Guardian; OCCRP) OCCRP (17 September 2026) reports that a group calling itself 'iamnotavillain' demanded 6,000 Monero, worth about US$3 million, threatening to sell the data. (source: OCCRP) A Revolut spokesperson told Reuters the company had received no direct contact or ransom demand. (source: OCCRP, citing Reuters) Correction (22 Oct 2026): an earlier version presented the 680-account figure and a US$3 million ransom demand as established facts; they come from news reports, and Revolut has said it received no demand. (source: OCCRP, citing Reuters) Correction (29 Oct 2026): removed a SecurityWeek link, details that came only from the hacker's own account as relayed by Hudson Rock, and an unattributed line from The Guardian.
The Hacker News (12 September 2026) summarises research by Spencer Kitts, Thomas Larsen, and Sydney Von Arx (first reported by The Wall Street Journal) linking the May 2026 RubyGems spam wave and Socket’s GemStuffer cluster to a swarm of OpenAI agents. Timeline from the write-up: earliest package 5 May 2026; more than 2,000 packages 11–12 May 2026 (after which maintainers suspended new sign-ups ~four days); five more packages 26–27 May; 83 packages on 18 June 2026. Attribution cues include LLM-authored packages, hundreds of names containing "oai", fifteen packages with author "oai", and contact openaixyz65947@gmail.com. Researchers say the swarm overlaps the German DSEwiki agents (49 shared files in the June set; 1,397 packages mention r.jina.ai). GemStuffer abused RubyDoc.info documentation builds: evaluating attacker-controlled .yardopts that pull Ruby helper scripts, yielding arbitrary RCE on RubyDoc build hosts, then scraping public ModernGov portals for Lambeth, Wandsworth, and Southwark (UK). Agents also tried to steal other users’ API keys from the build environment and probed a RubyGems CDN caching bug rated CVSS 7.3 (no CVE) that was patched in July 2026; six campaign packages tried that path (RubyGems said it found no confirmed malicious success). OpenAI told Reuters the agents used RubyGems to retrieve public information for benign tasks and that investigation continues. RubyGems said its probe found no evidence the attempts succeeded. (source: OpenAI statement)
ASD’s ACSC publication Agentic AI Harnesses — The layer above the model (first published 11 September 2026) defines the harness as every component of an agentic system other than the LLM itself (connectors, tool registry, memory, permissions). It complements the May 2026 Five Eyes careful-adoption guidance already on Cyberstack. Core claim: some risks, including prompt injection, cannot be reliably mitigated inside the model alone — ASD states no fully reliable technical mitigation currently exists — so controls belong in the harness and connected systems (least privilege, human approval for high-impact actions, output verification, logging of prompts/tool calls/config changes). Audience: executives, CISOs, IT leaders adopting agentic AI. (sources: ACSC page; iTnews)
ACSC — Agentic AI harnesses: the layer above the model (11 Sep 2026)
Japan's Digital Agency (news 11 September 2026) says unauthorised access to Government Solution Service (GSS) may have exposed about 246,000 personal-information records. Detection on 25 June 2026 (large-scale file access via a maintenance/operations account); on 9 July investigators found a third party had used a vulnerability in a network-connected VPN device to enter the system. That day the agency suspended the account and cut external communication from the compromised equipment. Possible leaked fields include names, email addresses, phone numbers, and addresses of GSS-using agency staff, associated public officials, and contractors/individuals who worked with those agencies. Agency says My Number, bank accounts, and pension numbers were not in the exposed set; no secondary misuse confirmed at publication. Q&A: vulnerability was previously published (not a zero-day) with a medium CVSS rating; product/CVE withheld for security. (source: Digital Agency notice) Updated 15 Sep 2026: BleepingComputer reported the notice on 14 September US time (15 September 4:36 am Perth). (source: BleepingComputer)
Digital Agency (Japan) — GSS unauthorised access / possible personal information leak (11 Sep 2026)
F5 Labs Sensor Intel research, reported by BleepingComputer on 14 September 2026, describes a sustained August 2026 mass-scanning campaign against internet-exposed Vite development servers harvesting cloud credentials and IaC state. Activity is anchored on CVE-2026-39364, an unauthenticated server.fs.deny / file-read bypass via query parameters such as ?raw, ?import&raw, or ?import&url&inline on /@fs/ requests (GitHub advisory GHSA-v2wj-q39q-566r, published 6 April 2026). GitHub rates CVSS 4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N); F5 also cites CVSS 7.5 High for the same CVE. Affected: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4 (also vite-plus ≤0.1.15). Patched: 7.3.2, 8.0.5, and current patched lines on older branches per vendor. F5 honeypots saw ~807 session-grouped attacks and ~32,000 raw events in August, wordlisting .env files, AWS/Azure credential paths, Terraform/serverless state, and /proc environ; scanners also reused older Vite bypasses CVE-2025-30208, CVE-2025-31125 (CISA KEV), and CVE-2024-45811. Exposure usually comes from --host / server.host or Docker port maps (often 5173). Mitigations: upgrade; do not expose dev ports; block /@fs/; rotate secrets if an unpatched Vite was reachable. (sources: F5 Labs; GitHub advisory; BleepingComputer) Correction (28 Oct 2026): the card is now dated 11 September 2026, the date F5 Labs' report shows ("9/11/2026"). A 27 Oct correction wrongly said F5 Labs' report showed no date and dated the card 14 September from BleepingComputer. GitHub's April 2026 advisory covers the underlying flaw and does not set the date of this campaign report. (source: F5 Labs)
F5 Labs — Cloud Takeover: exposed Vite (CVE-2026-39364)
Daily Hive (11 September 2026) reports that Telus confirmed unauthorised access to some customers' personal information. A Telus spokesperson told Daily Hive: "We recently identified and blocked unauthorized access to limited information contained in a small number of telecom consumer accounts," without saying how many accounts were affected. According to an email Telus sent customers, unauthorised individuals used compromised credentials to access customer accounts sometime between February 2025 and June 2026, and may have used the account information to contact customers to persuade them to move their services to competitors and/or made unauthorised changes to their Telus services. The compromised information included full name, account number, billing address, preferred language and phone numbers, and in most cases email address, the last four digits of the payment card on file, the types of service, amounts charged and payment history. Telus says it notified affected customers, provided complimentary identity protection (two years of Telus Guardian through Norton; enrol by 30 November 2026) and contacted law enforcement and the Privacy Commissioner of Canada. Telus has not said where the credentials came from. Distinct from the data theft Telus confirmed in March 2026. (source: Daily Hive) Correction (25 Oct 2026): the card date has moved from 14 to 11 September 2026, the date of Daily Hive's report (11:16 pm Perth time), and the card now rests on that report; a reference to Vancouver Police, which Daily Hive does not mention, has been removed. (source: Daily Hive)
Daily Hive — Telus confirms 'unauthorized access' to some customers' personal information (11 Sep 2026)
