F5 Labs Sensor Intel (11 September 2026; BleepingComputer 14 September) reports a sustained August 2026 mass-scanning campaign against internet-exposed Vite development servers harvesting cloud credentials and IaC state. Activity is anchored on CVE-2026-39364, an unauthenticated server.fs.deny / file-read bypass via query parameters such as ?raw, ?import&raw, or ?import&url&inline on /@fs/ requests (GitHub advisory GHSA-v2wj-q39q-566r, published 6–7 April 2026). GitHub rates CVSS 4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N); F5 also cites CVSS 7.5 High for the same CVE. Affected: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4 (also vite-plus ≤0.1.15). Patched: 7.3.2, 8.0.5, and current patched lines on older branches per vendor. F5 honeypots saw ~807 session-grouped attacks and ~32,000 raw events in August, wordlisting .env files, AWS/Azure credential paths, Terraform/serverless state, and /proc environ; scanners also reused older Vite bypasses CVE-2025-30208, CVE-2025-31125 (CISA KEV), and CVE-2024-45811. Exposure usually comes from --host / server.host or Docker port maps (often 5173). Mitigations: upgrade; do not expose dev ports; block /@fs/; rotate secrets if an unpatched Vite was reachable. Primary: F5 Labs; vendor: GitHub advisory; secondary: BleepingComputer.
SecurityWeek (14 September 2026) reports Telus is notifying some Canadian consumer telecom customers that attackers accessed their accounts between February 2025 and June 2026 using compromised credentials. Accessed data included names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. Telus says the stolen account information was used to push customers toward competitors and, in some cases, to make unauthorised service changes. Impacted credentials were reset and enhanced monitoring applied; Vancouver Police were notified and complimentary identity-theft protection offered. Headcount and exact credential source were not published; the description is consistent with credential stuffing or other account takeover using third-party credentials, which Telus has not explicitly confirmed. Distinct from the March Telus Digital / ShinyHunters incident. Primary/wire: SecurityWeek pending a public Telus notice URL.
Hacktron AI (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini; blog 13 September 2026; SecurityWeek wire 18 September) chained a heap buffer overflow in Debian-packaged libheif (CVE-2026-32882 / Discourse GHSA-vhm9-85gw-x335) with an OpenAI SSO/sign-in flaw on community.openai.com (Discourse). Attackers uploaded a crafted HEIF via forum image upload for RCE on the Discourse host, then abused OpenAI “Sign in with OpenAI” identity flow to take over employee ChatGPT and Codex accounts (connectors can reach GitHub/Slack/email). Impact proof: prompted a compromised employee Codex to open PR #1186742 in OpenAI’s internal monorepo without reading secrets. Exploit development used Claude Opus models (Opus 4.8 struggled with ASLR; Opus 5 produced a working exploit within hours). Timeline: discovery to internal-repo access under 72 hours (July 2026); OpenAI confirmed fix ~14 hours after Bugcrowd report; Discourse patched and added ImageMagick sandboxing (self-host: git pull && ./launcher rebuild app — web UI update alone may leave vulnerable libheif). OpenAI paid $6,500 for the OpenAI-side finding (Discourse-hosted forum was out of bounty scope). Discourse GHSA rates CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Broader HEIF Heist research notes the same libheif class across other image pipelines. Primary: Hacktron blog; also Discourse GHSA; wire: SecurityWeek 18 Sep.
