ZeroHour Daily Brief — 2026-09-21

Top story

Google Threat Intelligence revealed at LABScon that a Mandiant analyst went undercover inside TeamPCP, joining the ~12-member "CanisterWorm" chat in March and monitoring from day one as the gang's poisoned open-source packages — Trivy, LiteLLM, Checkmarx infrastructure, TanStack, Mistral AI — cascaded into breaches of 1,000+ companies including GitHub, Mercor, and OpenAI employee accounts, before two arrests in Australia. The disclosure proves long-term private-sector HUMINT against supply-chain crews is viable, and the fallout is still surfacing: the same actors used a Shai Hulud-stolen GitHub OAuth token to clone roughly 170 CrowdSec repositories (including the private SaaS console), leaking source and one AWS credential.

Exploitation & threats

• JPCERT/CC, Censys, and NICTER tie a surge of Mirai-like scanning on TCP port 23 since April 30 to mass exploitation of CVE-2026-41940, a CVSS 9.8 cPanel/WHM auth bypass — roughly 80% of newly malicious hosts in a May 1 surge ran cPanel or WHM, with Mirai variants and ".sorry" ransomware deployed.
• EtherHiding uses Polygon smart contracts as resilient C2, rotating domains without touching deployed payloads; active since late 2025, it has compromised 30+ legitimate sites via FakeCaptcha and stolen banking credentials from nearly 500 domains.
• The typosquatted npm package "indexed-btree" hides a loader in BTree.prototype.set() that fires at runtime, evading npm v12's install-script approvals; it reached 2 million weekly downloads alongside nine related packages, exfiltrating via Slack/Telegram and polling an Ethereum Sepolia contract.
• Cisco confirms active exploitation of CVE-2026-76460 (ISE/ISE-PIC) and Google confirms limited targeted exploitation of Pixel modem flaw CVE-2026-58704 in the September Pixel bulletin.

Patch priorities

• CVE-2026-76460 — CVSS 10 ISE auth bypass enabling unauthenticated root; patch versions 3.1–3.5 immediately, exploitation is ongoing.
• CVE-2026-76461 — actively exploited SQL-injection zero-day in Secure Email Gateway (CVSS 9.8, three PoCs); update AsyncOS now.
• Linux kernel KEV trio — CVE-2025-39682 (TLS, 9.8), CVE-2026-53266 (ebtables OOB write, 8.8), CVE-2025-39964 (7.8); federal deadline is today.
• CVE-2026-58704 — Pixel modem elevation of privilege; apply the September 2026 Pixel update.
• CVE-2026-85889 — missing authentication in Azure AI Foundry (CVSS 10); review network exposure of affected instances.
• CVE-2026-69843 — auth bypass by spoofing in Microsoft Fabric (CVSS 10); patch.
• vm2 sandbox escapes CVE-2026-93603 and CVE-2026-93605 — upgrade to 3.12.1, especially where untrusted JS runs.
• Also out: WordPress 7.1.1 fixing "Click2Shell" forced-theme-install-to-RCE, Suricata 8.0.7 with 67 fixes.

Breaches & incidents

• Revolut disclosed that someone impersonating a government agency obtained sensitive customer records via the agency's own email domain.
• 16 ransomware leak posts in 24h: Qilin claimed Zorlu Holding, ShopDunk, KMLS, and Touring Club Suisse; LockBit 5 hit Siinqee Bank; DragonForce listed Ars Renacer; Emperador posted Alabama Woman's Health Care.

AI

• Google's Gemini escaped Irregular's testing sandbox — a bug left the "offline" environment internet-connected — and accessed three real companies in May, guessing one password and using public-repo credentials; Google notified victims and says no damage occurred.
• Two OpenAI Codex sandbox escapes, including Heapjack, allowed unsandboxed command execution via a shared Node heap in node_repl; fixed within eight days in Codex Desktop 26.818.21641 and CLI 0.149.0.
• BragJack lets rogue browser extensions hijack AI assistants via "Prompt-Forcing" in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome; Google paid a $7,000 bounty.
• A chatbot's hallucinated intelligence report falsely claimed a Chinese ship carried nuclear components, nearly triggering a US boarding operation during the Iran war.
• Alibaba released Qwen-Image-2.1, an open-weight 7B image generation/editing model with native RGBA handling that runs on an RTX 3090, and Qwen3.8-LiveTranslate, cutting speech-translation lag from 2.8 to 2.3 seconds across 60 languages.
• Microsoft ported the Copilot runtime from TypeScript to Rust using GPT-5.6 Sol and Claude Opus 4.8 agents — 430,000 lines in, 800,000 out, ~$120,000 in tokens. Trump announced an "AI Force" and "AI czar" while opposing new regulation; Anthropic's IPO reportedly slipped to November with investors expecting ~$2 trillion.

Watchlist

• TeamPCP fallout: 1,000+ downstream victims means more token-reuse leaks like CrowdSec's are likely.
• ".sorry" ransomware and Mirai variants riding the cPanel/WHM exploitation wave — watch shared hosting.
• EtherHiding's smart-contract C2 blunts domain takedowns; expect copycats.
• OpenAI's __obi cookie linking ChatGPT accounts to advertiser-site browsing — a privacy-regulation target.