Wednesday, September 23, 2026

Top Story

ShinyHunters claims to have breached the FBI jobs portal via an unauthenticated Oracle PeopleSoft zero-day, defacing the site and stealing 2-3 TB of data including PII on nearly all agents and applicants. The group provided a sample of records to multiple outlets, with partial verification, escalating its dispute with the Bureau and demanding retraction of a May public service announcement.

Exploitation & Threats

• China-aligned UTA0565 exploited a Chrome-Windows zero-day chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) against Asian governments in early September, deploying the new CLEANGULP backdoor via phishing sites spoofing U.S. media outlets. (Volexity)
• CSuite is targeting U.S. and EU organizations with device-code phishing and remote access panels containing 23 modules; 60% of identified victims are U.S.-based. (ZeroHour)
• A Chinese-speaking actor exploited WordPress wp2shell flaws (CVE-2026-63030, CVE-2026-60137) across 49 organizations in 29 countries, stealing 18,566 records including plaintext passwords from a Western government entity. (ZeroHour)
• Cisco Talos identified CLOSEDQUORUM, the first autonomous AI-driven malware C2 implant that uses multiple LLMs for independent decision-making, eliminating the need for continuous human operator input. (ZeroHour)
• North Korea-linked WaterPlum (Contagious Interview) infected 30,000+ devices via fake job interviews, draining 7,000+ crypto wallets and funneling $10.71M to DPRK. (ZeroHour)

Patch Priorities

• CVE-2026-93616 (CVSS 9.8) — Check Point Security Management Server path traversal leading to unauthenticated RCE. Patch immediately; emergency hotfixes released September 22.
• CVE-2026-94127 (CVSS 9.8) — F5 BIG-IP APM OAuth heap overflow enabling unauthenticated RCE. Apply engineering hotfixes or deploy the interim iRule mitigation.
• CVE-2026-87902 (CVSS 9.2) — WordPress core path traversal with conditional RCE. Ensure WordPress is updated to 7.1.2; attackers began probing within hours of patch release.
• CVE-2026-76460 (CVSS 10) — Cisco ISE API authentication bypass. Update to the latest patched version immediately.

Breaches & Incidents

• FBI — ShinyHunters claims 2-3 TB of employee and applicant PII, including names, addresses, phone numbers, dates of birth, and spouse information, exfiltrated from AWS GovCloud after initial PeopleSoft compromise.
• 27 retailers — An AI-agent campaign using Strix, Cairn, and Hermes compromised 27+ companies including a Fortune 500 hospitality firm, stealing 600,000+ credit card records. (ZeroHour)
• Ransomware leak sites posted 26 new victims in the last 24 hours, including Fresenius Medical Care (ShinyHunters), Cozen O'Connor (LeakedData), and multiple LockBit5 and Qilin targets.

AI

• Anthropic released Claude Opus 5.5, claiming Fable 5.1-level performance at 40% lower cost ($4/$20 per million tokens). The model leads Terminal-Bench 4.0 (66.4%) and includes re-routed safety guards for cybersecurity and biology requests. (ZeroHour)
• OpenAI launched GPT-6 Sol and Luna, halving API prices versus GPT-5.6 while approaching Astra-level factuality and coding performance. (ZeroHour)
• Microsoft dismantled EvilTokens, an AI-powered phishing-as-a-service platform that compromised 12,000+ Microsoft 365 accounts across 10,000+ organizations since February 2026; two UK suspects were arrested. (ZeroHour)
• A Pentagon review found overreliance on Palantir's Maven AI targeting system contributed to a February strike killing 123 children at an Iranian school due to mislabeled facility data. (ZeroHour)

Watchlist

• Oracle PeopleSoft zero-day — No official patch or acknowledgment yet; watch for FBI and Oracle statements and potential broader exposure across PeopleSoft deployments.
• China-aligned APT campaigns — UTA0565's use of pre-patched Chrome-Windows chains suggests additional zero-days may be in play; monitor Volexity and Microsoft threat intelligence updates.
• WordPress exploitation — Probes for CVE-2026-87902 started within five hours of the 7.1.2 patch; unpatched sites face imminent compromise.
• AI agent malware — CLOSEDQUORUM represents a new class of autonomous LLM-driven C2; expect copycat implementations in coming weeks.
• F5 BIG-IP APM — CVE-2026-94127 is actively exploited; organizations with OAuth-configured APM virtual servers should treat hotfix deployment as urgent.