cybr.cx — Daily Digest | September 24, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-93616 | Check Point Security Management Server | No CVSS in NVD
A path traversal vulnerability across Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent allows an unauthenticated attacker to upload and execute arbitrary scripts. CISA has set a remediation deadline of September 25 — yesterday. If you run any Check Point management infrastructure on-prem, assume this is being actively targeted and patch or isolate immediately.

⚠️ Actively exploited — CVE-2026-85102 | Check Point Security Gateway & Spark Firewall | No CVSS in NVD
Improper certificate validation in Check Point Security Gateway and Spark Firewall — specifically on deployments using Site-to-Site VPN or Remote Access VPN — allows an unauthenticated remote attacker to execute arbitrary code on the gateway. Combined with CVE-2026-93616 above, Check Point environments are facing a dual active-exploitation event. Perimeter devices are the priority target; treat any anomalous VPN gateway behaviour as potentially post-compromise.

⚠️ Actively exploited — CVE-2026-94127 | F5 BIG-IP APM | No CVSS in NVD
A heap-based buffer overflow in F5 BIG-IP APM triggers when both an access policy and an OAuth profile are configured on a virtual server, enabling unauthenticated remote code execution. F5 APM sits at the edge of many enterprise environments handling authentication flows — RCE here means session hijacking, lateral movement, and credential theft at scale. CISA deadline was September 25; patch windows should have already closed.

⚠️ Actively exploited — CVE-2026-93952 | Arista VeloCloud Orchestrator (on-prem) | No CVSS in NVD
Improper input validation in Arista's on-premises VeloCloud SD-WAN Orchestrator allows a remote attacker to reach privileged internal functionality, compromising confidentiality, integrity, and availability of the orchestrator host. SD-WAN orchestrators control routing policy across entire branch networks; compromise here is effectively network-wide. CISA deadline was September 25.

⚠️ Actively exploited — CVE-2026-7273 | Zyxel GS1900 Series Switches | No CVSS in NVD
A stack-based buffer overflow in the CGI program on Zyxel GS1900 managed switches allows a LAN-based unauthenticated attacker to execute OS commands via a crafted HTTP request. Notably, this appears to be actively chained with WordPress exploitation in a campaign targeting government infrastructure (see Headline News). Today is the CISA remediation deadline — segment or patch now.

⚠️ Actively exploited — CVE-2025-39964 | Linux Kernel (AF_ALG socket) | No CVSS in NVD
A race condition in the Linux Kernel's AF_ALG (crypto API) socket allows concurrent writes to cause unpredictable data interleaving and internal state corruption. Active exploitation of a kernel-level crypto subsystem flaw is a serious escalation and may underpin privilege escalation chains on shared Linux infrastructure.

CVE-2026-96275 | Flatpak | CVSS 8.8
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). Two flaws combine: symlink following in files/extra resolution, and unsanitised .. traversal in blob names from xa.extra-data-sources. On system installs, writes occur as root. Any environment trusting third-party Flatpak repositories — including developer workstations and Linux desktops — is at risk.

CVE-2026-84683 | Red Hat Ansible Automation Platform (automation-controller) | CVSS 8.7
ANSI OSC 8 hyperlink escape sequences in job output are not stripped before HTML conversion, resulting in unsanitised href attributes in rendered anchor tags. This creates a stored XSS / open redirect condition in the automation-controller web UI. Any user or administrator viewing job output could be sent to an attacker-controlled URL or have scripts executed in their browser session.

CVE-2026-84691 | Red Hat Ansible Automation Platform (automation-controller) | CVSS 8.7
The API 4XX error log format string is an administrator-configurable Python template rendered with a live user object. Python's string formatting allows attribute traversal on passed objects, meaning a malicious administrator can craft a template that extracts sensitive object attributes — including secrets — into log output. This is a significant risk in multi-tenant or managed AAP environments where log access is broader than secret access.

CVE-2026-76648 | Red Hat Ansible Automation Platform (automation-controller) | CVSS 8.5
The CopyAPIView endpoint enforces object-level RBAC on GET requests but not on POST. An authenticated user can POST a copy request for objects they lack read access to, bypassing role-based controls. This allows lateral privilege escalation within AAP — accessing job templates, inventories, or credentials scoped to other teams or organisations.

CVE-2026-96889 | librsvg | CVSS 7.8
Processing SVG documents with nested XIncludes and duplicate entity declarations triggers a use-after-free in librsvg's XML parser. Exploitation could lead to denial of service or arbitrary code execution. librsvg is widely used in GNOME desktop environments and document rendering pipelines — malicious SVG files delivered via email attachments or web content are the likely attack vector.

Headline News

Chinese Threat Actor Chains Zyxel and WordPress Vulnerabilities in Government Data Theft Campaign

A Chinese-speaking threat actor has been confirmed exploiting CVE-2026-7273 — the Zyxel GS1900 switch stack overflow now on CISA's KEV list — alongside vulnerabilities in WordPress installations to conduct data theft at scale, compromising 996 devices and exfiltrating more than 18,500 records from backend databases. The campaign demonstrates a now-familiar pattern: network edge devices provide initial foothold or persistence, while web application vulnerabilities in co-located or same-network services provide access to data stores. The overlap with the active CISA KEV listing confirms this isn't opportunistic scanning — it's a targeted, multi-vector intrusion campaign likely focused on government and public sector targets. Defenders should correlate Zyxel switch anomalies with any unusual WordPress admin activity or outbound database queries on the same network segments.

ShinyHunters Claims Breach of FBI Agent Personnel Data

The ShinyHunters threat group is claiming to have stolen personally identifiable information on approximately 5,000 FBI agents, including names, home addresses, phone numbers, and spousal details. If confirmed, this represents a serious operational security exposure for law enforcement personnel — the kind of data that enables physical surveillance, intimidation, harassment campaigns, or targeted social engineering against agents and their families. ShinyHunters has a credible track record of large-scale data theft, having been linked to numerous high-profile breaches; their claims cannot be dismissed without verification. Practitioners working in government-adjacent roles or handling law enforcement data should treat this as a reminder that personnel databases are high-value targets and warrant security controls commensurate with the sensitivity of the individuals listed within them.

Radicle Discloses Network Protocol Vulnerability

Radicle, the peer-to-peer code collaboration network built on Git, has disclosed a vulnerability in its network protocol layer that warranted a coordinated public disclosure. While full technical details are still being assessed, a flaw in a decentralised code-hosting protocol is notable precisely because the trust model differs fundamentally from centralised platforms — there is no single authority to push an emergency patch or revoke compromised content. Development teams using Radicle for source code hosting or collaboration should review the disclosure, assess their node versions, and consider the implications of any period during which malicious peers could have interacted with their repositories. Software supply chain integrity starts at the source — literally.

Schrödinger's Feed

Qunnect has published new research exploring quantum security mechanisms that go beyond Quantum Key Distribution — an important signal that the field is maturing past QKD's well-documented limitations around range, infrastructure cost, and integration complexity. Meanwhile, MIT researchers have described a new qubit architecture enabling faster and more accurate gate operations, which incrementally advances the hardware capable of running Shor's algorithm at meaningful scale. The pace of improvement in both quantum hardware and quantum-safe protocol design is accelerating simultaneously, which is either reassuring or alarming depending on which side of your cryptographic migration plan you're standing on. Practitioners still running RSA-2048 or elliptic curve key exchanges in long-lived systems should treat every qubit architecture headline as a reminder that the post-quantum migration clock is not paused.

/dev/random

Someone implemented a functional JSON Event (JEV) stream processor in 25 lines of Python — not as a serious production tool, but as a demonstration that an entire event-driven processing pipeline with pattern matching can fit inside what most developers use for their import block. The trick involves leaning heavily on Python's generator protocol and a single recursive descent parser that would make a compiler professor wince and a Pythonista quietly impressed. It won't handle malformed input gracefully — but then again, neither does half the production code running in your SIEM right now. Sometimes the best argument for formal parsing libraries is watching what happens when you don't use them, elegantly.