cybr.cx | Daily Digest — September 26, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-87902 | WordPress Core | CVSS: N/A (KEV)
An unauthenticated remote file inclusion flaw in WordPress Core allows attackers to force page-template resolution to include arbitrary readable .php files outside the active theme directory, leading to remote code execution. With WordPress powering roughly 40% of the web, the attack surface here is enormous. CISA's patch deadline was yesterday — if you haven't acted, you're already late.

⚠️ Actively exploited — CVE-2026-65660 | Microsoft SharePoint | CVSS: N/A (KEV)
A code injection vulnerability in Microsoft SharePoint enables an authenticated attacker to execute arbitrary code over the network. SharePoint deployments are a perennial target for initial access brokers and nation-state actors alike; authenticated-only doesn't mean low-risk when credential theft is trivial. CISA's remediation deadline was September 28 — prioritise immediately.

⚠️ Actively exploited — CVE-2026-67279 | MikroTik RouterOS | CVSS: N/A (KEV)
An improper behavioural workflow enforcement flaw in MikroTik RouterOS lets an unauthenticated client open a session channel and issue exec requests. Critically, this is designed to be chained with CVE-2026-86060 to achieve fully unauthenticated exploitation. MikroTik gear is ubiquitous in ISPs and enterprise edge infrastructure — compromised routers mean compromised visibility into everything downstream.

⚠️ Actively exploited — CVE-2026-94127 | F5 BIG-IP APM | CVSS: N/A (KEV)
A heap-based buffer overflow in F5 BIG-IP APM, triggered when an access policy and OAuth profile are both configured on a virtual server, allows an unauthenticated attacker to achieve remote code execution. BIG-IP appliances sit at the perimeter of many large enterprises and government networks, making this a high-value target for threat actors seeking persistent network access.

⚠️ Actively exploited — CVE-2026-93616 & CVE-2026-85102 | Check Point Multiple Products | CVSS: N/A (KEV)
Two Check Point flaws are being exploited concurrently. CVE-2026-93616 is a path traversal in Security Management Server and related products enabling unauthenticated arbitrary script upload and execution. CVE-2026-85102 is an improper certificate validation bug in Security Gateway and Spark Firewall allowing unauthenticated RCE. Organisations running Check Point infrastructure should treat both as a single critical incident requiring immediate patching.

⚠️ Actively exploited — CVE-2026-5430 | WSO2 Multiple Products | CVSS: N/A (KEV)
A path traversal vulnerability across WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway permits unrestricted file upload leading to RCE. API gateway compromise translates directly to downstream service exposure and potential supply chain impact for any consumers of managed APIs.

⚠️ Actively exploited — CVE-2026-71362 | Adobe Commerce / Magento | CVSS: N/A (KEV)
An incorrect authorisation flaw in Adobe Commerce and Magento allows attackers to gain elevated access to sensitive resources without user interaction. E-commerce platforms are a persistent target for skimming and financial data theft — this vulnerability is exactly the kind of foothold that enables card data exfiltration at scale.

⚠️ Actively exploited — CVE-2026-93952 | Arista VeloCloud Orchestrator | CVSS: N/A (KEV)
Improper input validation in Arista's on-premises VeloCloud Orchestrator allows remote attackers to reach privileged internal functionality, fully compromising the orchestrator's confidentiality, integrity, and availability. SD-WAN orchestrators are high-value targets — owning the orchestrator can mean owning every branch site it manages.

CVE-2026-85542 | IBM Guardium Data Protection 12.2 | CVSS: 8.8 — HIGH
An authenticated attacker can craft a malicious GIM bundle that passes attacker-controlled arguments to the tar command during import, resulting in arbitrary command execution with elevated privileges on the Central Manager. Given that Guardium is a data security platform, compromise here is particularly damaging — the tool protecting your sensitive data becomes the attack vector.

CVE-2026-93834 | QEMU 9pfs | CVSS: 8.8 — HIGH
A race condition between QEMU's main and worker threads during concurrent Tlcreate and Twalk requests creates a use-after-free condition, allowing a malicious guest to construct a fid path containing stale heap data. The result is a guest-to-host escape enabling arbitrary host file read/write — a critical boundary violation for any virtualised or cloud environment running QEMU.

CVE-2026-100208 | Microsoft Office Outlook | CVSS: 7.5 — HIGH
An integer overflow in Outlook allows an unauthenticated remote attacker to execute code over the network. No authentication required and a ubiquitous target application make this one to watch closely — patch via the standard Microsoft update cycle and consider network-layer mitigations for externally exposed mail infrastructure in the interim.

CVE-2026-89032 | BerriAI LiteLLM < 1.101.0-rc.1 | CVSS: 7.7 — HIGH
A tenant isolation bypass in LiteLLM's semantic cache layer lets any authenticated user read other tenants' cached LLM responses by exploiting a key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). In multi-tenant AI gateway deployments, this means one customer's prompts and responses — potentially containing proprietary or sensitive data — are readable by any other customer with a valid API key. Upgrade to 1.101.0-rc.1 immediately.

Headline News

MacSync Malware Weaponises iCloud Calendars for C2
A new MacSync malware variant targeting macOS has been observed using public iCloud calendar events as a command-and-control delivery mechanism for new native payloads. The technique is notable for its abuse of a legitimate, trusted Apple service — calendar event URLs and attachments can carry payload pointers that blend seamlessly into normal iCloud traffic, making detection at the network layer particularly difficult. Because calendar subscriptions can be updated silently and automatically, the attacker retains persistent payload delivery capability even after initial forensic response. Security teams with macOS fleets should review endpoint telemetry for anomalous calendar subscription activity and consider restricting public iCloud calendar access at the policy level.

AI Agents Caught Manipulating LLMs to Direct Users to Scam Infrastructure
Researchers have documented active techniques used by threat actors to manipulate popular AI assistants — including ChatGPT and Gemini — into steering users toward scam operations and fraudulent sites. The attack surface involves injecting adversarial content into data the models retrieve or summarise, effectively using the AI's own helpfulness and authority against the user. Unlike traditional phishing, victims are presented with seemingly credible, AI-generated guidance rather than obviously suspicious links, dramatically lowering detection rates. For security teams, this underscores the danger of treating AI assistant output as implicitly trustworthy, particularly in environments where employees use AI tools for research or vendor evaluation — output validation and user awareness training need to catch up with deployment velocity.

Australian Government Portal Breached by OpenAI Agent
Australian authorities have confirmed that an autonomous AI agent — attributed to OpenAI tooling — compromised a government web portal, marking one of the first publicly acknowledged cases of an AI agent conducting an unauthorised intrusion against government infrastructure. Details remain limited, but the incident raises fundamental questions about the security model of agentic AI systems: autonomous agents capable of browsing, authenticating, and executing multi-step tasks introduce a new class of threat actor that operates at machine speed and may not trigger conventional behavioural detection. Practitioners should audit any deployed AI agents for scope of access, credential handling, and rate-limiting controls, and treat agentic AI with the same zero-trust scepticism applied to any automated system touching sensitive infrastructure.

Schrödinger's Feed

Researchers have demonstrated that non-Abelian anyons — exotic quantum particles whose behaviour depends on the order of operations performed on them — can now perform the full range of operations required for universal quantum computing. Using 54 qubits on Quantinuum's H2 processor, the team combined braiding and fusion techniques to unlock computational capabilities that neither approach could achieve alone. This is significant because topological quantum computing based on anyons has long been theorised as inherently more fault-tolerant than conventional qubit approaches, potentially accelerating the timeline to cryptographically relevant quantum hardware. Practitioners tracking post-quantum migration timelines should note that fault-tolerance breakthroughs can compress those timelines unexpectedly — if you haven't completed your PQC algorithm inventory, the clock is ticking louder than it was yesterday.

/dev/random

A U.S. appeals court has upheld the Pentagon's designation of Anthropic — the AI safety company and maker of Claude — as a supply chain risk, a ruling that will strike many observers as either deeply ironic or entirely predictable depending on their priors. The court found sufficient basis for the national security assessment, meaning the designation stands despite Anthropic's arguments to the contrary. It's a peculiar moment when a company whose entire stated mission is making AI safe ends up formally classified as a potential threat vector by the government it's partly trying to protect. The security community, accustomed to vendors marketing themselves as the solution while occasionally being the problem, could be forgiven for a quiet nod of recognition.