cybr.cx Daily Digest — September 22, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-7273 | Zyxel GS1900 Series Switches | CVSS: N/A (KEV)
A stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches allows an unauthenticated, LAN-adjacent attacker to execute OS commands via a crafted HTTP request. Added to CISA KEV on September 21 with a remediation deadline of September 24 — that's 48 hours. If these switches are in your network perimeter or OT environment, treat this as urgent. Patch or isolate immediately.

⚠️ Actively exploited — CVE-2026-76460 | Cisco Identity Services Engine | CVSS: N/A (KEV)
An incorrect use of privileged APIs in Cisco ISE and ISE-PIC allows an unauthenticated remote attacker to bypass the web-based management interface entirely and gain unauthorised access. ISE is the backbone of NAC and zero-trust enforcement in many enterprise environments — a bypass here is effectively a bypass of your entire network access policy. Cisco patches should already be in your queue.

⚠️ Actively exploited — CVE-2026-76461 | Cisco Secure Email Gateway | CVSS: N/A (KEV)
A SQL injection vulnerability in Cisco AsyncOS for the Secure Email Gateway can be triggered by an unauthenticated remote attacker to execute arbitrary commands with root privileges. This is a full pre-auth RCE on a device sitting directly in your mail flow. Exploitation has been observed in the wild since mid-September — if you haven't patched, assume you should already be checking logs.

⚠️ Actively exploited — CVE-2025-39964 | Linux Kernel | CVSS: N/A (KEV)
A race condition in AF_ALG socket handling allows concurrent writes to cause unpredictable data interleaving and internal state corruption. Exploitation has been confirmed in the wild. Prioritise kernel updates across Linux-based infrastructure, particularly container hosts and cloud workloads where AF_ALG is exposed.

⚠️ Actively exploited — CVE-2026-53266 | Linux Kernel | CVSS: N/A (KEV)
An out-of-bounds write in the ebtables SNAT target allows an ARP sender hardware address rewrite to corrupt a nonlinear socket buffer fragment backed by a splice-imported file page. This is a low-level memory corruption primitive with active exploitation — patch and audit systems running ebtables, especially where network bridging or container networking is in use.

⚠️ Actively exploited — CVE-2025-39682 | Linux Kernel | CVSS: N/A (KEV)
An improper condition check in the TLS receive path allows a zero-length record from rx_list to bypass record-type handling, potentially causing subsequent TLS records to be processed with incorrect context. Active exploitation adds urgency — review kernel TLS offload configurations and apply patches.

⚠️ Actively exploited — CVE-2026-58704 | Google Pixel | CVSS: N/A (KEV)
A logic error in the cellular modem firmware of Google Pixel devices allows privilege escalation via improper authorisation bypass. Modem-layer vulnerabilities are particularly concerning as they sit below the OS security boundary. Device owners should apply Google's security update immediately.

⚠️ Actively exploited — CVE-2026-87886 | Acronis Backup (cPanel/Plesk) | CVSS: N/A (KEV)
Incorrect default permissions in the Acronis Backup plugin for cPanel & WHM and Plesk enable local privilege escalation. Hosting providers running these panels at scale are the primary risk population — audit plugin permissions and apply vendor updates without delay.

CVE-2026-94146 | BioStar BIOS Update Utility 1.9.7.3 | CVSS: 8.8 | HIGH
The BSMEM64_W10.sys kernel driver exposes an IOCTL handler with a write-what-where primitive via the PhysicalAddress/Size arguments. A public exploit exists. Local access is required, but this is a classic kernel driver abuse path for privilege escalation — the sort of thing endpoint detection should be tuned to catch.

CVE-2026-94411 / CVE-2026-94412 / CVE-2026-94501 | jshERP ≤ 3.6 | CVSS: 8.8 | HIGH
Three separate broken access control vulnerabilities in jshERP allow authenticated low-privilege users to escalate to tenant administrator, reset any user's password to a known default, and freely manipulate user-role mappings. Together these constitute a near-complete authorisation collapse — any authenticated user can effectively own the tenancy. CVE-2026-94497 (CVSS 8.3) adds insult to injury with missing object ownership checks across multiple resource types.

CVE-2026-15801 | CRI-O | CVSS: 8.0 | HIGH
When container checkpoint and restore functionality is enabled in CRI-O, insufficient validation of restore metadata can allow a privileged user to perform unintended host filesystem operations. The attack surface is limited to environments with this feature explicitly enabled, but Kubernetes operators using checkpoint/restore for workload migration should review their configurations.

Headline News

RAT Malware Drains $235K in Crypto Across Hundreds of Victims in 48 Hours

A remote access trojan campaign targeting cryptocurrency holders extracted over $235,000 from hundreds of victims within a 48-hour window, underscoring how effective focused, short-burst malware campaigns can be before defenders have time to respond. The malware appears to have combined credential harvesting with wallet-targeting capabilities, taking advantage of the irreversible nature of on-chain transactions to make recovery impossible for victims. The speed and yield of the campaign suggest either a highly targeted victim list or a large-scale phishing funnel feeding into automated wallet-draining infrastructure. For security teams supporting financial services or crypto-native organisations, this is a reminder that traditional incident response timelines are incompatible with blockchain theft — detection has to happen before the transaction confirms, or not at all.

AECOM Breach: Threat Actors Claim Theft of More Than 1TB of Data

AECOM, one of the world's largest engineering and infrastructure firms, is at the centre of a reported breach in which threat actors claim to have exfiltrated more than one terabyte of data. The scale of the alleged theft raises serious concerns given AECOM's work across critical infrastructure sectors including transportation, water, energy, and defence-adjacent projects — the kind of data that holds value well beyond simple financial fraud. At this stage the company has not publicly confirmed the specific scope or nature of the compromised material, but the volume claimed is consistent with extended dwell time and deliberate staging prior to exfiltration. Practitioners working in the infrastructure and engineering sector should treat this as a supply-chain intelligence concern and audit third-party data sharing arrangements with firms of this profile.

Schrödinger's Feed

SEALSQ, WISeKey, and the Swiss Canton of Jura have formalised a CHF 40–60 million partnership to build a Post-Quantum Semiconductor Personalization Hub, centred on SEALSQ's QS7001 Quantum Shield chip. The facility is designed to manufacture and personalise hardware roots of trust that implement post-quantum cryptographic algorithms at the silicon level — moving PQC from a software standards discussion into embedded device supply chains. This is the kind of infrastructure investment that takes years to bear fruit, but it signals that the industry is beginning to operationalise PQC at the hardware layer rather than treating it as a future software patch. Practitioners procuring IoT, embedded, or identity hardware over the next product lifecycle should start asking vendors where their PQC roadmap sits — "we'll update the firmware" may not be a sufficient answer for long-lived devices.

/dev/random

The AI coding boom has apparently broken CI pipelines — not through any vulnerability, but through sheer velocity. Linear documented how their continuous integration infrastructure became the de facto bottleneck once AI-assisted coding dramatically increased the volume and frequency of commits from their engineering team. The fix involved rearchitecting their CI system to parallelise more aggressively, cache smarter, and shed the assumptions baked in during the pre-AI-assist era when humans typed code at human speeds. The unintended security footnote: more commits, faster, with less manual review time per change, compressing the window in which a human might catch something a model confidently got wrong. Ship fast, but maybe keep a human in the loop for the parts that matter.