Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
The day's defining flaw is one that management-interface hardening cannot fix, and it sits in the module that decides who gets into the network. F5 disclosed CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager rated 9.8 (CVSS v3.1) and 9.3 (v4.0), and says it is being exploited: because the malicious traffic is aimed at the virtual server that terminates OAuth traffic rather than at the management plane, restricting access to the BIG-IP management interface is no defence, and appliances running in Appliance mode are exposed too. CISA added it to the KEV catalog on 22 September with a 25 September remediation deadline — the same deadline it set for Check Point's CVE-2026-85102 and CVE-2026-93616 and for Arista's CVE-2026-93952. The second thread is a state-actor campaign that reused a shared exploit kit: Volexity attributes attacks on 3–4 September to UTA0565, a Chinese actor that chained two Chrome flaws and a Windows ALPC bug as zero-days to escape the browser sandbox and deliver a new implant, CLEANGULP. Third, the criminal use of AI moved from service to fieldwork: investigators caught a threat actor using open-source agent frameworks to scan, exploit and skim 600,000+ payment cards across 119 websites.
The day's exploited products are the load-bearing infrastructure of Australian enterprise, government and education estates, and the national picture adds no new ACSC product. BIG-IP APM is the access tier in front of exactly the kind of application portals Commonwealth and state agencies publish; Check Point Security Gateways terminate the VPNs that connect agencies, banks and utilities to their staff; and WordPress 7.1.2 — patched on 22 September for the unauthenticated CVE-2026-87902 path-traversal flaw that is now being probed and exploited at ten times the initial rate — runs a large share of Australian small-business and not-for-profit web presence. The ACSC's newest alert remains the 18 September WaterPlum advisory on North Korean actors targeting IT professionals, and its newest publications remain the 17 September network segmentation and segregation package (overview plus anti-patterns); the ATO's own public position is a caution rather than a model, with Copilot Chat available broadly but its agentic component deliberately switched off because of the ATO's sensitive data holdings, on the view that re-engineering, automation and machine learning cover most use cases before agency is needed. One Australian-adjacent detail worth noting: GitGuardian's leaked-key study named Civica, a supplier of local-government and justice software used widely in Australia, among roughly 300 organisations whose GitHub Actions token-key leak carried repository-write and organisation-administration rights — that key was rotated after disclosure, but it is a reminder that the software Australian councils run is maintained under the same credential hygiene as anyone else's.
This week now has a clear theme, and it is not new vulnerabilities — it is that three separate vendors of perimeter and management security products have all confirmed live exploitation inside five days. Check Point's management server (22 September), Arista's SD-WAN orchestrator (22 September) and today's F5 BIG-IP APM overflow are the same story told three times: the appliances organisations buy specifically to enforce trust are themselves the cheapest route to it, because one console or gateway holds relationships to thousands of endpoints. The KEV catalog is the scoreboard — four additions on 22 September, all with 25 September deadlines, three of them in security products. The Chinese-nexus thread has shifted from one group to an ecosystem. Volexity's finding that the same BlueMoon kit was adopted, customised and re-weaponised across multiple Chinese actors follows last week's shared-kit reporting and SideCopy's move into Indian academia; the CNE community is now behaving like a supply chain rather than a set of independent teams, which means patch cadence against any single named actor buys less than it used to. The AI thread, by contrast, has split cleanly in two. The speculative end is an implant that delegates its next move to a quorum of commercial models and a shell for selling autonomous exploitation; the operational end is not model-driven at all — it is a human operator with agent frameworks doing reconnaissance at machine tempo and monetising it through skimmers. For the week ahead: whether the 6.1 and 7.0 Arista VCO trains get fixes before the weekend, whether F5's hotfix list grows beyond the three branches published, and whether the Ubuntu kernel fix for CVE-2026-80521 ships after an exploit with no workaround has been public for two days.
Incident Map
Global (Macro) 5 stories
F5 Discloses a 9.8 Heap Overflow in BIG-IP APM That Is Exploited Against OAuth Authorisation Servers — and Management-Interface Lockdown Does Not Help
F5 released engineering hotfixes for CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager (APM) rated 9.8 on CVSS v3.1 and 9.3 on v4.0, and confirmed it is being exploited to run code on BIG-IP systems without authentication. The exposed configuration is narrow but common: an APM access policy and an OAuth authorisation server profile on the same virtual server, with APM issuing access tokens to applications. The narrowness is not comfort — restricting access to the BIG-IP management interface does not mitigate the flaw, because the malicious traffic is sent to the virtual server that receives OAuth traffic itself, and systems running in Appliance mode are vulnerable. Patched branches are 21.1 (Hotfix-BIGIP-21.1.0.2.0.30.22-ENG), 17.5 (Hotfix-BIGIP-17.5.1.9.0.160.12-ENG) and 17.1 (Hotfix-BIGIP-17.1.3.5.0.41.14-ENG). CISA added it to the KEV catalog on 22 September with a 25 September federal remediation deadline; F5, CISA and CERT-EU have published no victim count, attributed actor or targeting detail, and F5 narrowed its own CVE record at 00:45 UTC on 23 September to clarify the authorisation-server role after the KEV and CERT-EU entries described the condition more broadly.
UTA0565 Chains Two Chrome Flaws and a Windows ALPC Bug as Zero-Days, Delivering the CLEANGULP Implant Through Fake Media and NGO Sites
Volexity has attributed a campaign on 3–4 September to UTA0565, a Chinese state-aligned actor that exploited CVE-2026-85046 and CVE-2026-87491 in Chrome together with CVE-2026-85880 in Windows Advanced Local Procedure Call to break out of the browser sandbox and achieve remote code execution. One campaign targeted Asian government entities with Chinese- and English-language phishing that urged support for Hong Kong activist Chow Hang-tung and impersonated the Center for American Progress, using spoofed domains — `chinadigitaltimes[.]top` and `americanprgoress[.]top` — that copied China Digital Times and CAP while loading a hidden iframe carrying the shared BlueMoon exploit kit. The final payload, `chrome_cleanup.exe`, is CLEANGULP, a Visual C++ implant with `shell`, `ps`, `upload`, `download` and beacon-object-file execution, using a hard-coded C2 domain, `thecovnresation[.]com`, that mimics the nonprofit publisher `theconversation[.]com`. Volexity's assessment is the significant part: the kit's use across multiple Chinese groups indicates the core was shared, customised and weaponised inside the Chinese CNE community, and that the two victims observed to date understate the true scope.
Check Point Confirms Active Exploitation of the Security Gateway VPN Certificate Flaw and Names the Certificate Subjects Attackers Used
Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution flaw in the certificate-handling path of its Security Gateway VPN, with malicious activity beginning 12 September against Spark customers from anonymisation infrastructure including VPN services and proxies. The company published the certificate subjects seen in the attempts — `CN=vpn,OU=users,O=global`, `CN=vpn-user,OU=users,O=global` and `CN=vpnuser,OU=users,O=global` — while warning that these reflect current observations only. The same advisory covers CVE-2026-93616, the management-server path-traversal flaw exploited as a zero-day since 23 July, giving the pair a common remediation deadline of 25 September in CISA's KEV catalog. Fixes are LivePatch Take 26 on R81.20, R82 or R82.10 gateways, or Jumbo Hotfix R81.20 Take 166, R82 Take 126, R82.10 Take 44 or R81.10 Take 190; Spark firewalls need R82.00.10 Build 2325 or R81.10.17 Build 4968. The Dutch NCSC had flagged the Security Gateway issue on 10 September as imminent, which makes the two-day gap between warning and observed exploitation the pace to plan against.
Compromised MemTensor Packages Ship a Cross-Platform Credential Stealer, and OpenSourceMalware Attributes the Payload to PolinRider and DPRK-Aligned Actors
Unknown actors compromised legitimate MemTensor packages on npm and PyPI to deliver sckit, a platform-specific Go implant for Windows, Linux and macOS. The affected versions are `@memtensor/memos-cloud-openclaw-plugin` 0.1.21, 0.1.23 and 0.1.25 (0.1.22 and 0.1.24 are clean) and PyPI `MemoryOS` 2.0.34, now quarantined. The npm launcher fires when the agent gateway starts and on every memory-recall event, passing the host environment — and during recall, the user's prompt text — to the payload; the PyPI build starts on import of the `memos` module. Exfiltration goes to `skyleen[.]fr`, harvesting npm, PyPI, GitHub, GitLab, AWS, Vault and SSH secrets, `.npmrc`, `.vault-token`, `id_ecdsa`, `access_tokens.json` and tokens for Hugging Face, Slack, Stripe and SendGrid, with a worm-like capability to self-propagate through GitHub and registry publishing. OpenSourceMalware's verified record for `memoryos` gives the campaign an attribution the news coverage does not carry: it classifies the package as legitimate-but-compromised, severity critical, and names the payload family PolinRider, associated with DPRK/Lazarus, with data exfiltration, code execution, network activity and obfuscation behaviours. SafeDep traces the initial access to MemTensor's own GitHub Actions release pipelines, where commits caused the workflow to hand over the npm and PyPI publish tokens.
An Unpatched Ubuntu Kernel Use-After-Free Escapes Containers to Host Root, and No Distribution Fix Has Shipped
DepthFirst published exploit code on 22 September for CVE-2026-80521, a use-after-free in the Linux kernel's AF_UNIX socket garbage collector (CVSS 7.8) that lets code inside a container escape namespace isolation, cgroup limits and seccomp filtering to gain root on the host. The flaw was fixed upstream on 6 August in mainline kernel 7.2 and stable 7.1.10, and the vulnerable code — introduced in kernel 6.10 and backported to 6.1 and 6.6 — is still unpatched on Ubuntu 26.04, 24.04 and 22.04 LTS, where the security tracker lists the package as "vulnerable, work in progress"; AWS, Azure and GCP kernel packages on those releases inherit it. The reach is the point: AF_UNIX sockets are permitted by default in Docker and Kubernetes seccomp profiles, so the exploit arrives through ordinary system calls a container is already entitled to make, and a race condition in the collector frees linked sockets while a pointer survives in a persistent internal list. The bug is not in CISA's KEV catalog and there are no confirmed in-the-wild attacks; no vendor workaround has been published, and the advisory recommends not running untrusted workloads on affected kernels.
Government 2 stories
ShinyHunters Claims It Breached the FBI Through an Oracle PeopleSoft Zero-Day, and the Bureau Is Investigating
The extortion group ShinyHunters defaced FBIjobs.gov with its banner and claims to hold data on "almost ALL FBI Agents" and job applicants across the Criminal Justice, HR and Medlink services, saying it acted in retaliation for a May 2026 FBI public service announcement about its targeting of the Canvas learning-management platform. A spokesperson told The Register the group used a new Oracle PeopleSoft zero-day to gain remote code execution, and ShinyHunters provided samples of 5,000 FBI agent records to 404 Media and other outlets, which confirmed their authenticity. The FBI says it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating"; as of Wednesday morning the jobs site still carried a banner stating the special agent application portal was unavailable. The technical claim is the weakest element: no PeopleSoft pre-authenticated RCE zero-day has been detailed publicly, though ShinyHunters weaponised a related flaw, CVE-2026-35273, in June 2026 to breach enterprise networks, and reporting notes the claimed lateral movement into FBI-managed AWS GovCloud infrastructure and a 2–3 TB volume are unverified. The group has also hijacked Clop's leak site and denied being part of The Com.
DHS Watchdog Finds 86% of Federal Agencies Missed the CISA Cloud Security Deadline and Says CISA Cannot Enforce Its Own Directives
A DHS inspector-general report published 23 September found that 88 of 102 federal civilian executive branch agencies — 86% — failed to implement all mandatory Secure Cloud Business Applications (SCuBA) policies required by Binding Operational Directive 25-01 by its June 2025 deadline, and that compliance had not improved by February 2026, when 78 of 102 were still non-compliant. The unimplemented baselines include blocking outdated authentication procedures, enforcing multifactor authentication and adopting a policy to protect sensitive and personally identifiable information — controls directly relevant to both credential-theft campaigns and the device-code phishing pattern that dominated this week's enforcement news. The IG's structural finding matters more than the rate: CISA lacks the authority to require full and timely implementation of BODs, so a directive that binds agencies in name produces cloud environments that "remain exposed to preventable threats". ScuBA was created after the 2022 SolarWinds attack to give agencies secure configuration baselines and assessment tooling; the report concludes that without defined enforcement oversight the federal cloud security posture is weakened enterprise-wide. CISA did not respond to the IG's report and did not answer CyberScoop's request for comment.
Defence 1 story
The Pentagon's Cyber Chief Tells Industry the Demand for Cyber Effects Outruns the Supply, as Congress Weighs Its Own AI-Cyber Pilot
Speaking at DefenseTalks 2026, the Pentagon's cyber chief said the demand for cyber operations "far exceeds supply", an admission that the constraint on US military cyber activity is now capacity rather than authority — trained operators, tooling and integration time — against an operating tempo set by state and criminal activity rather than by the department's own planning cycle. The comments land alongside legislative movement in the same direction: after the attacks on US water utilities, Capitol Hill has offered its own proposal for an AI-cyber test programme through a CISA pilot, running parallel to the administration's push for AI leadership in critical infrastructure. The two tracks do not yet meet — one funds operators, the other funds automation of the defensive side — and industry observers note that regulatory questions remain the sticking point for wider adoption of defensive AI in critical-infrastructure operators, which is the same gap Ukraine's partnership below is designed to close in practice rather than in policy.
Healthcare 2 stories
Anomali Maps Ransomware Targeting Across Eight Sectors and Finds 154 of 200 Groups Hit Healthcare, Third Behind Technology and Manufacturing
Anomali's US Ransomware Industry Targeting Report analysed targeting by 200 distinct ransomware entities across eight sectors and found more than 50% observed presence in every one — technology first with 172 groups (86%), manufacturing with 166 (83%) and healthcare third with 154 (77%). The finding is not that healthcare is uniquely targeted but that it is targeted near-universally, which changes the defensive question from "will we be a target" to "which of 154 groups will arrive first". Anomali's explanation is consistent with the incident record: healthcare combines patient care, protected health information, insurance, payments and clinical operations into one extortion surface, cannot tolerate the loss of access to patient data because that is a safety risk, faces acute pressure to recover quickly, and carries legacy systems and unpatched devices that cannot be remediated on a modern cadence. The entry points named are the familiar internet-facing set — unpatched VPNs, firewalls, edge devices, backup platforms, remote monitoring and management tooling and externally reachable applications — and the recommended controls are identity-led: phishing-resistant MFA for remote access, administrators, SSO, VPN and privileged service accounts, removal of exposed RDP, stale-account review and continuous monitoring for credential exposure.
California Moves to Put Guardrails on AI-Delivered Mental Health Treatment
California is seeking to regulate the use of AI in mental health treatment, addressing a gap that has opened faster than either clinical governance or licensing frameworks: AI chatbots are already being used for intake, triage, therapy-adjacent conversation and crisis signposting, in some cases without clinician oversight, and the state's proposal would impose requirements on how those systems operate rather than banning them. The healthcare relevance is regulatory rather than technical — it is the first US state action aimed specifically at the intersection of a clinical duty of care and an unlicensed automated agent, and it follows the same pattern as the AI incident-response gap and the rogue-agent incidents that defined this week's AI-safety coverage. For health providers, the practical consequence is that any AI function touching patient mental health data in California becomes a compliance surface with documentation and oversight obligations, and telehealth and digital-mental-health vendors operating nationally will need to decide whether to build to California's standard or run separate configurations.
Education 1 story
Elsevier Confirms a Brief Compromise After Visitors to Its Platforms Were Redirected to the LAPSUS$ Leak Site
Academic publisher Elsevier confirmed that visitors to select platforms were redirected to a LAPSUS$ leak page following an attack on 21 September, with a nursing student's Reddit post on 22 September showing the criminal crew's calling card in place of textbook access. The Amsterdam-based publisher says its security team resolved the issue and restored service, and characterises it as "a narrowly scoped, limited-duration event involving the temporary redirection of traffic for certain web properties", with no indication that core platforms, customer data, research content or operational systems were compromised. It would not say which platforms were affected or for how long the redirect was in place — the operationally important detail for any institution that needs to determine whether users were exposed to a credential-harvesting page. Elsevier is best known for ScienceDirect, which hosts scientific, technical and medical research and sits inside university library authentication flows; a redirect at that layer intersects with institutional single sign-on, which is why a "limited" event still warrants a user-credential review.
Legal Services 2 stories
Sweden's IMY Fines Miljödata SEK 1.8 Million for Security Failures Behind a Breach That Hit 2.2 Million People
Sweden's privacy regulator IMY imposed a SEK 1.8 million (about US$183,000) administrative fine on IT provider Miljödata for inadequate technical and organisational security under Article 32(1) GDPR, following the 25 August 2025 attack that disrupted IT services in more than 200 Swedish regions and municipalities. Miljödata supplies work-environment and HR management systems used by 80% of Sweden's municipal systems, and the leaked data included personal identity numbers, contact information, sickness absence, rehabilitation records and school incidents involving minors; the attacker demanded 1.5 Bitcoin (about US$168,000 at the time) and published the data under the name "Datacarry". IMY's specific findings are the transferable lesson for suppliers of government-facing software: the company did not perform sufficient checks when installing new software and lacked automated real-time monitoring to detect intrusions and suspicious activity, a gap that let an intrusion proceed to exfiltration unnoticed. IMY has also opened investigations into two municipalities and one region in connection with the same attack, so further penalties may follow.
The UK's Online Safety Regulator Opens an Investigation Into Pornhub's Parent Company Over Alleged Age-Verification Failings
The UK regulator has opened an investigation into the parent company of Pornhub over alleged age-verification failings, testing the enforcement machinery created by the Online Safety Act against the largest operator in the sector. The case is being reported alongside the parallel and separate action over the site's use of Apple-powered age checks, which raises a question about whether delegating verification to a platform's own account-level signal satisfies the statutory duty or merely shifts it. The legal significance extends past one site: age assurance is now the compliance surface on which a broad set of consumer services are judged, and the regulator's findings will define what "highly effective" verification means in practice — how much certainty, what documentation, what fallback for users who do not hold a supported device account. For Australian and New Zealand platforms watching the same policy direction, the UK enforcement record is the nearest precedent for what a regulator accepts as adequate; penalties in this regime are calculated on global turnover rather than on the number of affected users.
Retail & Entertainment & Sport 1 story
An Attacker Pointed Open-Source AI Agent Frameworks at Online Retailers, Stealing 600,000 Card Records and Skimming 119 Sites
Gambit has documented a financially motivated campaign, active since at least July and ongoing as of 22 September, in which a human operator gave open-source AI agent frameworks campaign goals and let them run the attack chain against tens of companies per day. The stack is three tools: Strix, a penetration-testing framework used for scanning and vulnerability discovery; Cairn, an autonomous exploitation engine tasked with objectives such as obtaining a shell or administrator access; and Hermes, which handled orchestration, post-exploitation and tactical decisions using `claude-opus-4.6` and carried a persona, "SOUL - Red Team Operator", with 121 skills, 78 of them attack-related. Strix ran 146 times against 138 hosts between 23 and 31 August, accumulating 633 scanning hours, and between 10 and 15 September the operator launched 105 distinct attack waves, succeeding to varying degrees on at least 27 organisations; the campaign compromised at least 119 sites with card skimmers and stole more than 600,000 valid card details from two companies, reaching a Fortune 500 hospitality firm, a major US airline, an industrial supplies distributor and an online fashion retailer. Skimmers were planted by appending to legitimate JavaScript, injecting script tags into checkout pages and Google tag blocks, poisoning S3/CDN content and server-side caches, altering database fields and Kubernetes deployments, and using cron jobs to restore the skimmer after removal.
Energy & Utilities 1 story
OpenAI Pledges More Than US$1 Billion in Subsidised Tokens to Ukraine to Defend Power and Water Systems
OpenAI and the Ukrainian government announced a partnership at OpenAI's New York office that gives Ukrainian cybersecurity officials access to advanced models through the company's Daybreak programme, together with a pledge of more than US$1 billion in subsidised tokens. Ukrainian officials described the intended uses as cybersecurity automation — incident response, threat triage, login analysis, system inventory, code analysis and vulnerability validation — with the stated purpose being speed rather than substitution: the volume of logs defenders must read is the constraint, and officials were explicit that the aim is to make the cyber defender act faster, not to replace them. Ukraine reports roughly 6,000 cyberattacks a year, about 15 a day, and its critical infrastructure has been under sustained Russian attack across twelve years, including the 2015 grid shutdown and the 2025 railway attack, which is why the programme is framed around keeping the country running rather than protecting computers. For other operators, the signal is that subsidised defensive AI at national scale is now a live procurement model: US Senate staff told the panel there is broad bipartisan support for similar adoption by US critical-infrastructure operators, with regulation the remaining obstacle.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |