Skip to content
Friday, September 18, 2026 · Daily edition · Vol. 1, No. 3Back issue

Vol. 1, No. 3Composed Sep 19 · 00:08 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

1 critical · 4 elevated5 stories on the wire

You are reading a back issue. Go to the latest edition →

The situation

Ransomware Hits Ellis County; Brevo Supply Chain Impacts 100,000+ Sites

Ellis County faces ransomware impact; Brevo supply-chain attack affected 100k+ sites; prioritize patching and credential hygiene.

Composed by SitRep’s AI editors from 4 sources — Breaches.net, SecurityWeek, The Hacker News, BleepingComputer

Ellis County, Kansas, discovered a ransomware incident that affected parts of its information technology systems and will impact some services. Separately, Brevo’s supply-chain compromise injected malicious scripts into an estimated 100,000+ websites after a Sept 10 SAML SSO breach and a Sept 14 compromised Cloudflare API key.

Context

These incidents show attackers focused on trusted infrastructure—local government services, SaaS supply chains, orchestration tooling, and kernel primitives—raising immediate operational risk for organizations that rely on third‑party services and widely deployed open‑source components. Organizations using Brevo, Cloudflare workers, Orkes Conductor, or vulnerable Linux kernels face a broad blast radius: credential theft, site compromise propagation, remote code execution, and local privilege escalation.

The move

5 things to do today

  1. Revoke and rotate any long‑lived Cloudflare API keys and Brevo/SAML credentials; scan web assets for injected Cloudflare worker content and block found worker endpoints.
  2. Upgrade Orkes Conductor to 3.30.2 or later and restrict workflow submission APIs; add firewall rules to block external workflow submissions and alert on novel inline workflow definitions (CVE-2026-58138).
  3. Patch Linux kernels immediately for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469 or disable unprivileged namespaces where patches cannot be applied.
  4. Apply Check Point updates addressing CVE-2026-91843, CVE-2026-85103, and CVE-2026-85102; restrict management interfaces to trusted IPs and monitor for abnormal admin sessions.
  5. Hunt for exposed tokens and session artifacts after Gyazo‑style breaches: search logs for reused tokens, rotated API keys, and anomalous downloads of private image URLs; force token/session invalidation where found.

Also drawn on Ransomware Developer Sentenced and Plugin4Shell Attack Highlight SAP Flaw (SecurityWeek)

On the wire

  • 1critical
  • 4elevated
  • 0moderate
  • 0low
P1Incident

Ellis County Ransomware Impacts County IT Services

Ellis County, Kansas, reports parts of its IT environment were encrypted and some services will be affected; officials initiated incident response. Isolate infected hosts, preserve forensic evidence, engage legal/IR, and confirm backups before restoration; treat as high‑impact local government incident.

BREACHES.NET · Ransomware Attack on Ellis County Affects Some Services

Copy link to “Ellis County Ransomware Impacts County IT Services”

P0News

Brevo supply‑chain Compromise Injected Malware into 100,000+ Websites

Attackers leveraged a Sept 10 SAML SSO breach and a long‑lived Cloudflare API key (Sept 14) to deploy a Cloudflare worker serving a fake verification page for ~4 hours, enabling credential theft and widespread site compromise. Revoke Brevo‑related credentials and long‑lived Cloudflare API keys, rotate affected API keys, scan web assets for injected ClickFix/worker content, and block known malicious worker endpoints.

SECURITYWEEK · Brevo Supply Chain Attack Injected Malware Into 100,000 Websites

Copy link to “Brevo supply‑chain Compromise Injected Malware into 100,000+ Websites”

P1Exploit

Critical Orkes Conductor RCE Actively Exploited (CVE-2026-58138)

Unauthenticated remote code execution against Orkes Conductor was exploited in the wild; a patch is available in Conductor 3.30.2. Upgrade to 3.30.2 or later, restrict public access to workflow submission APIs, apply network filtering/firewall rules, and alert on anomalous workflow definitions or inline submission patterns.

SECURITYWEEK · Critical Orkes Conductor Vulnerability Exploited in Attacks

Copy link to “Critical Orkes Conductor RCE Actively Exploited (CVE-2026-58138)”

P1News

Public Exploits Released for Four Linux Kernel Privilege Escalations

Working exploits for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469 were published; fixes exist. Patch kernels immediately where updates are available, or mitigate by disabling unprivileged namespaces and other affected features; hunt for suspicious local privilege escalations and recent kernel module loads.

THE HACKER NEWS · Public Exploits for Four Linux Kernel Privilege Escalations

Copy link to “Public Exploits Released for Four Linux Kernel Privilege Escalations”

P1News

Check Point Security Management Server Critical RCE (CVE-2026-91843) Patched

Check Point released updates addressing a stack‑based buffer overflow that enables remote root code execution (CVE-2026-91843) plus related high‑severity bugs. Apply vendor updates or LivePatch where available, restrict management interfaces to trusted IPs, and monitor for suspicious admin logins and post‑exploit persistence.

BLEEPINGCOMPUTER · Check Point Flaw Lets Root Code Execution (CVE-2026-91843)

Copy link to “Check Point Security Management Server Critical RCE (CVE-2026-91843) Patched”

Vulnerabilities named in this edition

CVE-2026-80844 · CVE-2026-81000 · CVE-2026-68121 · CVE-2026-74469 · CVE-2026-58138 · CVE-2026-91843 · CVE-2026-85103 · CVE-2026-44756

Known exploited

Added 18 Sept3 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2025-39682Linux Kernel18 Sept21 Sept
CVE-2025-39964Linux Kernel18 Sept21 Sept
CVE-2026-53266Linux Kernel18 Sept21 Sept

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

AI-Built Exploit and Sign-In Flaw Exposed OpenAI Internal Code

Hacktron used Claude to exploit a Discourse image-processing flaw in libheif (HEIC/HEIF) and a separate OpenAI sign-in weakness to takeover OpenAI ChatGPT and Codex accounts, gaining access to internal code. OpenAI revoked affected tokens; fix took about 14 hours. Discourse patched within two days and added sandboxing. Hacktron awarded a $6,500 bounty.

5 reports

RatHat Android Malware Abuses ADB to Retain Shell Access

Researchers flag RatHat, an Android malware alleged to be operated by China-based actors, using AI-powered controls and ADB self-pairing to break sandbox, install persistent daemons, and enable reverse tunnels for C2. It drops via smishing and malvertising, can keylog, overlay apps, capture screens, read SMS, extract credentials, and persist after uninstall.

4 reports

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw

Microsoft fixed a maximum-severity flaw in Azure AI Foundry (CVE-2026-85889) that could enable unauthorized privilege escalation due to missing authentication. CVSS 10.0. Discovery credited to Rémy Marot; no customer action required. Microsoft also patched several other critical CVEs; the issues are reportedly mitigated.

2 reports

Plugin4Shell Lets Repository Owners Swap Pinned Plugins Across AI Agents

Air Security warns of Plugin4Shell, a flaw enabling repository owners to swap pinned plugin code across four AI coding agents by abusing branch names resembling commit hashes. Anthropic fixed Claude Code 2.1.179 and OpenAI Codex 0.146.0; GitHub Copilot has no fix; Google Gemini CLI will not be fixed. No CVE or active exploitation reported as of Sept 18.

2 reports

FBI and Coast Guard Board Two Hacked Oil Tankers Heading Toward U.S.

FBI and U.S. Coast Guard boarded two U.S.-bound oil tankers after hackers compromised at least one vessel’s networks, taking control of navigation, propulsion, and cargo systems. A joint statement notes the operation followed the breach last month; the story was reported by TechCrunch.

2 reports

Fake Parcel Delivery Messages Steal Card and Bank Details

Malwarebytes warns of parcel-delivery phishing campaigns impersonating USPS, Colissimo, Chronopost, Correos, Poste Italiane, and PostNL. A Belgian-bpost scam asks for €4.95 customs duties and personal, card, and IBAN data via fake sites. Links route through URL shorteners; pages mimic secure payment but steal data. Check deliveries independently and use Scam Guard to verify suspicious messages.

2 reports

Also reported

End of the Friday, September 18, 2026 edition.

Colophon

SitRep · Vol. 1, No. 3

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.