You are reading a back issue. Go to the latest edition →

The situation

Patch Zyxel GS1900 Flaw After KEV Listing

KEV-listed CVE-2026-7273 prompts patching for ~996 devices across 48 countries; fixes exist. Also: other exploits and PoCs demand rapid actions.

Composed by SitRep’s AI editors from 2 sources — BleepingComputer, The Hacker News

CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to patch Zyxel GS1900 switches after exploitation was observed across approximately 996 devices in 48 countries. Zyxel released firmware fixes on June 16; the flaw enables OS command execution via a CGI stack-based buffer overflow.

Context

Network and management-plane devices are being weaponized as entry points for data theft and lateral movement; exploited switches and routers can bridge to sensitive infrastructure and forensic evidence may be transient. Enterprise environments with unmanaged or consumer-grade devices (including DIR-822A and GS1900 series) and exposed management interfaces face the largest blast radius.

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Active exploitation of network and management infrastructure, paired with attacker tooling targeting endpoints and supply-chain edges, is increasing near-term risk of data theft and operational outages unless rapid patching, segmentation, and detection are applied.

BleepingComputer · The Hacker News

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Don’t Treat Router Flaws as Vendor-only Problems

Most network teams will deprioritize router flaws as 'vendor router problems.' That is the wrong read because exploited Zyxel and D‑Link devices provide attackers a persistent bridge into enterprise networks and have been observed in large-scale exploitation, requiring immediate isolation, patching, and forensic review.

BleepingComputer

Anyone with the link reads the whole edition, free. The link says nothing about you.

Email it

The move

5 things to do today

Patch Zyxel GS1900 devices for CVE-2026-7273 immediately and isolate any unmanaged GS1900 switches from sensitive VLANs.
Install the Sept 22 Check Point hotfix for CVE-2026-93616 and restrict Security Management Server access to trusted admin IPs only.
Block remote management and L2TP services for DIR-822A routers and remove internet-facing DIR-822A devices until vendor patches are available (CVE-2026-86296, CVE-2026-86510).
Verify disk free space and Microsoft Defender update path integrity on endpoints; alert on rapid disk consumption and unauthorized changes (watch for BigDiskBuster activity).
Search network and management logs for signs of CGI-based HTTP exploitation, script injection, and anomalous admin sessions tied to the affected devices.

On the wire

1critical
2elevated
1moderate
0low

P0Exploit

Patch Zyxel GS1900 Switches for CVE-2026-7273 Immediately

CVE-2026-7273 is actively exploited across ~996 Zyxel GS1900 switches in 48 countries and is KEV-listed; apply Zyxel firmware fixes released June 16 to affected devices and isolate any unmanaged GS1900 instances. Prioritize network segmentation, revoke exposed credentials, and search logs for crafted CGI HTTP requests to the device management interface.

BLEEPINGCOMPUTER · CISA Orders Feds to Patch Zyxel Flaw Exploited for Data Theft

Copy link to “Patch Zyxel GS1900 Switches for CVE-2026-7273 Immediately”

P1Exploit

Apply Check Point Security Management Server Hotfix for CVE-2026-93616

CVE-2026-93616 enables unauthenticated script execution via a web-service path traversal; install the vendor hotfix released Sept 22 and restrict management-plane access to trusted IP ranges. Audit management-server logs for new or altered policies, unusual admin sessions, and signs of script injection.

THE HACKER NEWS · Check Point Management Server Zero-Day Exploited in Attacks

Copy link to “Apply Check Point Security Management Server Hotfix for CVE-2026-93616”

P1Vulnerability

Mitigate D‑Link DIR-822A PoC Zero-days (CVE-2026-86296, CVE-2026-86510)

Two max-severity DIR-822A flaws have public PoCs enabling remote code execution from the local network; until patches exist, disable remote/third-party management, remove affected devices from critical segments, and apply strict ACLs to L2TP/udhcpcd services. Monitor internal networks for exploit activity and consider device replacement for internet-exposed units.

BLEEPINGCOMPUTER · D-Link DIR-822A Zero-Day Flaws With PoC Exploits

Copy link to “Mitigate D‑Link DIR-822A PoC Zero-days (CVE-2026-86296, CVE-2026-86510)”

P2Endpoint

Investigate BigDiskBuster PoC That Disrupts Microsoft Defender Updates

A publicly posted PoC named BigDiskBuster can exhaust disk space and tamper with Defender update paths, blocking signature updates; validate free disk space and Defender update integrity across endpoints and ensure update paths and signatures match Microsoft baselines (note Microsoft previously patched related CVE-2026-45498). Alert on sudden disk-filling activity and unauthorized changes to Defender configuration.

THE HACKER NEWS · BigDiskBuster Zero-Day PoC Blocks Microsoft Defender Updates

Copy link to “Investigate BigDiskBuster PoC That Disrupts Microsoft Defender Updates”

Vulnerabilities named in this edition

CVE-2026-7273 · CVE-2026-93616 · CVE-2026-86296 · CVE-2026-86510 · CVE-2026-45498

Known exploited

Added 22 Sept4 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2026-85102	Check Point Multiple Products	22 Sept	25 Sept
CVE-2026-93616	Check Point Multiple Products	22 Sept	25 Sept
CVE-2026-93952	Arista VeloCloud Orchestrator	22 Sept	25 Sept
CVE-2026-94127	F5 BIG-IP APM	22 Sept	25 Sept

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

Hidden Meta Muse Setting Could Turn AI Assistant Into Backdoor

Security researcher Wardle demonstrated a macOS config flaw in Meta’s Muse that lets an attacker redirect dictation output to a controlled endpoint. By hijacking the Muse token, an attacker could read dictated text, inject trusted commands, and control the account across devices. A remote exploit via a ClickFix trick is possible if code runs as the logged-in user; patch status unclear.

5 reports

THE HACKER NEWSHidden Meta Muse Setting Could Turn AI Assistant Into Backdoor
NEWSAPI CYBER INSIGHTSMeta Patched Major Zero-Day in Muse AI Assistant
NEWSAPI CYBER INSIGHTSMeta Muse Zero-Day Flaw Not-A-Mused Allows Data Access
NEWSAPI CYBER INSIGHTSMeta patches Muse exploit that lets attackers control the AI agent
NEWSAPI CYBER INSIGHTSMeta patch for Muse zero-day lets attackers control AI agent

ShinyHunters Claim FBI Breach Through Oracle PeopleSoft Zero-Day

ShinyHunters claims it breached FBI systems using a new Oracle PeopleSoft zero-day, accessing internal services and stealing 2–3 TB of data on employees and applicants via FBI AWS GovCloud. The FBI is investigating and has not confirmed a breach. Defaced FBI Jobs site and sample data were shared; no independent verification yet.

5 reports

BLEEPINGCOMPUTERShinyHunters Claim FBI Breach Through Oracle PeopleSoft Zero-Day
NEWSAPI CYBER INSIGHTSShinyHunters Boast FBI Breach and Data Theft Claim
NEWSAPI CYBER INSIGHTSShinyHunters Claim FBI Breach via PeopleSoft Exploit
BREACHES.NETShinyHunters Escalates Dispute With FBI Over Data
NEWSAPI CYBER INSIGHTSShinyHunters Breach Claims FBI Agents and Applicants Data Stolen

WordPress Patch Fixes Critical RCE Flaw Across Versions

WordPress fixed a critical flaw (CVSS 9.2, CVE-2026-87902) that lets attackers load PHP files from outside theme folders, enabling code execution on some servers. Affected versions range from 4.7.0 through 7.1.1; update to 7.1.2 on September 22, 2026. Updates are automatic where enabled; otherwise update via dashboard or WordPress[.]org. No PoCs or exploitation reported to date.

3 reports

THE HACKER NEWSWordPress Patch Fixes Critical RCE Flaw Across Versions
SECURITYWEEKWordPress Patches Click2Shell Vulnerability in Version 7.1.1 Release
THE HACKER NEWSWordPress Comment2Shell Flaw Causes RCE via Admin Session

Microsoft Takes Down EvilTokens PhaaS Device-Code Phishing Network

Microsoft, with U.S. court authorization and partners, took down EvilTokens, a AI-assisted device-code phishing service (Storm-2992) linked to 12,000 inbox compromises across 10,000+ organizations. Two suspects arrested; 50 sites seized, 150 domains disabled.

3 reports

THE HACKER NEWSMicrosoft Takes Down EvilTokens PhaaS Device-Code Phishing Network
BLEEPINGCOMPUTEREvilTokens PhaaS Disrupted After Compromising 12,000 Microsoft Accounts
MICROSOFT SECUREUnmasking EvilTokens: Root of Device Code Phishing Campaigns

Understanding GET Requests With Bodies and HTTP Standards

SANS ISC examines HTTP GET requests with a body and RFC guidance. RFC2616 and RFC7231 show ambiguous semantics. Tests across servers vary: Apache 2.4.68 accepts a GET with a body and returns 200; nginx and Python http[.]server ignore the body; Node ignores; lighttpd returns 400; Tomcat returns 200.

2 reports

SANS INTERNET STORM CENTERUnderstanding GET Requests With Bodies and HTTP Standards
SANS INTERNET STORM CENTERThe Truth About GET and HTTP Standards Explained

ClosedQuorum Windows malware uses AI for autonomous decisions

A Go-based Windows malware, ClosedQuorum, uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously decide post-compromise actions via a voting system. It can steal credentials, inject shellcode, persist, or move laterally, with stolen data sent to operators via a Discord webhook.

2 reports

BLEEPINGCOMPUTERClosedQuorum Windows malware uses AI for autonomous decisions
HELP NET SECURITYCAIRN Open-Source Framework Detects AI-Driven Malware With Autonomous Action

BigCommerce Data Stolen Via Ribon Apps Hack

BigCommerce says a supply chain attack on the Ribon app led to access of customer data (names, emails, phone numbers, addresses) via compromised API credentials between Sept 13–17. The attacker gained access to data on hundreds of stores; credentials were revoked Sept 17 and the app was uninstalled, with merchants notified on Sept 18. BigCommerce did not report a breach of its own systems.

2 reports

SECURITYWEEKBigCommerce Data Stolen Via Ribon Apps Hack
NEWSAPI CYBER INSIGHTSBigCommerce data breach via Ribon app affects merchants

Nightmare Eclipse Reveals Identity, Drops Microsoft Defender Exploit

Nightmare Eclipse, aka Chaotic Eclipse, reveals identity as Abdelhamid Naceri, a former Microsoft Germany employee, and releases a new PoC exploit for Microsoft Defender named BigDiskBuster that blocks Windows Defender updates on all supported Windows versions. The PoC is buggy and requires refinement; Microsoft comment was sought for response.

2 reports

SECURITYWEEKNightmare Eclipse Reveals Identity, Drops Microsoft Defender Exploit
NEWSAPI CYBER INSIGHTSChaotic Eclipse Releases BigDiskBuster DoS PoC for Windows Defender

Also reported

BLEEPINGCOMPUTERRogue External MFA Providers Steal Passwords During Logins
BLEEPINGCOMPUTERSweden Fines Miljödata $183,000 for GDPR Breach Impacting 2.2 Million
BLEEPINGCOMPUTERChinese Hackers Exploit WordPress, Zyxel Flaws to Steal Government Data
THE HACKER NEWSMalicious npm Package Poses as Twilio Bug-Bounty Probe
BLEEPINGCOMPUTERReducing Shadow IT Visibility Gaps With Wazuh
THE HACKER NEWSCritical Bifrost AI Gateway Flaw Lets Attackers Run Commands
PROOFPOINT NEWSSumit Dhawan on Proofpoint Protect 2026 at TheCUBE NYSE Wired
SECURITYWEEKCyera Raises $400 Million at $12+ Billion Valuation
SANS INTERNET STORM CENTERLausivLoader multi-stage malware data handoff analysis
BLEEPINGCOMPUTERBreach Autopsy: Real-World Google Workspace Breaches

End of the Tuesday, September 22, 2026 edition.

Read the whole paper free, by email each morning. Get the brief →

Colophon

SitRep · Vol. 1, No. 5

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
Editors: Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure: Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections: brief@sitrepit.com or the contact page.