Friday, September 18, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Ellis County Ransomware and Brevo Attack

Ellis County faces ransomware impact; Brevo supply-chain attack affected 100k+ sites; prioritize patching and credential hygiene.

Composed by SitRep’s AI editors from 4 sources — Breaches.net, SecurityWeek, The Hacker News, BleepingComputer

Ransomware Hits Ellis County; Brevo Supply Chain Impacts 100,000+ Sites

Ellis County, Kansas, discovered a ransomware incident that affected parts of its information technology systems and will impact some services. Separately, Brevo’s supply-chain compromise injected malicious scripts into an estimated 100,000+ websites after a Sept 10 SAML SSO breach and a Sept 14 compromised Cloudflare API key.

Context

These incidents show attackers focused on trusted infrastructure—local government services, SaaS supply chains, orchestration tooling, and kernel primitives—raising immediate operational risk for organizations that rely on third‑party services and widely deployed open‑source components. Organizations using Brevo, Cloudflare workers, Orkes Conductor, or vulnerable Linux kernels face a broad blast radius: credential theft, site compromise propagation, remote code execution, and local privilege escalation.

The move

5 things to do today

  1. Revoke and rotate any long‑lived Cloudflare API keys and Brevo/SAML credentials; scan web assets for injected Cloudflare worker content and block found worker endpoints.
  2. Upgrade Orkes Conductor to 3.30.2 or later and restrict workflow submission APIs; add firewall rules to block external workflow submissions and alert on novel inline workflow definitions (CVE-2026-58138).
  3. Patch Linux kernels immediately for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469 or disable unprivileged namespaces where patches cannot be applied.
  4. Apply Check Point updates addressing CVE-2026-91843, CVE-2026-85103, and CVE-2026-85102; restrict management interfaces to trusted IPs and monitor for abnormal admin sessions.
  5. Hunt for exposed tokens and session artifacts after Gyazo‑style breaches: search logs for reused tokens, rotated API keys, and anomalous downloads of private image URLs; force token/session invalidation where found.

On the wire

P1Incident

Ellis County Ransomware Impacts County IT Services

Ellis County, Kansas, reports parts of its IT environment were encrypted and some services will be affected; officials initiated incident response. Isolate infected hosts, preserve forensic evidence, engage legal/IR, and confirm backups before restoration; treat as high‑impact local government incident.

BREACHES.NET · Ransomware Attack on Ellis County Affects Some Services

P0News

Brevo supply‑chain Compromise Injected Malware into 100,000+ Websites

Attackers leveraged a Sept 10 SAML SSO breach and a long‑lived Cloudflare API key (Sept 14) to deploy a Cloudflare worker serving a fake verification page for ~4 hours, enabling credential theft and widespread site compromise. Revoke Brevo‑related credentials and long‑lived Cloudflare API keys, rotate affected API keys, scan web assets for injected ClickFix/worker content, and block known malicious worker endpoints.

SECURITYWEEK · Brevo Supply Chain Attack Injected Malware Into 100,000 Websites

P1Exploit

Critical Orkes Conductor RCE Actively Exploited (CVE-2026-58138)

Unauthenticated remote code execution against Orkes Conductor was exploited in the wild; a patch is available in Conductor 3.30.2. Upgrade to 3.30.2 or later, restrict public access to workflow submission APIs, apply network filtering/firewall rules, and alert on anomalous workflow definitions or inline submission patterns.

SECURITYWEEK · Critical Orkes Conductor Vulnerability Exploited in Attacks

P1News

Public Exploits Released for Four Linux Kernel Privilege Escalations

Working exploits for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469 were published; fixes exist. Patch kernels immediately where updates are available, or mitigate by disabling unprivileged namespaces and other affected features; hunt for suspicious local privilege escalations and recent kernel module loads.

THE HACKER NEWS · Public Exploits for Four Linux Kernel Privilege Escalations

P1News

Check Point Security Management Server Critical RCE (CVE-2026-91843) Patched

Check Point released updates addressing a stack‑based buffer overflow that enables remote root code execution (CVE-2026-91843) plus related high‑severity bugs. Apply vendor updates or LivePatch where available, restrict management interfaces to trusted IPs, and monitor for suspicious admin logins and post‑exploit persistence.

BLEEPINGCOMPUTER · Check Point Flaw Lets Root Code Execution (CVE-2026-91843)

Indicators named in this edition

KindValueNote
CVECVE-2026-80844DirtyAH6 Linux kernel local privilege escalation
CVECVE-2026-81000TUNderflow Linux kernel local privilege escalation
CVECVE-2026-68121PPPoEject Linux kernel local privilege escalation
CVECVE-2026-74469DiagSpill Linux kernel local privilege escalation
CVECVE-2026-58138Orkes Conductor unauthenticated RCE; patch in Conductor 3.30.2
CVECVE-2026-91843Check Point Security Management Server stack overflow leading to root RCE
CVECVE-2026-85103Check Point VPN certificate ASN.1 decoding heap overflow
CVECVE-2026-44756SAP OVERPASS critical flaw noted in related coverage

Elsewhere in the edition

AI-Built Exploit and Sign-In Flaw Exposed OpenAI Internal Code

Hacktron used Claude to exploit a Discourse image-processing flaw in libheif (HEIC/HEIF) and a separate OpenAI sign-in weakness to takeover OpenAI ChatGPT and Codex accounts, gaining access to internal code. OpenAI revoked affected tokens; fix took about 14 hours. Discourse patched within two days and added sandboxing. Hacktron awarded a $6,500 bounty.

5 reports

RatHat Android Malware Abuses ADB to Retain Shell Access

Researchers flag RatHat, an Android malware alleged to be operated by China-based actors, using AI-powered controls and ADB self-pairing to break sandbox, install persistent daemons, and enable reverse tunnels for C2. It drops via smishing and malvertising, can keylog, overlay apps, capture screens, read SMS, extract credentials, and persist after uninstall.

4 reports

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw

Microsoft fixed a maximum-severity flaw in Azure AI Foundry (CVE-2026-85889) that could enable unauthorized privilege escalation due to missing authentication. CVSS 10.0. Discovery credited to Rémy Marot; no customer action required. Microsoft also patched several other critical CVEs; the issues are reportedly mitigated.

2 reports

Plugin4Shell Lets Repository Owners Swap Pinned Plugins Across AI Agents

Air Security warns of Plugin4Shell, a flaw enabling repository owners to swap pinned plugin code across four AI coding agents by abusing branch names resembling commit hashes. Anthropic fixed Claude Code 2.1.179 and OpenAI Codex 0.146.0; GitHub Copilot has no fix; Google Gemini CLI will not be fixed. No CVE or active exploitation reported as of Sept 18.

2 reports

FBI and Coast Guard Board Two Hacked Oil Tankers Heading Toward U.S.

FBI and U.S. Coast Guard boarded two U.S.-bound oil tankers after hackers compromised at least one vessel’s networks, taking control of navigation, propulsion, and cargo systems. A joint statement notes the operation followed the breach last month; the story was reported by TechCrunch.

2 reports

Fake Parcel Delivery Messages Steal Card and Bank Details

Malwarebytes warns of parcel-delivery phishing campaigns impersonating USPS, Colissimo, Chronopost, Correos, Poste Italiane, and PostNL. A Belgian-bpost scam asks for €4.95 customs duties and personal, card, and IBAN data via fake sites. Links route through URL shorteners; pages mimic secure payment but steal data. Check deliveries independently and use Scam Guard to verify suspicious messages.

2 reports

Also reported

End of the Friday, September 18, 2026 edition.