Tuesday, September 22, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Patch Zyxel GS1900 Flaw After KEV Listing

KEV-listed CVE-2026-7273 prompts patching for ~996 devices across 48 countries; fixes exist. Also: other exploits and PoCs demand rapid actions.

Composed by SitRep’s AI editors from 2 sources — BleepingComputer, The Hacker News

Patch Zyxel GS1900 Flaw After KEV Listing

CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to patch Zyxel GS1900 switches after exploitation was observed across approximately 996 devices in 48 countries. Zyxel released firmware fixes on June 16; the flaw enables OS command execution via a CGI stack-based buffer overflow.

Context

Network and management-plane devices are being weaponized as entry points for data theft and lateral movement; exploited switches and routers can bridge to sensitive infrastructure and forensic evidence may be transient. Enterprise environments with unmanaged or consumer-grade devices (including DIR-822A and GS1900 series) and exposed management interfaces face the largest blast radius.

The move

5 things to do today

  1. Patch Zyxel GS1900 devices for CVE-2026-7273 immediately and isolate any unmanaged GS1900 switches from sensitive VLANs.
  2. Install the Sept 22 Check Point hotfix for CVE-2026-93616 and restrict Security Management Server access to trusted admin IPs only.
  3. Block remote management and L2TP services for DIR-822A routers and remove internet-facing DIR-822A devices until vendor patches are available (CVE-2026-86296, CVE-2026-86510).
  4. Verify disk free space and Microsoft Defender update path integrity on endpoints; alert on rapid disk consumption and unauthorized changes (watch for BigDiskBuster activity).
  5. Search network and management logs for signs of CGI-based HTTP exploitation, script injection, and anomalous admin sessions tied to the affected devices.

On the wire

P0Exploit

Patch Zyxel GS1900 Switches for CVE-2026-7273 Immediately

CVE-2026-7273 is actively exploited across ~996 Zyxel GS1900 switches in 48 countries and is KEV-listed; apply Zyxel firmware fixes released June 16 to affected devices and isolate any unmanaged GS1900 instances. Prioritize network segmentation, revoke exposed credentials, and search logs for crafted CGI HTTP requests to the device management interface.

BLEEPINGCOMPUTER · CISA Orders Feds to Patch Zyxel Flaw Exploited for Data Theft

P1Exploit

Apply Check Point Security Management Server Hotfix for CVE-2026-93616

CVE-2026-93616 enables unauthenticated script execution via a web-service path traversal; install the vendor hotfix released Sept 22 and restrict management-plane access to trusted IP ranges. Audit management-server logs for new or altered policies, unusual admin sessions, and signs of script injection.

THE HACKER NEWS · Check Point Management Server Zero-Day Exploited in Attacks

P1Vulnerability

Mitigate D‑Link DIR-822A PoC Zero-days (CVE-2026-86296, CVE-2026-86510)

Two max-severity DIR-822A flaws have public PoCs enabling remote code execution from the local network; until patches exist, disable remote/third-party management, remove affected devices from critical segments, and apply strict ACLs to L2TP/udhcpcd services. Monitor internal networks for exploit activity and consider device replacement for internet-exposed units.

BLEEPINGCOMPUTER · D-Link DIR-822A Zero-Day Flaws With PoC Exploits

P2Endpoint

Investigate BigDiskBuster PoC That Disrupts Microsoft Defender Updates

A publicly posted PoC named BigDiskBuster can exhaust disk space and tamper with Defender update paths, blocking signature updates; validate free disk space and Defender update integrity across endpoints and ensure update paths and signatures match Microsoft baselines (note Microsoft previously patched related CVE-2026-45498). Alert on sudden disk-filling activity and unauthorized changes to Defender configuration.

THE HACKER NEWS · BigDiskBuster Zero-Day PoC Blocks Microsoft Defender Updates

Indicators named in this edition

KindValueNote
CVECVE-2026-7273Zyxel GS1900 stack-based buffer overflow, KEV-listed and actively exploited.
CVECVE-2026-93616Check Point Security Management Server unauthenticated script execution.
CVECVE-2026-86296D‑Link DIR-822A udhcpcd stack-based overflow enabling RCE from local network.
CVECVE-2026-86510D‑Link DIR-822A L2TP parser out-of-bounds write; PoC published.
CVECVE-2026-45498Related Microsoft Defender flaw patched in May 2026; referenced as context for BigDiskBuster technique.

Elsewhere in the edition

Hidden Meta Muse Setting Could Turn AI Assistant Into Backdoor

Security researcher Wardle demonstrated a macOS config flaw in Meta’s Muse that lets an attacker redirect dictation output to a controlled endpoint. By hijacking the Muse token, an attacker could read dictated text, inject trusted commands, and control the account across devices. A remote exploit via a ClickFix trick is possible if code runs as the logged-in user; patch status unclear.

5 reports

ShinyHunters Claim FBI Breach Through Oracle PeopleSoft Zero-Day

ShinyHunters claims it breached FBI systems using a new Oracle PeopleSoft zero-day, accessing internal services and stealing 2–3 TB of data on employees and applicants via FBI AWS GovCloud. The FBI is investigating and has not confirmed a breach. Defaced FBI Jobs site and sample data were shared; no independent verification yet.

5 reports

WordPress Patch Fixes Critical RCE Flaw Across Versions

WordPress fixed a critical flaw (CVSS 9.2, CVE-2026-87902) that lets attackers load PHP files from outside theme folders, enabling code execution on some servers. Affected versions range from 4.7.0 through 7.1.1; update to 7.1.2 on September 22, 2026. Updates are automatic where enabled; otherwise update via dashboard or WordPress[.]org. No PoCs or exploitation reported to date.

3 reports

Microsoft Takes Down EvilTokens PhaaS Device-Code Phishing Network

Microsoft, with U.S. court authorization and partners, took down EvilTokens, a AI-assisted device-code phishing service (Storm-2992) linked to 12,000 inbox compromises across 10,000+ organizations. Two suspects arrested; 50 sites seized, 150 domains disabled. Revenue and pricing details disclosed; campaigns spanned multiple countries and industries, exposing widespread business email compromise r…

3 reports

Understanding GET Requests With Bodies and HTTP Standards

SANS ISC examines HTTP GET requests with a body and RFC guidance. RFC2616 and RFC7231 show ambiguous semantics. Tests across servers vary: Apache 2.4.68 accepts a GET with a body and returns 200; nginx and Python http[.]server ignore the body; Node ignores; lighttpd returns 400; Tomcat returns 200.

2 reports

ClosedQuorum Windows malware uses AI for autonomous decisions

A Go-based Windows malware, ClosedQuorum, uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously decide post-compromise actions via a voting system. It can steal credentials, inject shellcode, persist, or move laterally, with stolen data sent to operators via a Discord webhook. Cisco Talos notes this as an architectural shift toward automated attack chains, possibly not yet in…

2 reports

BigCommerce Data Stolen Via Ribon Apps Hack

BigCommerce says a supply chain attack on the Ribon app led to access of customer data (names, emails, phone numbers, addresses) via compromised API credentials between Sept 13–17. The attacker gained access to data on hundreds of stores; credentials were revoked Sept 17 and the app was uninstalled, with merchants notified on Sept 18. BigCommerce did not report a breach of its own systems.

2 reports

Nightmare Eclipse Reveals Identity, Drops Microsoft Defender Exploit

Nightmare Eclipse, aka Chaotic Eclipse, reveals identity as Abdelhamid Naceri, a former Microsoft Germany employee, and releases a new PoC exploit for Microsoft Defender named BigDiskBuster that blocks Windows Defender updates on all supported Windows versions. The PoC is buggy and requires refinement; Microsoft comment was sought for response.

2 reports

Also reported

End of the Tuesday, September 22, 2026 edition.