Three bugs that were quietly patched earlier this month turned out to have been used together, in real attacks, before anyone outside the victims knew. Two Chrome flaws and one Windows flaw were chained by a Chinese group against government targets in Asia on 3 and 4 September, breaking out of the browser sandbox to plant a backdoor. Every piece of that chain already has a fix. If your Chrome and your Windows are current, you are not exposed. If they are not, this is the week to change that.
The other theme was uncomfortable in a different way. Two products companies buy specifically to keep attackers out were being used to let them in: F5's BIG-IP Access Policy Manager and Check Point's Security Management Server both had unauthenticated remote code execution flaws scored 9.8 out of 10, and both were attacked before patches existed. The largest single loss of the week was financial rather than technical: the crypto exchange Bitget says attackers reached into its wallet infrastructure and moved roughly $351.6 million out through its own authorisation process.
This is week 39, covering Monday 21 to Sunday 27 September. Last week's roundup is here.
What to act on#
Update Chrome and Windows if you have not since early September#
Researchers tied three vulnerabilities into one exploit chain used by a Chinese group tracked as UTA0565: CVE-2026-85046 and CVE-2026-87491 in Chrome, plus CVE-2026-85880 in the Windows Advanced Local Procedure Call service. Victims received phishing emails linking to spoofed sites where a hidden iframe loaded the exploit, escaped Chrome's sandbox and installed a backdoor called CLEANGULP.
All three are fixed. The first Chrome bug was patched on 4 September in version 152.0.7977.82/.83, the second on 9 September in 153.0.8010.36/.37, and the Windows privilege escalation in the 8 September Patch Tuesday.
What to do: open Chrome's About page to force the version check, then restart the browser, because Chrome will not apply a downloaded update until you do. Then run Windows Update. That is the whole job. For a longer look at browser choices, see private and secure browsers in 2026.
A fake LastPass Authenticator download is killing antivirus and emptying browsers#
This one is aimed squarely at ordinary people. Attackers set up a fake GitHub page at github.com/LastPass-Authenticator that ranks in search results for "LastPass Authenticator download" and looks like a real product page. The download is a large archive containing a genuine Microsoft debugging tool alongside a malicious DLL. Once run, it escalates to SYSTEM and loads a kernel driver that works through a list of 145 antivirus and security process names, killing each one it finds. Then it takes saved passwords from more than two dozen browsers, cryptocurrency wallet files, Windows Credential Manager contents, and login sessions for Discord, Steam and Telegram.
The driver is the nasty detail. It is a renamed copy of a component from a Chinese disk encryption product, carrying a valid Microsoft hardware compatibility signature from 2023, and the rename took its detection rate to zero. Microsoft told the researchers the behaviour does not meet its definition of a security vulnerability because the driver is not a Microsoft component, and it was still not blocklisted when the report was published. The same server hosted impersonation pages for at least 40 other brands, so LastPass is the example, not the limit.
What to do: get security software from the vendor's own website, typed in directly, never from a search result. If this ran on a machine, treat every password saved in that browser as stolen, change them from a different clean device, and rebuild the machine rather than cleaning it, because a kernel driver was installed. It is also a clear argument for passkeys over saved passwords: a stolen password database is worth something, a stolen passkey is not, because the private key never leaves the device and cannot be typed into a phishing page.
WordPress 7.1.2 and Elementor 4.3.2, today if you run a site#
WordPress core shipped a fix for CVE-2026-87902, a path traversal flaw rated 9.2 affecting versions 4.7.0 through 7.1.1. It lets an unauthenticated attacker load a PHP file from outside the theme folders, which becomes code execution only where two conditions line up: the active theme has a top-level folder whose name starts with page-, and PHP's register_argc_argv setting is on. No exploitation was reported as of 22 September. Fixed in 7.1.2, with backports down to 4.7.37, and sites with automatic background updates will take it on their own.
Separately, Elementor 4.3.0 and 4.3.1 carry a cross-site request forgery flaw rated 8.8, with more than two million sites on those versions. One link, clicked by a logged-in administrator, makes that account perform any REST API action it is allowed to, which on a normal install means creating another administrator. It works as a plain link in an email or chat message, with no JavaScript and no attacker-controlled page needed. No exploitation reported yet; the fix is 4.3.2.
What to do: update core and update Elementor, and get out of the habit of clicking links while logged in as an admin in the same browser profile.
If a recruiter asks you to run code, that is the attack#
North Korea's Contagious Interview operation has now compromised at least 30,000 devices across more than 100 countries and stolen a minimum of $10.71 million in cryptocurrency from over 7,000 wallets. The approach never changes: a plausible recruiter on LinkedIn, a lucrative role, then a coding assessment or take-home test that installs a backdoor when you run it.
The same shape appeared elsewhere. third-party[.]com, a placeholder domain that hundreds of thousands of files use as an example endpoint, was registered by someone and now serves a fake Cloudflare verification page that copies a PowerShell command into the visitor's clipboard and asks them to paste it into a terminal.
What to do: never run an installer or script that arrives as part of a hiring process, and never paste a command into a terminal because a web page told you to. No legitimate site needs that to prove you are human. That one rule defeats both campaigns.
The week's biggest#
F5 BIG-IP APM: code execution with no credentials at all#
CVE-2026-94127 is rated 9.8 and was already being exploited when F5 disclosed it. Unauthenticated attackers send crafted traffic to a virtual server and run code on it. Affected branches are 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3, and only where APM acts as an OAuth authorization server with both an access policy and an OAuth authorization server profile on the same virtual server. Deployments using APM purely as a client or resource server are not vulnerable. CISA added it to its exploited-vulnerabilities catalogue on 22 September, and F5 has shipped hotfixes for all three branches.
Who's exposed: organisations running BIG-IP APM in that specific OAuth role. Nothing for a home user to do. But if your employer's single sign-on runs through one of these boxes, this is a flaw in the thing that issues your logins, which is why it matters more than its install base suggests.
Check Point's management server has been under attack since July#
CVE-2026-93616, also 9.8, is a path traversal flaw in Check Point's Security Management Server: the service does not properly limit which files a request can reach, so an attacker with no credentials can upload a script and then run it. Check Point confirmed targeted attacks dating to 23 July and shipped a fix on 22 September. Vulnerable builds span R82.20 with no Jumbo Hotfix, R82.10 at Take 44 or below, R82 at Take 126 or below, R81.20 at Take 166 or below, and a long tail of end-of-support versions. A second flaw, CVE-2026-85102, allows pre-authentication code execution on Spark and Security Gateway firewalls on R81 through R82.10; fixes have been out since 9 September and attempts began on 12 September.
Who's exposed: companies running Check Point firewalls. The management server holds the firewall policy for the whole estate, so a two-month exploitation window before a patch is a genuinely bad outcome. Home and small-office routers are unrelated.
A SharePoint "spoofing" bug was actually code execution, and it is being used#
Microsoft originally filed CVE-2026-65660 as a spoofing issue, then re-rated the advisory to remote code execution and, on 25 September, confirmed reliable evidence of observed attacks. It is rated 8.8 and needs an authenticated account, so in practice an attacker who already holds a foothold or stolen credentials. It affects SharePoint Server 2016, 2019 and Subscription Edition, and the fix has been in the 11 August security updates all along, which also turn the vulnerable function off by default.
Who's exposed: organisations running SharePoint on their own servers, and only those that skipped the August updates. Microsoft-hosted SharePoint Online is not part of this story.
MikroTik routers taken over with no password#
Researchers published the full chain, nicknamed MikroTrick: CVE-2026-67279 in the SSH state machine combined with CVE-2026-86060, argument injection in the login process, gives complete unauthenticated access to the administrative console. MikroTik patched on 3 September in RouterOS 6.49.21, 7.23.4 and 7.24.2, but attack logs go back to 2 September, one day earlier, and CISA added the second CVE to its exploited catalogue on 10 September. The chain needs SSH reachable from the attacker, which MikroTik's default configuration does not allow, so the risk sits with administrators who opened it up or who manage devices over SSH from untrusted networks. No authoritative count of compromised devices has been published.
Who's exposed: businesses, ISPs and technically inclined home users running MikroTik gear with SSH exposed. If your router came from your ISP or from Asus, TP-Link or Netgear, this is not about you.
Roundcube webmail: pre-auth SQL injection, exploited four months after the patch#
CVE-2026-48842, rated 8.1, lets an unauthenticated attacker inject SQL through Roundcube's virtuser_query plugin, which opens the door to mail credentials and stored messages. Roundcube fixed it back in May in 1.6.16 and 1.7.1. The Canadian Centre for Cyber Security warned this week that it is now being exploited in the wild. More than 523,000 Roundcube instances are exposed to the internet, though Shadowserver counted only 10 still-vulnerable hosts on 23 September, which suggests the patch landed widely.
Who's exposed: anyone whose email is read through a self-hosted Roundcube, which usually means small hosting providers, universities and companies running their own mail. If you use Gmail, Outlook.com or your provider's own webmail, this is not yours. The real lesson is the gap: a four-month-old patch was still worth attacking.
Bitget says $351.6 million left through its own authorisation process#
The exchange's chief executive said attackers compromised a critical backend system in its wallet infrastructure, used it to spoof transaction data, and triggered Bitget's own authorisation process to move funds out. The initial $351.6 million figure was later revised to roughly $390 million in total. Bitget says cold wallets and the overwhelming majority of platform assets are unaffected and customer balances are accurate; withdrawals were suspended during the review and were due to resume on 28 September. Attribution points at North Korea: Bitget cites IP behaviour and on-chain analysis, TRM Labs ties the laundering infrastructure to the TraderTraitor group, and Elliptic sees overlap with addresses from earlier attacks attributed to the same programme.
Who's exposed: Bitget customers, though the company says balances are intact. The broader point applies to anyone holding cryptocurrency: assets on an exchange are secured by that exchange's internal controls, and here the attackers broke no cryptography, they got the company's own systems to approve the transfer.
Kiteworks told customers to switch their systems off for nine hours#
Kiteworks, formerly Accellion, asked customers to shut down their systems for nine hours over the weekend after receiving what it called credible threat intelligence from federal intelligence authorities that a threat actor may attempt to target some Kiteworks systems. It also told customers to apply the patches in version 9.5.1. This is a precaution, not incident response: the company says it has found no evidence any customer system was compromised, and no CVE was named. Subsidiaries including Zivver, DRACOON, totemo, ownCloud and Maytech are unaffected.
Who's exposed: organisations running Kiteworks managed file transfer. It is here less for what happened than for what the category has become. Managed file transfer products have been the most productive single target for extortion groups in recent years, and this is the same company whose FTA product was mass-exploited in 2021. A vendor asking paying customers to take a service offline for nine hours on a warning alone tells you how that history is read internally.
Two compromised GitHub Actions came back to life#
Malicious code was injected into two widely used GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, on 18 May, harvesting credentials from any CI/CD pipeline that ran them. The repositories were disabled, then on 16 September they were re-enabled for about seven hours and immediately resumed executing the payload for every workflow referencing them by version tag. GitHub has disabled them again. The important detail is that the malicious code was never removed from the version tags, so the risk persists for any workflow not pinned to a commit hash from before 18 May.
Who's exposed: development teams whose pipelines reference third-party Actions by a mutable tag like @v3 rather than a commit hash. If that is you, pin to hashes and rotate any secret those pipelines could see. This is the kind of thing that quietly becomes a company-wide breach, a pattern we wrote about in what actually breaks company security.
OnePlus and OPPO phones can be rooted by an app with no permissions#
Researchers chained two flaws in OnePlus's software: a root-level debugging service takes unchecked input into a system command, and a second service then runs shell instructions with full low-level Linux privileges, including the ability to load kernel code. Confirmed on a OnePlus 15 running the latest OxygenOS and on a OnePlus 12 Pro, and OnePlus says the same flaws affect many more of its devices and OPPO's, which share the codebase. The attack is local: a malicious app has to be installed and running already, but it needs no permissions and shows the user no prompt at all. There is no evidence anyone has used it in a real attack. OnePlus confirmed the flaws in May 2026 and, as of 24 September, had assigned no CVE and released no fix, while claiming an exclusive final right of disclosure and warning of legal liability for publication.
Who's exposed: OnePlus and OPPO owners, though your exposure is decided by where your apps come from, because nothing here works without a malicious app on the phone first. Sticking to Google Play and skipping sideloaded APKs removes almost all of the risk; the rest is in our Android hardening guide.
The week in CVEs#
| Identifier | Product | Exploited | Patch available |
|---|---|---|---|
| CVE-2026-85046 | Google Chrome (V8) | Yes | Yes, 152.0.7977.82/.83 |
| CVE-2026-87491 | Google Chrome (V8) | Yes | Yes, 153.0.8010.36/.37 |
| CVE-2026-85880 | Windows ALPC | Yes | Yes, September updates |
| CVE-2026-94127 | F5 BIG-IP APM | Yes | Yes, engineering hotfixes |
| CVE-2026-93616 | Check Point Security Management Server | Yes | Yes, from 22 September |
| CVE-2026-85102 | Check Point Spark and Security Gateway | Attempts observed | Yes, from 9 September |
| CVE-2026-65660 | SharePoint Server 2016, 2019, SE | Yes | Yes, 11 August updates |
| CVE-2026-67279 | MikroTik RouterOS | Yes, as part of a chain | Yes, 6.49.21 / 7.23.4 / 7.24.2 |
| CVE-2026-86060 | MikroTik RouterOS | Yes | Yes, same releases |
| CVE-2026-48842 | Roundcube Webmail | Yes | Yes, 1.6.16 / 1.7.1 |
| CVE-2026-87902 | WordPress core | No reports | Yes, 7.1.2 and backports |
| CVE-2026-35273 | Oracle PeopleSoft | Yes | Yes |
| Not yet assigned | Elementor 4.3.0 and 4.3.1 | No reports | Yes, 4.3.2 |
| Not yet assigned | OnePlus and OPPO OxygenOS | No | No |
Worth knowing about#
Microsoft took down a phishing service that never needed your password. EvilTokens sold access to more than 12,000 compromised inboxes across over 10,000 organisations by abusing the device authorisation flow: the victim is shown a real code and a button to the genuine Microsoft sign-in page, enters the code there, and the attacker's waiting session receives the tokens. A US court authorised the takedown, 50 sites were seized and 150 domains disabled, and UK police arrested two men on 11 September. Two things are worth taking from it. Because the victim completes a real sign-in, a one-time code from an authenticator app does not stop this; app-based codes are a real improvement over SMS but they are not phishing-resistant, and passkeys or hardware keys are. And Microsoft's note that access can survive a password reset if sessions and tokens are not revoked is the detail most incident checklists still miss.
Cloudflare fixed a flaw that handed one customer another customer's leftover disk data. In Cloudflare Containers and Sandboxes, disk blocks were not wiped before being reallocated, so researchers could write a small block and read back up to 60 KB of what had been there before, recovering directory listings, SQLite databases, browser profiles and .env credential files belonging to other customers. It was found through the bug bounty on 4 September and fully remediated by 19 September, and Cloudflare's records show only authorised testing ever touched it.
ShinyHunters claims it breached the FBI, and almost none of that is confirmed. The group says it took around 2 TB covering agents and job applicants, via a supposed Oracle PeopleSoft zero-day, and framed it as retaliation for an FBI advisory. No such PeopleSoft pre-authentication zero-day is known to exist, no data sample has been verified, and the FBI says only that it is investigating and that the point of breach, whether a third party or its own systems, is undetermined. What is solidly real is the older PeopleSoft flaw CVE-2026-35273, rated 9.8, back in mass exploitation with a firewall bypass that simply URL-encodes one character of the request path: many firewall rules match the literal path before decoding, while the application server decodes it and routes the request to the vulnerable component anyway.
Google was fined 403 million euros over location data. Ireland's Data Protection Commission found breaches of the GDPR rules on lawful and fair processing and on transparency, and that location data was kept longer than necessary across Web and App Activity, Location History and Location Accuracy, in practices running from May 2018 to February 2020. Google has six months to comply and 28 days to appeal to the High Court; the fine cannot be collected until an Irish court confirms it.
Summary#
- Check Chrome's version and restart it, then run Windows Update. Three actively exploited flaws in that chain are already patched.
- Download password managers and authenticator apps only from the vendor's own site. A fake LastPass Authenticator installer is disabling antivirus at kernel level and stealing browser-saved passwords.
- If you run a WordPress site, update core to 7.1.2 and Elementor to 4.3.2 today.
- Never run a script or paste a terminal command because a recruiter, an assessment or a web page's verification step asked you to. That one rule defeats both major social-engineering campaigns this week.
- F5 BIG-IP APM and Check Point Security Management Server both had unauthenticated 9.8 flaws exploited before patches existed. Check Point's was under attack for two months.
- Bitget lost roughly $351.6 million, later put nearer $390 million, because attackers got its own systems to authorise the transfers. Money on an exchange is secured by that exchange's internal controls.
- Two compromised GitHub Actions briefly came back online and resumed stealing CI/CD credentials. Pin third-party Actions to commit hashes, not version tags.
- App-based one-time codes are strong but not phishing-resistant. The EvilTokens takedown is the reason passkeys and hardware keys are the better answer, and why revoking sessions matters as much as changing a password.
If your organisation is unsure which of this week's items actually touch your systems, that is the question worth answering before the next one lands. bluwarden helps small and mid-sized organisations work out what they are genuinely exposed to and fix it in the right order. Get in touch.
This post summarises publicly reported security news for the week of 21 to 27 September 2026 and is general information, not tailored security advice. Details can change as vendors and researchers publish updates. Verify against the linked sources and your vendors' own advisories before acting.