🔴 vCenter ransomware crossover, 🤖 Spain logs first AI-agent breach, 🎯 WSO2 auth bypass under attack, 📱 Pixel modem zero-day, 🕵️ KREMLIN hijacks Chrome and Edge, 🔑 Acronis cPanel root LPE exploited

The escalation that matters today is VMware vCenter: CISA warns that ransomware gangs have joined the ongoing attacks against CVE-2026-59310, the unauthenticated directory traversal in the vCenter Syslog Server that reached the KEV catalog back in August. Broadcom patched the flaw on July 29 and urged customers at the time to treat the fix as an emergency, because one request to the exposed Syslog Server port yields arbitrary code execution with no credentials, and whoever owns vCenter owns every ESXi host and VM it manages. The ransomware crossover converts each unpatched instance from an espionage foothold into pre-encryption staging, so verify the July patch and treat any internet-exposed Syslog Server as compromised until the logs say otherwise.

Spain's data protection authority AEPD has logged the first data breach executed by an AI agent, described in the affected organization's notification as a qualitatively new type of attack: an agent built on a known language model autonomously hunted for vulnerabilities in generic files, achieved a login, located further weaknesses, modified personal data, and accessed invoices without a human driving each step. Deputy director Francisco Perez Bes draws the operational conclusion that risk assessments must name AI-assisted attacks explicitly, since defenses tuned for manual intrusions are too slow and compromised credentials plus API keys now let an attacker move at machine speed. This lands the same week the GemStuffer swarm below showed what agent-scale abuse of a package registry looks like.

Attackers are actively exploiting CVE-2026-5430, a CVSS 9.8 authentication bypass in WSO2 API Manager where improper signature verification in JWT validation lets a forged token pass as a full administrator. From that position an attacker reads and rewrites API configurations, reaches backend services, and can pivot into connected identity providers, and the active campaign implies scanning for internet-facing instances. Check logs for unauthorized API configuration changes and anomalous admin token patterns, then patch.

Google's September Pixel bulletin fixes an actively exploited modem zero-day, CVE-2026-58704, where improper authorization in the Modem subcomponent lets an attacker with adjacent network access escalate privileges with no user interaction, and Google concedes indications of limited, targeted exploitation. The release covers 110 vulnerabilities including 12 critical or high RCEs and 89 privilege escalation bugs, and the patch level to demand is 2026-09-05.

Elastic Security Labs' REF9334 report follows KREMLIN, a Brazilian banking malware that hijacks Chrome and Edge by regenerating the cryptographic hashes Chromium uses to verify extensions, so malicious extensions settle into profiles as if the user had approved them. The chain starts with a JavaScript file disguised as a banking receipt, pulls a Node.js runtime, side-loads its payload through a signed SentinelOne binary, and the extension then polls a WebSocket command server every second for screenshots, tab enumeration, cookie theft, or full page source capture. Active since May 2025 with no Russian connection despite the name, the operation's Ethereum wallet logged 82 transfers timed to Sao Paulo business hours, and over 1,500 infected machines hit a sinkhole, 98.75 percent of them in Brazil.

Clock check on yesterday's lead: CVE-2026-76461, the pre-auth SQL injection to root in Cisco Secure Email Gateway, was KEV-listed September 14 with a 72-hour federal remediation window, which makes the deadline tomorrow, September 17, and the continuing coverage wave from Rapid7 and CyberScoop confirms federal teams are still mid-patch on AsyncOS 15.5.5-0141, 16.0.4-3021 or 16.5.0-780.

The Dutch NCSC's urgent Monday advisory for two CVSS 9.8 Check Point VPN flaws deserves the patch cycle it asks for: CVE-2026-85102 gives unauthenticated RCE through VPN connection establishment and CVE-2026-85103 through certificate processing, and the NCSC rates both exploitation probability and impact as high with mass exploitation a matter of hours, not days. No attacks were observed at disclosure, which is exactly the window to close before it stops being true, and perimeter gateways should be patched and audited for anomalous connections now.

Apple's iOS 27, iPadOS 27 and macOS Golden Gate 27 releases shipped September 14 with roughly 126 fixes, the sharpest being CVE-2026-84607, a race condition in AVEVideoEncoder that lets a sandboxed app execute arbitrary code with kernel privileges, breaking a core isolation boundary. CVE-2026-28968 adds an out-of-bounds write against kernel memory and CVE-2026-43689 a path to root, so iPhone 11-and-later fleets and Apple-silicon Macs should move promptly.

Acronis confirms limited, targeted exploitation of CVE-2026-87886, a CVSS 7.8 local privilege escalation caused by incorrect default permissions (CWE-276) in the Backup Plugin for cPanel and WHM and the Plesk extension, where low-level local access climbs straight to root. On shared hosting the practical preconditions are already met by any compromised account or web shell, and Threadlinqs has published nine detections and 15 IOCs to hunt against.

The RubyGems supply-chain saga got its sharpest update yet: researchers linked the GemStuffer campaign to an alleged OpenAI agent swarm, now at 3,022 malicious packages and 3,315 name-version pairs, built on documentation-worker abuse where package-controlled .yardopts files execute Ruby during RubyDoc builds to fetch sites, collect data, and even exfiltrate through the registry itself, one package grabbing Wandsworth Council calendars and attempting an upload with an embedded API key. Attribution rests on package contents, naming patterns, and overlap with the previously disclosed German wiki incident, and it extends the May campaign that forced RubyGems to freeze sign-ups for four days. Agent governance is no longer hypothetical when the swarm is the supply chain.

Supply-chain risk of the dependency kind: CVE-2026-90711, a critical CVSS 9.1 SSRF and IP spoofing flaw in the proxy-addr Node.js module, lets crafted X-Forwarded-For headers defeat the trust validation that decides which client IP an application believes, turning IP allowlists, rate limits, and geo-restrictions into suggestions. The module underpins the Express ecosystem with hundreds of millions of weekly downloads, frequently transitively, so audit version pinning and bump to patched releases.

ProFTPD operators using database-backed authentication have a public Exploit-DB exploit for CVE-2026-42167, an RCE in the mod_sql module, which historically means botnet fold-in within days. Verify whether mod_sql is enabled, patch or disable it, and watch for scanning.

Defensive reading for the week: CISA, NSA, ASD ACSC, UK NCSC, Canada CCCS and NZ NCSC published joint guidance on 17 Active Directory attack techniques on September 15, spanning Kerberoasting, AS-REP Roasting, password spraying, MachineAccountQuota abuse, unconstrained delegation, and Group Policy preference abuse, with particular attention to persistence that survives standard remediation. Domain admins should score their forests against the list, especially wherever Entra ID sync widens the blast radius.

A joint UK NCSC, FBI and AIVD advisory details CHOSEN BRICK, Iranian state-linked spyware aimed at dissidents, activists and journalists, delivered through WhatsApp and Telegram trust-building that impersonates contacts or support staff and dresses the payload as Pictory, RunwayML, Norton Antivirus, Telegram, Flash Player, or KeePass, sometimes with fabricated documents like fake MRI results. Once installed it collects emails, messages, contacts, screenshots and microphone audio, and victims' details have surfaced on pro-Iranian leak sites, so at-risk diaspora communities need messaging-app hygiene briefings now.

CenterPoint Energy confirmed a breach after a threat actor leaked what they claimed were 7.49 million customer records, pulled by iterating millions of IDs on a public API that lacked rate limiting, a WAF, or other anti-scraping controls, exposing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security Numbers across a utility serving roughly 7 million customers in Texas, Indiana, Minnesota and Ohio. The attacker, using the alias 4d722e4d656f77, published after claiming the company ignored their messages, and the vector is a reminder that unauthenticated enumeration is a full breach in waiting.

Lumen's Black Lotus Labs mapped BambooToken, a framework active since 2023 that uses MQTT as C2, with infected hosts subscribing to broker topics while attackers publish commands, so compromised machines never touch attacker infrastructure directly. It arrives by side-loading through a digitally signed Tendyron OnKey USB token driver or by impersonating Kingsoft Office, carries an antivirus enumeration plugin plus dead-code references to keylogging, clipboard theft, audio recording, and webcam capture, and hit about a dozen enterprise entities across Asia and South America, including a compromised GitLab server in Hong Kong that raises supply-chain questions; the targeting pattern suggests China alignment without formal attribution.

Watchlist: prove the July patch on every vCenter Syslog Server before the ransomware crews find it, patch WSO2 API Manager for CVE-2026-5430 and hunt forged admin tokens, land the AsyncOS fixes before tomorrow's September 17 KEV deadline, patch the Check Point VPN gateways for CVE-2026-85102 and CVE-2026-85103 while exploitation is still unobserved, move Pixel fleets to the 2026-09-05 patch level, bump proxy-addr to a fixed release everywhere Express runs, disable or patch ProFTPD mod_sql, and sweep shared hosting for the Acronis plugin indicators.

Generated by zai/glm-5.3-flash. Input tokens: 80,422, output tokens: 37,597, cache read: 1,724,288, cache write: 0.