🔴 Zyxel GS1900 KEV add, 🌐 BlueMoon's third actor UTA0565, 🏛️ wp2shell govt data theft, 💥 PAYLOAD encryptionless GPO ransomware, 💾 Veeam Agent exploited, 🇰🇵 Japan's first DPRK laptop farm takedown

The day belongs to network edge gear: CISA added CVE-2026-7273 to the KEV catalog, a CVSS 8.8 stack-based buffer overflow in Zyxel GS1900 series switches that lets an unauthenticated attacker execute OS commands with a single HTTP request and, per CISA, has been exploited to steal data. Zyxel fixed it in firmware 2.20.1, but these switches are rarely on anyone's emergency patch list, which is exactly why the federal remediation deadline matters; if a GS1900 sits at your network edge, treat it as compromised until patched and audited.

[REVISIT] Volexity's "Mind the Patch Gap, Part 2" extends the BlueMoon saga with a third China-nexus actor: UTA0565 joined UTA0560 and JungleBamboo in chaining the Chrome V8 flaws CVE-2026-85046 and CVE-2026-87491 with the Windows kernel escalation CVE-2026-85880, observed on September 3 and 4 while Chrome remained unpatched. The new activity used typosquatted clones of China Digital Times and the Center for American Progress, plus lures invoking jailed Hong Kong activist Chow Hang-tung, to deliver a previously undocumented backdoor. Three distinct groups monetizing the same kit means the patch gap, not the individual CVEs, is the attack surface.

[UPDATE] The wp2shell WordPress chain has a body count: GreyNoise telemetry ties the exploitation of CVE-2026-63030 and CVE-2026-60137 to at least 49 compromised organizations across 29 countries since July, mostly government and small-business targets, with one Western government agency losing 18,566 records after the attacker, a suspected Chinese-speaking operator possibly linked to Red Heron, deployed a web shell, dumped 13 admin accounts, and backdated a rogue administrator account to blend in. Patched sites are the floor; audit for backdated admin accounts and stray plugins.

[UPDATE] WordPress 7.1.1's worth was re-proven today: Comment2Shell shows CVE-2026-93485 lets a completely unauthenticated blog comment trigger stored XSS that escalates to remote code execution the moment an administrator views it. No login, no plugin, one comment; if core is not yet on 7.1.1, that gap is now a one-comment compromise.

[NEW] Veeam Agent for Microsoft Windows carries CVE-2026-32996, a critical flaw under active attack with public PoC exploit code available, added to KEV in the same September 21 batch as the Zyxel switch bug. Backup infrastructure is the last thing you want attackers holding; patch agents and rotate any credentials reachable from backup servers.

[NEW] Kaspersky's GERT details PAYLOAD ransomware, which extorted a Middle Eastern manufacturer in April without encrypting a single Windows file: after reaching domain-admin-equivalent privileges, the attacker linked a malicious GPO named PAYLOAD at the domain root to drop ransom notes, swap wallpaper and lock screens, and disable the local Administrator account, while a second GPO switched off Windows Firewall across every profile; the only encryptor seen targeted ESXi. A signed, SYSTEM-privileged distribution channel abused as the extortion payload is a TTP every EDR stack should be tested against.

[NEW] Zscaler ThreatLabz reports Vidar now hides its strings behind a lightweight custom virtual machine and per-build stream ciphers, having progressed from XOR to modified ChaCha20 between May and September 2026, so every build looks unique at the byte level while doing the same work. Static signatures age out fast against this; behavioral and runtime detection is the durable answer.

[NEW] D-Link's advisory SAP10516, updated September 18, discloses CVE-2026-86296, a CVSS 10.0 unauthenticated stack-based buffer overflow in non-US DIR-822A routers, and a public PoC is already circulating. These routers are effectively end-of-life consumer gear; replace rather than patch.

[UPDATE] The NightmareStresser takedown widened: the DOJ has now seized nightmare-stresser.com and nightmarestresser.org, extending the FBI and RCMP action against the DDoS-for-hire service behind hundreds of thousands of attacks. Expect the operator to rebrand, but the seizure infrastructure feeds future prosecutions.

[NEW] Japan's National Police Agency, the FBI, and Australian and German partners published a joint advisory on WaterPlum, also known as Contagious Interview, and announced Japan's first-ever takedown of a North Korean laptop farm. The advisory ties the fake-employer campaign, which hit at least 30,000 devices in over 100 countries between December 2025 and July 2026 and moved roughly $10.71 million from more than 7,000 crypto wallets, to operators linked to Pyongyang's broader IT-worker scheme. Laptop farms live where the laptops are; landlords and hosting providers are now part of the detection surface.

[NEW] Colorado's governor's office confirmed foreign hackers targeted water utilities in August, with intrusions reaching operational technology systems. No disruption has been attributed publicly, but state-level confirmation of OT reach in US water infrastructure keeps this sector at the top of the civilian risk list.

[NEW] Synology patched eight DSM vulnerabilities, including two critical unauthenticated flaws tracked as CVE-2026-13684 and CVE-2026-13639 in DiskStation Manager. Internet-exposed NAS boxes are constant scan targets; apply the update before the PoCs do the walking.

[NEW] Zscaler's reporting on Operation RapidRust shows Pakistan-aligned APT36 running a high operational tempo since January, deploying a refreshed Rust-based toolkit including RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH. Rust rewrites are costly for the actor and for defenders alike; re-baseline detections for this group rather than relying on the January toolset.

[NEW] A vendor trust-score sweep flagged Reolink cameras with 22 CVEs, 100 percent unpatched, hard-coded cryptographic keys and command injection flaws. CCTV at the edge with baked-in keys is an easy pivot point; segment camera VLANs and track vendor patch posture before buying.

Watchlist: hunt for GS1900 switches and unpatched Veeam Agent installs tonight before the KEV deadline pressure brings mass scanning, sweep WordPress estates for backdated admin accounts and stray plugin webshells left by wp2shell, audit GPOs for objects you did not create, and treat any unsolicited recruiter coding test or blog comment on an unpatched WordPress admin view as hostile input.

Generated by zai/glm-5.3-flash. Input tokens: 53,418, output tokens: 11,782, cache read: 673,408, cache write: 0.