🔥 F5 BIG-IP APM zero-day exploited, 🛡️ Check Point management RCE in the wild, 🌐 VeloCloud CVSS 10 KEV add, 🇨🇳 GreyNoise names Zyxel switch actor, 🤖 CLOSEDQUORUM AI-deciding malware, 🏛️ Florida DMV breach confirmed

The day's defining story is F5's disclosure of CVE-2026-94127, a critical zero-day in BIG-IP APM under active exploitation for unauthenticated remote code execution. The flaw hits virtual servers configured as an OAuth Authorization Server with both an APM access policy and an OAuth profile present; F5 confirmed exploitation and advises hunting for combined OAuth authentication failures and suspicious commands followed by a TMM SIGABRT. Shadowserver counts more than 14,700 exposed BIG-IP APM IPs worldwide, and an iRule from F5 Support serves as the stopgap until patches land. An in-the-wild RCE on a widely deployed access proxy with a five-figure exposed footprint is the remediation priority of the day.

[NEW] Check Point confirmed CVE-2026-93616, a CVSS 9.8 directory traversal and arbitrary file upload flaw, is being exploited in the wild. It affects Security Management Server, Multi-Domain Security Management, Log Server and SmartEvent, letting unauthenticated attackers upload and execute scripts. Hotfixes are out for R82.20, R81.20, R81 and R82, and LivePatch does not fix it; CISA added it to KEV. Restrict management access and TCP/19009 to trusted IPs and sweep for Check Point's released IOCs. A management-plane RCE with confirmed victims is a crown-jewel exposure, not a routine patch.

[NEW] Arista confirmed active exploitation of CVE-2026-93952, a CVSS 10.0 bug in the VeloCloud Orchestrator that grants unauthenticated remote access to certificate-based SD-WAN appliances; CISA added it to KEV with a Friday federal deadline. Edge orchestration planes that trust every branch should be patched before that deadline, not after the first breach report.

[NEW] The above three, plus CVE-2026-85102, arrived together in CISA's latest KEV batch of four known exploited vulnerabilities, a single update confirming active exploitation across edge, management and orchestration layers. When one catalog update names three vendor consoles attackers are already inside, the pattern is the message: internet-facing management planes are the week's hunting ground.

[UPDATE] The Zyxel GS1900 switch bug CVE-2026-7273 covered yesterday has a face now: GreyNoise attributes active exploitation to a Chinese actor that used a heavily obfuscated Python script in August to pull hashed root credentials, configuration and network data from 996 vulnerable switches across 48 countries, and 564 of those devices had factory default credentials left in place. The same actor chained Ubiquiti flaws in the same push, and the KEV remediation deadline is September 24. If a GS1900 sits at your edge, assume it was harvested and rotate everything it touched.

[REVISIT] CISA has confirmed the WatchGuard Firebox RCE CVE-2025-14733, patched since December 2025, is now being exploited in ransomware attacks, with roughly 125,000 exposed IPs still visible. A nine-month-old patch driving this quarter's ransomware intrusions says the problem is unpatched fleets, not undisclosed bugs; audit firewall inventory before it becomes an incident.

[NEW] WordPress 7.1.2 fixes CVE-2026-87902, a CVSS 9.2 unauthenticated path traversal in core that lets an attacker include a readable PHP file outside the active theme directory and, under the right server conditions, reach full site compromise. Updates cover branches back to 4.7, so there is no excuse to remain vulnerable, and theme-dependent exploitation conditions mean scanning will start before exploitation does.

[REVISIT] The ShinyHunters FBI breach claim we flagged yesterday now has a mechanism: the group says it got in through an unpatched Oracle PeopleSoft RCE and moved laterally into AWS GovCloud, alleging theft of data on employees and applicants. No CVE is assigned and the FBI has not confirmed, so treat it as an unverified claim; the watch item is Oracle's response and whether a PeopleSoft zero-day lands formally.

[NEW] ManageEngine patched CVE-2026-74849, a CVSS 9.8 unauthenticated RCE in the ADSelfService Plus GINA client; the advisory urges an immediate update to build 7001. Password self-service endpoints hold domain credentials on every workstation that loads the agent, which makes this the kind of bug that becomes domain-wide compromise if exploited before you patch.

[NEW] Cisco Talos, via its CAIRN research track, has documented CLOSEDQUORUM, the first Windows implant built to outsource tactical decisions to commercial AI models: the 16.4 MB Go binary prompts DeepSeek, Qwen, Mistral and Gemini with host data, plurality-votes on the responses, then executes the winning action, whether credential theft, code injection, persistence or lateral movement. Development artifacts tie it to carding forums since 2025, though active campaigns are unconfirmed. Malware that votes on its own next step breaks indicator-based detection assumptions; classification of AI-integrated artifacts is the new baseline.

[NEW] Microsoft disrupted EvilTokens, the Storm-2992 phishing-as-a-service platform behind more than 12,000 compromised inboxes across over 10,000 organizations. It sold phishing templates, token management and AI-assisted email customization, and its signature device-code phishing abused legitimate OAuth flows to hijack accounts without stealing passwords. Restricting device-code flows via conditional access and reviewing OAuth consent grants removes its favorite door.

[NEW] An Armenian national, Karen Serobovich Vardanyan, was sentenced to 24 months for his role in Ryuk ransomware attacks on US companies between March 2019 and June 2020, specializing in initial access and helping deploy ransomware across hundreds of servers; victims included a Michigan company that paid over $1.1 million in bitcoin, and prosecutors tally the group's proceeds at roughly 1,610 BTC, over $15 million. The sentence lands years after the attacks, a reminder that initial-access brokers face real legal risk on a very slow clock.

[NEW] A supply-chain breach through one compromised marketing tool hit more than 100,000 websites: a flawed SAML SSO implementation exposed a Cloudflare API key that attackers used to inject rogue JavaScript at scale. If the affected tool is embedded in your properties, you inherited someone else's breach; audit for injected scripts and rotate any Cloudflare credentials the integration could reach.

[NEW] The Florida DMV breach claimed by ShinyHunters is now confirmed, with 612,982 ZIP archives containing SSN cards and license data tied to the same actor now claiming the FBI intrusion. State identity documents in criminal hands supercharge the phishing and SIM-swap chains behind nearly everything else in this brief.

[NEW] Vercel patched CVE-2026-94545, a critical RCE in Next.js image generation; the fix is out, so the window is now a straight race between patching and mass scanning of a framework that runs a large share of the modern web.

[NEW] Storm ransomware hit Insight Credit Union, pairing data theft with operational disruption at a financial institution. No CVE attaches; the actionable item for credit unions and community banks is verifying backup isolation, testing recovery timelines, and reviewing the third-party access that ransomware crews routinely abuse for entry.

Watchlist: tonight, inventory OAuth-configured BIG-IP APM virtual servers, Check Point management servers with TCP/19009 exposed, and VeloCloud Orchestrators ahead of the Friday KEV deadline; tomorrow, expect scanning waves against WordPress cores below 7.1.2 and unpatched Next.js image pipelines, and watch for Oracle's response to the PeopleSoft claim and the first CLOSEDQUORUM sighting in a live campaign.

Generated by zai/glm-5.3-flash. Input tokens: 42,588, output tokens: 6,817, cache read: 460,864, cache write: 0.