The extortion group ShinyHunters claimed on its dark web site that it breached the FBI and stole data on current and former employees and job applicants, naming Criminal Justice, HR, and Medlink services. A spokesperson told The Register the group exploited a new Oracle PeopleSoft zero-day to gain remote code execution and deface the FBI jobs site. The claim, first reported by 404 Media, is unverified, and the FBI has not confirmed any compromise. ShinyHunters framed it as retaliation for a May FBI advisory about its Canvas targeting, disputing those allegations and rejecting reported ties to the wider criminal collective. Treat the specifics as an attacker claim pending independent confirmation.
Vercel patched a critical flaw in Next.js ImageResponse, the feature that generates Open Graph and social preview images, that can let attackers run code on the server. Tracked as CVE-2026-94545 and rated 9.5, it affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the default Node.js runtime, and is fixed in 16.3.6. The Edge runtime and Next.js 15 are not affected. ImageResponse uses the Satori library to convert layouts into SVG before rendering, and apps are exposed when they pass attacker-controlled values, such as text from a request URL, into SVG content, attributes, or styles. As of disclosure there were no public exploits or reports of attacks.
ReversingLabs detailed a malicious npm package, tw-pkgprobe-7731, that masquerades as an authorized Twilio bug-bounty research probe while harvesting developer data. Uploaded in mid-August by an account that no longer exists, it shipped eleven versions within about 45 minutes. Comments inside describe it as an authorized HackerOne probe that runs only inside Twilio's serverless sandbox and takes no destructive action. On execution it first checks for a Twilio developer environment and exits otherwise, then collects environment variables plus system details like mounts and temporary folders and exfiltrates them through a webhook. Later versions specifically target developers using Twilio APIs by searching for folders tied to particular Twilio account identifiers, sharpening the credential theft.
Varonis Threat Labs detailed a post-compromise technique it calls TrustSink, in which an attacker holding a highly privileged Microsoft Entra account registers a rogue External Authentication Method as an external MFA provider. During normal sign-ins, Entra redirects users to the rogue provider to complete the second factor, and the attacker inserts a convincing Microsoft password prompt that captures the password in plaintext before returning a valid signed token, so the login completes with no error. In testing, every sign-in succeeded while the attacker server logged passwords with source IPs. Resetting a captured password does not remove the rogue provider, which persists in the configuration and works against any external provider model.
Arista disclosed on September 22 that attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator, the server that manages Edge devices across a VeloCloud SD-WAN. Tracked as CVE-2026-93952 and rated 10.0, it lets a remote attacker with no login reach internal functions and affect the orchestrator host, but only where Edges authenticate using certificates. A compromised orchestrator exposes the data it manages and can give access to the Edge devices under it. Arista says the flaw was found externally and is known to be actively exploited. Fixed releases exist for the 5.2 and 6.4 trains, with 6.1 and 7.0 still pending.
CISA added a Zyxel GS1900 series switch flaw to its Known Exploited Vulnerabilities catalog, citing active exploitation. Tracked as CVE-2026-7273 and rated 8.8, it is a stack-based buffer overflow in the switch firmware's CGI program that lets a LAN-based, unauthenticated attacker run operating system commands through a crafted HTTP request. Zyxel patched it in June across the GS1900-8 through GS1900-48HPv2 models. GreyNoise reported that a suspected Chinese-speaking actor has weaponized the flaw since August 17, successfully exploiting and exfiltrating data from 996 Zyxel switches across 48 countries. Federal agencies must patch under the KEV directive, and other operators should treat exposed management interfaces as a priority.
A flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave freed host memory exposed to a guest virtual machine when nested virtualization is enabled. Tracked as CVE-2026-89775, it lets a guest read and write host kernel memory, and the reporter says it can be used to escape the guest and run code on the host. A size calculation reaching zero skips a TLB invalidation, leaving a freed page mapped and writable with no hardware trap. It is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Nested virtualization is off by default and needs specific ARM hardware, and no exploitation is reported.
LastPass and Delphos Labs reported a fake LastPass Authenticator installer, hosted on a lookalike GitHub page, that installs a Windows kernel driver to shut off security software before a password stealer runs. The driver, named Alinubx.sys, was signed through Microsoft's hardware-compatibility program, scored zero detections on VirusTotal in August, and was not on Microsoft's blocklist. It carries 145 antivirus and security process names and terminates each from the kernel, below where endpoint tools can see or block it. The installer uses DLL side-loading through a renamed Microsoft debugger, escalates to SYSTEM, and ships in padded 128 to 148 MB archives to evade size-limited scanners.
In an authorised test reported by ABC Four Corners on September 21, automotive security researcher Dan Hreszczuk remotely locked doors, operated wipers and washers, toggled headlights while the vehicle moved slowly, and played media through the infotainment system of a BYD Shark 6, while also tracking it and accessing in-cabin audio. He said the access path his team used had no password. He could not reach brakes or cameras and considered those well protected, and found no control over steering or acceleration. ABC did not publish the model year, software build, initial access method, affected versions, or a vulnerability identifier, so fleet-wide reproducibility remains unestablished.
Blackpoint researchers documented ChainScript, a previously unseen remote access trojan spread through ClickFix-style lures that impersonate Spotify, Zoom, and Microsoft Teams. It uses an EtherHiding-style technique, querying a Polygon smart contract to locate its active WebSocket command infrastructure so operators can rotate servers without changing the malware. The chain starts with a ClickFix lure leading to a malicious MSI run through msiexec, which deploys a Node.js runtime and launches a JavaScript agent through hidden PowerShell and VBScript stages dropped into Microsoft-looking paths under LOCALAPPDATA. ChainScript offers interactive command shells, file operations, screenshots, remote JavaScript, and enumeration of cryptocurrency wallets in both desktop applications and browser extensions.
TrustStrike Labs