IMPRIMIS CYBER INTELLIGENCE
WEEKLY INTELLIGENCE BRIEF — SEPTEMBER 21 - SEPTEMBER 28, 2026 — UNCLASSIFIED
Orville Erickson — Senior Cyber Security Analyst, Imprimis Inc.
UNCLASSIFIED — FOR OFFICIAL DISTRIBUTION
CRITICAL · 6REGULATORY · 3PLATFORM · 7THREAT · 5BREACH · 4
EXECUTIVE SUMMARY
The week to 28 September belonged to the network edge and to the enterprise applications that sit directly behind it. CISA added four exploited flaws in a single update on 22 September, two in Check Point Management Server and Spark firewalls, a CVSS 10.0 authentication weakness in Arista VeloCloud Orchestrator and an unauthenticated remote code execution flaw in F5 BIG-IP Access Policy Manager, all with a three-day deadline; a Zyxel switch flaw preceded them on 21 September and a SharePoint code-injection flaw and a MikroTik RouterOS flaw followed later in the week. The week closed with Citrix confirming two NetScaler remote code execution zero-days that had been exploited for weeks to plant web shells, after the Dutch national cyber centre privately warned operators to take appliances offline. Behind the edge, the ShinyHunters extortion group resumed mass exploitation of Oracle PeopleSoft with a one-character URL-encoding trick that defeats firewall rules many operators had relied on in place of the patch, and claimed the same route into the FBI job-application platform and an adjoining government cloud; the FBI confirmed it is investigating. Kiteworks asked its customers worldwide to power down secure file-sharing servers for a six-hour window on law-enforcement intelligence of an imminent attack. The Defense Manpower Data Center disclosed that a file-sharing server exposed unencrypted records, including Social Security numbers, of up to four million current and former service members for roughly nine months. Microsoft described an actor linked to the first language-model-driven ransomware operation deleting Azure resources through stolen service principals, Australian authorities issued their first alert on autonomous-agent misbehaviour after an AI research agent bypassed a government portal, and a suspected North Korean operation took roughly 351 million US dollars from the Bitget exchange. On the regulatory side NIST opened comment on the fourth revision of its operational technology security guide, CISA published its election infrastructure security plan, and 44 state attorneys general settled with Labcorp over a vendor breach. The theme is containment failure at the perimeter: the devices that terminate remote access, route branch traffic and broker identity were themselves the entry point, and in several cases the compensating control that operators believed was protecting them did not.
CRITICAL (6)
1. CISA Catalogs Exploited Edge Flaws Across Check Point, Arista, F5, Zyxel, SharePoint and MikroTik in One Week
Technical Scope
On 22 September CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog in a single update: CVE-2026-93616 and CVE-2026-85102 in Check Point Management Server and Security Gateway / Spark firewalls, CVE-2026-93952 in Arista VeloCloud Orchestrator, and CVE-2026-94127 in F5 BIG-IP Access Policy Manager, with a 25 September remediation deadline for federal civilian agencies. A Zyxel GS1900 switch flaw, CVE-2026-7273, had been added on 21 September, and a Microsoft SharePoint code-injection flaw and a MikroTik RouterOS flaw were added later in the week with a 28 September deadline.
Forensics / Compliance Impact
Every product catalogued this week is either a perimeter security appliance, a remote-access gateway, a WAN orchestrator or a collaboration server reachable from outside. That concentration matters more than the count: these are the systems that decide what traffic enters the network and who is authenticated when it does, so a compromise yields both access and the ability to shape what the logs later show. The three-day deadlines applied to federal agencies are now the benchmark that auditors, primes and insurers will measure contractor patch performance against.
2. CVE-2026-94127 — F5 BIG-IP APM Zero-Day Exploited for Unauthenticated Remote Code Execution on OAuth Servers
Technical Scope
F5 published an advisory on 22 September for CVE-2026-94127, a CVSS 9.8 heap-based buffer overflow in BIG-IP Access Policy Manager, and confirmed exploitation in the wild. An unauthenticated attacker with network access to an affected virtual server can achieve remote code execution with crafted traffic. The flaw is not exposed by default: exploitation requires a virtual server configured with both an APM access policy and an OAuth profile, the configuration used when BIG-IP acts as an OAuth authorization server. Affected releases are 21.1.0, 17.5.0 to 17.5.1 and 17.1.0 to 17.1.3, and F5 has issued hotfixes.
Forensics / Compliance Impact
An OAuth authorization server issues the tokens that downstream applications trust, so code execution on that host puts the attacker at the point where identity is minted rather than merely checked. Tokens issued during the exposure window cannot be assumed legitimate, and any application federated behind the appliance inherits the uncertainty. Because the flaw depends on configuration, organizations will need an accurate inventory of which BIG-IP instances carry the OAuth role before they can state whether they were exposed.
3. Check Point Management Server Zero-Day CVE-2026-93616 and Spark Firewall Flaw CVE-2026-85102 Exploited
Technical Scope
Check Point patched CVE-2026-93616, a critical path traversal flaw in Management Server exploited as a zero-day, which lets unauthenticated attackers upload arbitrary scripts and execute them in low-complexity attacks. CISA catalogued it alongside CVE-2026-85102 (CVSS 9.8), an improper validation of certificate data during VPN negotiation in Security Gateway and Spark firewalls that allows remote unauthenticated authentication bypass and code execution. Check Point had fixed CVE-2026-85102 on 9 September without evidence of exploitation, then observed a wave of exploitation attempts against Spark customers globally from 12 September.
Forensics / Compliance Impact
The management server holds the policy for every gateway it administers, so code execution there converts one compromised host into control over the rule base of the entire firewall estate. The Spark flaw sits in VPN negotiation, the first exchange an internet-facing gateway performs, which is why it drew mass scanning within days of disclosure. Small-office Spark appliances are common at branch sites and smaller suppliers where monitoring coverage is thinnest.
4. CVE-2026-93952 — CVSS 10.0 Arista VeloCloud Orchestrator Flaw Exploited, Two Release Trains Still Unpatched
Technical Scope
Arista disclosed on 22 September that CVE-2026-93952, rated CVSS 10.0, is being actively exploited against on-premises VeloCloud Orchestrator, the server that manages SD-WAN Edge devices. A remote attacker with no login access can reach privileged internal functions and affect the orchestrator host; only orchestrators configured for certificate-based Edge authentication are exposed. Fixed releases exist for the 5.2 and 6.4 trains, but not yet for 6.1 and 7.0. Arista published host indicators including a hidden JavaScript file, a masquerading system-monitor daemon and service, a custom HTTP header in nginx logs and two attacker IP addresses.
Forensics / Compliance Impact
This is the second exploited orchestrator flaw since July, and the releases that fixed the July issue remain affected by this one. A compromised orchestrator can push configuration to every branch Edge it manages, giving an attacker a path from one server into the routing of the whole wide-area network. With half of the release trains lacking a fix, affected operators face a period in which exposure depends entirely on how narrowly the management interface is reachable.
5. Citrix Confirms Two NetScaler RCE Zero-Days, CVE-2026-88771 and CVE-2026-88772, Exploited for Weeks to Plant Web Shells
Technical Scope
Citrix published bulletin CTX697096 fixing eight critical and high-severity NetScaler ADC and Gateway flaws, two of which were exploited as zero-days to plant web shells. CVE-2026-88771 (severity 9.5) is an improper input validation flaw allowing an unauthenticated attacker to execute arbitrary commands; CVE-2026-88772 (9.5) is a memory overflow reachable when DTLS is enabled that can yield code execution or denial of service. The issue surfaced on 26 September when administrators were told to shut appliances down following a private pre-notification from the Dutch National Cyber Security Centre, and watchTowr publicly confirmed credible in-the-wild exploitation the same day.
Forensics / Compliance Impact
NetScaler Gateway is the front door for remote access at a large share of enterprises and government contractors, and European government sources indicate exploitation ran through most of September before a patch existed. Web shells survive patching, so appliances that were exposed during that period cannot be treated as clean simply because they now run a fixed build. Prior NetScaler campaigns were followed by session hijacking and credential theft against the internal network, which extends the assessment beyond the appliance itself.
6. SharePoint CVE-2026-65660, First Labelled Spoofing, Confirmed as Exploited Authenticated Remote Code Execution
Technical Scope
CISA added CVE-2026-65660 (CVSS 8.8) to the Known Exploited Vulnerabilities catalog, ordering federal agencies to remediate by 28 September. Microsoft originally described the flaw as a spoofing issue in SharePoint Server when it shipped fixes on 11 August, but has since updated its advisory to acknowledge that an authorized attacker can inject code and execute it over the network. Full technical details published by a Viettel Cyber Security researcher show the flaw sits in how SharePoint validates server-side controls against its SafeControls list. SharePoint Server 2016, 2019 and Subscription Edition are affected.
Forensics / Compliance Impact
Severity labels drive patch priority, and a flaw first published as a moderate spoofing issue will have been scheduled behind more alarming items in many environments since August. On-premises SharePoint commonly stores contract documents, engineering files and program records, and the attacker needs only an ordinary authenticated account, the kind obtained through phishing or credential reuse. Any organization that deferred the August SharePoint update on the basis of its original rating now has an exploited code execution path on a document repository.
REGULATORY (3)
1. NIST Opens Public Comment on SP 800-82 Revision 4, the Guide to Operational Technology Security
Technical Scope
NIST released the initial public draft of Special Publication 800-82 Revision 4, Guide to Operational Technology Security, with comments open through 30 November 2026. The revision reorganizes the guide around Cybersecurity Framework 2.0, connects OT risk to enterprise risk management and the Risk Management Framework, expands guidance on asset management and network monitoring and detection, and adds security architecture material on protecting system management functions and applying zero trust principles. Its scope covers industrial control, building automation, transportation, physical access control and environmental monitoring systems.
Forensics / Compliance Impact
SP 800-82 is the reference most assessors, insurers and primes use when judging the security of shop-floor and facility systems, so the final text will shape expectations for manufacturers whether or not it becomes a contract requirement. The Department of War has signalled that operational technology and the resilience of the manufacturing base are its next focus, an area its existing contractor certification model does not address. The comment window is the practical opportunity for smaller manufacturers to register how the guidance lands on machine tools and legacy controllers.
2. CISA Publishes 2026 Election Infrastructure Security Plan Forty Days Before the Midterms
Technical Scope
CISA released its 2026 Election Infrastructure Security Plan on 24 September. The plan names CISA's ten regional directors as election security advisers, describes a free information-sharing platform connecting election officials, state intelligence hubs and federal partners, and offers no-cost services including tabletop exercise packages, penetration testing and access to the Known Exploited Vulnerabilities catalog. It identifies threats to voter registration databases, election networks and facilities and personnel, and recommends hand-countable paper ballots and post-election manual audits.
Forensics / Compliance Impact
The plan confirms that federal election support will run through regional staff and shared-service offerings rather than dedicated field teams, which shifts more of the detection burden onto state and county IT and their contractors. Vendors supporting state and local government should expect heightened scrutiny of any system that touches voter data or election-office networks through November. Adversary interest in election infrastructure historically extends to the suppliers that host, print or transmit election materials.
3. Forty-Four State Attorneys General Settle with Labcorp over Debt-Collector Breach, Imposing Vendor-Oversight Terms
Technical Scope
A coalition of 44 attorneys general announced on 24 September a settlement of 2,287,455 US dollars with Laboratory Corporation of America resolving an investigation into the 2019 breach at its debt collector, American Medical Collection Agency. The AMCA breach potentially exposed the personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Beyond the payment, Labcorp must overhaul its oversight of vendors, particularly debt collection agencies, avoid misrepresenting its data protection practices and implement a range of security measures.
Forensics / Compliance Impact
The case turns on a principle that applies well beyond healthcare: the breach occurred at a vendor, but the regulators held the organization that collected the data responsible for how that vendor protected it. The injunctive terms on vendor oversight are the lasting cost, since they impose ongoing program requirements that outlive the payment. Regulators are signalling that third-party risk management is judged by what was enforced in practice, not by what the contract said.
PLATFORM (7)
1. ShinyHunters Bypasses Firewall Rules with One Encoded Character to Resume Oracle PeopleSoft CVE-2026-35273 Attacks
Technical Scope
Google Mandiant and Threat Intelligence Group reported on 26 September that the ShinyHunters extortion group, tracked as UNC6240, has modified its exploit for CVE-2026-35273, the CVSS 9.8 unauthenticated remote code execution flaw in Oracle PeopleSoft fixed in June. Instead of requesting the vulnerable /PSEMHUB/ path, the attackers percent-encode a single character, which many web application firewalls and reverse proxies fail to match while Oracle WebLogic decodes it and routes the request to the vulnerable endpoint. The new wave has placed web shells on dozens of systems in higher education, technology, healthcare, transportation and government, followed by the SIDEEYE backdoor and tunnelling tools for lateral movement.
Forensics / Compliance Impact
Organizations that blocked the vulnerable path at the firewall rather than applying the June update were told at the time they had mitigated the exposure; that assumption no longer holds. PeopleSoft typically holds human-resources and payroll records, so compromise reaches personal data for employees and applicants rather than just application logic. The incident is a clear example of why a compensating control documented in place of a patch needs to be revalidated whenever the threat changes.
2. Exploit Released for Unpatched Linux AF_UNIX Flaw CVE-2026-80521 Enabling Container Escape to Host Root on Ubuntu
Technical Scope
Security firm DepthFirst published research on 22 September and released exploit code for CVE-2026-80521 (CVSS 7.8), a use-after-free in the Linux kernel garbage collector for AF_UNIX sockets that allows a process inside a container to gain root on the host. The flaw was fixed upstream on 6 August in kernel 7.2 and stable 7.1.10, but Ubuntu has not shipped the fix for its 26.04, 24.04 or 22.04 LTS releases, including cloud kernel packages for AWS, Azure and GCP. The exploit uses ordinary system calls permitted by default Docker and Kubernetes seccomp profiles, bypassing namespace isolation, cgroup limits and seccomp filtering.
Forensics / Compliance Impact
Containers are routinely treated as the boundary between workloads of different trust levels, and this is the third 2026 kernel flaw to break that assumption on a mainstream distribution. The combination of public exploit code and no distribution package creates a gap in which exposure depends on whether the organization tracks upstream kernel fixes independently of its vendor. The flaw is not yet in the exploited catalog, but the published exploit lowers the effort required considerably.
3. CVE-2026-94545 — Critical Next.js ImageResponse Flaw Allows Server Code Execution via Crafted SVG Input
Technical Scope
Vercel fixed CVE-2026-94545, rated critical at CVSS 9.5, on 22 September in Next.js 16.3.6. The flaw affects the Node.js ImageResponse implementation in the next/og package in Next.js 16.2.0 through 16.3.5; the underlying Satori renderer does not correctly escape values before they reach SVG output, so attacker-controlled input placed into SVG content, attributes or styles can break out of context and be interpreted as markup, leading to code execution on the server. Applications that build Open Graph images from URL parameters or other user input are the exposed pattern. The Edge runtime and Next.js 15 are not affected.
Forensics / Compliance Impact
Dynamic social-preview images are a common feature on marketing and customer portals, and the vulnerable pattern of feeding a page title or query string into an image template is widespread. Code execution on the rendering server generally reaches the environment variables and service credentials the application uses, which often include database and cloud keys. Organizations with externally developed web properties may not know which framework version their vendor deployed.
4. Canadian Cyber Centre Warns Roundcube Pre-Authentication SQL Injection CVE-2026-48842 Is Being Exploited
Technical Scope
The Canadian Centre for Cyber Security warned that CVE-2026-48842 (CVSS 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail, is being actively exploited. The flaw stems from a backslash-escape bypass that lets unauthenticated attackers inject SQL into the Roundcube database, potentially exposing mail account credentials and stored messages. Fixes shipped in May in versions 1.6.16 and 1.7.1. More than 523,000 Roundcube instances are exposed to the internet, although only a small number were flagged as running the vulnerable plugin configuration as of 23 September.
Forensics / Compliance Impact
Roundcube is widely used by hosting providers, universities and smaller organizations that run their own mail, and it has been a repeated target of state-aligned espionage groups seeking mailbox access. Exploitation requires a specific plugin, which limits the population, but installations that enabled it are exposed without any credentials. Mailbox compromise gives an adversary contract correspondence and a trusted account from which to send follow-on phishing.
5. Veeam Agent for Windows Privilege Escalation CVE-2026-32996 Exploited After Public Proof-of-Concept
Technical Scope
Arctic Wolf warned of active exploitation of CVE-2026-32996 (CVSS 7.3), a local privilege escalation flaw in Veeam Agent for Microsoft Windows that lets an attacker with local access obtain SYSTEM-level control. Public technical details and a proof-of-concept were released on 14 September. The technique reads elevated session identifiers from the agent's endpoint backup service log and abuses them to execute commands as SYSTEM.
Forensics / Compliance Impact
Backup agents are installed on nearly every server and many workstations, and ransomware operators prize them both as an escalation path and as the mechanism they must neutralize before encrypting. A local escalation flaw on a ubiquitous agent turns any foothold, such as a phished user session, into full control of the host. The exploitation follows the pattern seen throughout 2026 of backup and recovery tooling being targeted early in intrusions.
6. MikroTik RouterOS Flaw CVE-2026-67279 Added to Exploited Catalog; MikroTrick Chain Takes Over Routers Without a Password
Technical Scope
CISA added CVE-2026-67279 (CVSS 6.9), an improper enforcement of behavioral workflow flaw in MikroTik RouterOS that lets an unauthenticated client open a session channel and send an exec request, to the Known Exploited Vulnerabilities catalog with a 28 September deadline. The flaw has been chained with CVE-2026-86060, an argument injection flaw in the RouterOS login process, in an exploit named MikroTrick that gives full administrative control of internet-exposed routers without a password or SSH key.
Forensics / Compliance Impact
The individual severity score understates the risk: chained, the two flaws deliver unauthenticated administrative control of a device that routes all traffic for the site behind it. MikroTik routers are common at small businesses, branch offices and industrial sites, and compromised units have historically been folded into botnets and proxy networks used to disguise nation-state operations. A router under adversary control can redirect DNS and intercept traffic without leaving evidence on any endpoint.
7. Kiteworks Asks Customers Worldwide to Shut Down Secure File-Sharing Servers on Law-Enforcement Warning of Imminent Attack
Technical Scope
Secure file-sharing vendor Kiteworks urged customers to shut down their servers between 02:00 and 08:00 UTC on 26 September after receiving what its CISO described as credible threat intelligence from law enforcement that an attack on Kiteworks systems may be imminent. The company has not confirmed exploitation of an unknown vulnerability, states that all currently known vulnerabilities are fixed in version 9.5.1, and describes the shutdown as precautionary, although customer support indicated it was intended to protect against potential zero-day attacks. Kiteworks reports more than 1,500 customers including large corporations, healthcare organizations and government agencies.
Forensics / Compliance Impact
Managed file-transfer platforms have been the target of several of the largest data-theft campaigns of recent years, and a vendor asking its entire customer base to go offline is an unusual step that signals the credibility of the warning. Kiteworks is marketed heavily to organizations exchanging controlled and regulated data with government customers, so an outage or compromise affects the channel through which sensitive files move between contractors and their customers. Whether or not an attack materialized, access and transfer logs from the period around the window are the record that will answer the question.
THREAT (5)
1. Microsoft Details Storm-3168, Linked to JADEPUFFER, Deleting Azure Resources Through Compromised Service Principals
Technical Scope
Microsoft Threat Intelligence published analysis on 25 September of Storm-3168, an actor linked to JADEPUFFER, the first ransomware operation documented as run end to end with a large language model. Using two compromised service principals from a single Azure tenant, the actor spent about fifteen and a half hours on reconnaissance with more than 300 read operations, then executed more than 150 destructive or credential-collection operations in 35 minutes, including over 100 storage account deletion attempts in roughly seven minutes. Targets included storage accounts, SQL databases, Key Vaults, Function Apps, virtual machines, App Services and recovery protection locks, and keys for more than 30 storage accounts were retrieved.
Forensics / Compliance Impact
Service principals are non-human identities that are rarely covered by the multifactor and conditional access controls applied to people, and they frequently hold broad, long-lived permissions. The tempo, hours of patient enumeration followed by minutes of automated destruction, is what agent-driven operations look like and leaves little time for a human responder to intervene. Targeting the recovery locks shows the actor understood that deleting the means of recovery matters as much as deleting the data.
2. Attacker Compromised Nearly 1,000 Zyxel Switches Since August in Campaign Aimed at Government Data
Technical Scope
GreyNoise published findings on 21 September that an attacker exploiting CVE-2026-7273, a CVSS 8.8 stack-based buffer overflow in Zyxel GS1900 series switches that allows unauthenticated OS command execution via a crafted HTTP request, had confirmed exploitation and exfiltration activity against 996 switches by 17 September. Exploitation was first observed on 17 August. The activity, paired with WordPress intrusions, has been described as deliberate and sustained and aimed specifically at government data rather than ransom. CISA added the flaw to its exploited catalog on 21 September.
Forensics / Compliance Impact
Managed access switches sit inside the network, below the firewall, and are seldom monitored or logged centrally, which makes them durable positions for traffic collection. A campaign that ran for a month before public disclosure indicates the operators were confident the devices would not be examined. Organizations that bought small-business switching for office or plant networks should not assume that equipment is outside the interest of state-aligned collectors.
3. Placeholder Domain third-party.com, Cited in 1,700+ Code Repositories, Now Serves ClickFix Malware Lures
Technical Scope
The domain third-party.com, long used as a generic placeholder in developer documentation and tests in the way example.com is, is referenced in more than 1,700 public repositories, including projects associated with Chromium, Sanity and Vercel and documentation for AI agent skills and MCP servers. Unlike example.com it is not reserved and has been serving a ClickFix lure to Windows browsers since at least June 2026 while showing a harmless decoy to others. The lure presents a fake verification check that copies a malicious PowerShell command to the clipboard and instructs the user to run it.
Forensics / Compliance Impact
The attack exploits trust that developers extend to example endpoints copied from documentation, and it reaches precisely the population with privileged access to source code and build systems. Because the domain appears in tests and configuration, automated tools and AI agents following documentation may also contact it. The incident illustrates a class of supply-chain exposure that no vulnerability scanner will flag: an unreserved name that became live infrastructure.
4. Compromised GitHub Actions Re-Enabled with Mini Shai-Hulud Payload Still Live, Exposing Thousands of Repositories
Technical Scope
Two third-party GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, compromised in the Mini Shai-Hulud campaign on 18 May and removed by GitHub, were re-enabled by their maintainer and served the original malicious payload under the same release tags from 16 September until 25 September. About 15,000 repositories depend on issues-helper through GitHub's dependency graph. Socket found both actions disabled again on 25 September, causing workflows that reference them to fail rather than run the payload.
Forensics / Compliance Impact
Workflows that referenced these actions by tag rather than by pinned commit silently resumed executing malware for nine days with no change on the consuming side. CI runners typically hold repository write tokens, package-registry credentials and cloud deployment keys, so any secret available to an affected workflow during that window must be assumed exposed. The episode shows that removal of a malicious component is not permanent and that trust decisions on third-party build steps need to be revisited.
5. Australian Cyber Security Centre Issues First Alert on Autonomous AI Agents After OpenAI Research Agent Bypassed Medicare Portal
Technical Scope
The Australian Cyber Security Centre published a high-priority alert on 24 September, the first government warning focused on misaligned autonomous AI agents, following disclosure that an AI agent on an internal OpenAI research task bypassed access controls on a Services Australia Medicare statistics portal on 18 June. After the portal repeatedly refused its requests, the agent found and used a vulnerability on its own, accessed non-public files and wrote data into the system. The portal publishes aggregate figures and is separate from claims and patient systems; no patient records were found. OpenAI identified the activity on 11 August and notified the government on 10 September.
Forensics / Compliance Impact
The incident was not a directed attack: the agent was assigned research and circumvented a control to complete it, which is the behaviour defenders now have to anticipate from any autonomous tool given network access and a goal. The 84 days between the event and notification to the affected agency also raises the question of how incident-reporting obligations apply when the actor is a vendor's software. Organizations deploying agents internally face the same exposure in the other direction, with their own tools probing the systems they touch.
BREACH (4)
1. Defense Manpower Data Center Breach Exposed Unencrypted Records of Up to Four Million Service Members for Nine Months
Technical Scope
The Defense Manpower Data Center disclosed that unauthorized users accessed files on a file-sharing server containing unencrypted personally identifiable information between October 2025 and 16 July 2026, when the vulnerability was discovered. Exposed data includes Social Security numbers together with at least one further identifier such as name, date of birth, contact information, sex, race or military personnel details including occupational specialty. Approximately four million current and former Department of Defense personnel may be affected. The department is offering one year of credit monitoring and says it has no indication of misuse.
Forensics / Compliance Impact
The combination of Social Security numbers with occupational specialty is valuable for targeting as well as fraud, since it identifies who holds which technical roles and supports tailored recruitment or phishing approaches against service members and veterans now working in industry. Many of those affected are employed by defense contractors, which extends the social-engineering risk into the industrial base. The nine-month dwell time on a file-sharing server echoes the pattern seen repeatedly in managed file-transfer breaches.
2. ShinyHunters Claims Breach of FBI Jobs Platform and Adjoining Government Cloud; FBI Confirms Investigation
Technical Scope
The ShinyHunters extortion group claimed on 22 September that it breached the FBI and stole two to three terabytes of data on current and former employees and job applicants, including background, education, prior government employment and medical and drug-related information. The group says it exploited Oracle PeopleSoft behind the FBIjobs.gov platform and pivoted into an Amazon-hosted government cloud. The FBI said it is investigating activity affecting FBIjobs.gov but has not confirmed that data was stolen; outside checks matched at least ten entries in sample data. The group says the attack is not financially motivated.
Forensics / Compliance Impact
Applicant files for sensitive positions contain exactly the background-investigation detail foreign intelligence services seek, whether or not the applicant was ultimately hired. The claimed route, a human-resources application leading into a government cloud tenant, mirrors the PeopleSoft campaign reported elsewhere in this brief and shows how HR platforms bridge into more sensitive environments. Until the FBI completes its review, the scope remains an adversary claim, but the sample matches warrant treating it seriously.
3. Bitget Loses About 351 Million US Dollars in Hot-Wallet Theft Attributed to Suspected North Korean Operators
Technical Scope
Cryptocurrency exchange Bitget detected unauthorized hot-wallet transfers on 24 September at 18:31 UTC and lost roughly 351.6 million US dollars, the largest crypto theft of 2026 so far. The attacker compromised a critical backend system in the wallet infrastructure and abused it to have fraudulent transfers approved; private keys were not compromised. Bitget's CEO said the method is highly consistent with North Korean groups, and blockchain analysts reported wallet overlaps with earlier thefts attributed to the TraderTraitor cluster. Withdrawals were suspended pending a security review.
Forensics / Compliance Impact
The theft did not require stealing keys; it subverted the approval workflow that authorizes their use, the same design lesson seen in earlier large exchange thefts. North Korean revenue operations fund weapons programs, which is why these incidents carry sanctions and national-security significance beyond the financial loss. The operators behind these thefts also run fake-recruiter and fake-developer schemes that routinely target engineers at technology and defense firms.
4. Cloudflare Discloses Cross-Tenant Data Exposure in Containers Platform Leaving Prior Customers’ Disk Data Readable
Technical Scope
Cloudflare disclosed a cross-tenant data exposure in its Containers platform, also affecting Sandboxes, in which one customer's workload could read residual disk data left by a previous tenant on the same physical host. Thin provisioning had been configured to skip zeroing blocks before reassignment, so writing 4 KiB to a new container could expose the remaining 60 KiB of a reused 64 KiB block. A researcher found residual material, including directory structures, database pages and complete SQLite databases, on 18 of 24 placements. The issue was reported on 4 September and all mitigations were completed by 19 September; Cloudflare found no evidence of malicious exploitation in retained telemetry.
Forensics / Compliance Impact
Multi-tenant isolation is the premise on which organizations place sensitive workloads in shared cloud services, and data remanence between tenants is a failure of that premise regardless of whether anyone exploited it. The absence of evidence is bounded by how much telemetry was retained, which is a limitation any customer assessing its own exposure should note. The case is a reminder that the provider's shared-responsibility boundary includes storage sanitization that customers cannot observe or verify themselves.
DIB WATCH — DEFENSE INDUSTRIAL BASE CROSS-CUT
Subprime relevance lens over the items above. Not additional items. No remediation guidance.
Remote-access gateways exploited for weeks before a patch existed [CRITICAL 5]
NetScaler Gateway fronts remote access for a large share of contractors, and web shells planted during the unpatched period survive the upgrade; a gateway that was internet-facing in September cannot be presumed clean on the strength of its current build number.
Perimeter firewalls, SD-WAN orchestrators and identity gateways all catalogued at once [CRITICAL 1]
Check Point, VeloCloud and F5 appliances are common at subprime sites and branch shops; each catalogued flaw sits on a device that defines the network boundary and holds the logs that would evidence an intrusion.
Secure file-sharing platform told customers to go dark on imminent-attack intelligence [PLATFORM 7]
Kiteworks is positioned for exchanging controlled and regulated files with government customers; any outage or compromise touches the channel through which drawings, specifications and contract data move between primes and suppliers.
Firewall rules documented as a compensating control stopped working [PLATFORM 1]
The PeopleSoft bypass defeats path-matching rules that many operators recorded in place of the patch; software developers and manufacturers running any internet-facing enterprise application behind a rule-based mitigation should expect assessors to ask when that control was last proven effective.
Service-member records exposure raises targeting risk for the veteran-heavy industrial workforce [BREACH 1]
Social Security numbers paired with occupational specialty for up to four million current and former personnel support precise pretexting against machinists, engineers and program staff who now work at defense suppliers.
Operational technology guidance rewrite opens for comment [REGULATORY 1]
The draft fourth revision of the OT security guide will inform how assessors and primes judge shop-floor and CNC environments at a moment when the Department of War has named manufacturing-base resilience as its next focus; the comment window closes 30 November.
Reporting & Readiness Reminders
- DIBNet reporting: DFARS 252.204-7012(c) requires rapid reporting to https://dibnet.dod.mil within 72 hours of discovery of a cyber incident affecting covered defense information or the contractor ability to perform operationally critical support — the clock runs from discovery, which for an appliance found to carry a web shell is the moment the shell is identified, not the moment scope is confirmed.
- SPRS currency: self-assessment scores and annual affirmations remain due and unchanged while third-party certification is paused; the reform task force report has not yet been published and no current obligation has changed.
- OT segmentation: with SD-WAN orchestrators, branch routers and access switches all under active exploitation this week, re-verify that shop-floor and controller networks do not depend on a single edge device for separation from office and internet traffic.
- Software supply chain attestation: the re-enabled GitHub Actions payload and the hijacked documentation placeholder domain both bear on secure-development attestations covering pinning of third-party build components and handling of secrets available to CI pipelines.
- Evidence integrity: appliance, gateway and file-transfer logs are the record that will show whether this week’s edge exploitation reached an organization; retain them outside the device that produced them so that assessment and incident evidence does not depend on a potentially compromised system.
END OF BRIEF — UNCLASSIFIED
Orville Erickson — Senior Cyber Security Analyst, Imprimis Inc.
