# Today's Top Stories

F5 disclosed and patched CVE-2026-94127, a critical zero-day in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution on systems where APM is configured as an OAuth authorization server. Active exploitation was confirmed prior to the September 22 disclosure, with engineering hotfixes now available. Security teams running BIG-IP APM in OAuth server mode should treat this as an emergency patch given the pre-auth RCE impact.

ShinyHunters claimed on September 23 to have breached the FBI, asserting they hold sensitive data on 'almost ALL FBI Agents' and job applicants, and temporarily defaced the FBIjobs.gov website with a Pokemon image associated with the group. The FBI confirmed it is investigating the claims, and the jobs site remained unavailable. This follows ShinyHunters' history of high-profile data theft and extortion, and the group is demanding retraction of an FBI threat report.

Check Point confirmed active exploitation of CVE-2026-93616, a pre-authentication zero-day in its Security Management Server that allows attackers with web service access to execute arbitrary scripts without credentials. Targeted attacks were recorded as early as July 23, with a patch released September 22. Organizations running Check Point Security Management Server should apply the fix immediately given the unauthenticated code execution risk.

Chinese threat actor UTA0565 exploited a chained zero-day combining two Chrome vulnerabilities (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC flaw (CVE-2026-85880) to deploy CLEANGULP malware via fake websites, with attacks detected on September 3–4, 2026. Volexity identified the group as sharing exploit kit infrastructure with multiple other Chinese threat actors. The use of browser-plus-OS exploit chains against targeted victims signals sophisticated, state-aligned offensive capability.

Microsoft, acting under a U.S. District Court for the Eastern District of Virginia authorization, seized 50 websites and disabled 150+ domains belonging to EvilTokens, an AI-powered phishing-as-a-service platform linked to 12,000 Microsoft 365 inbox compromises. EvilTokens used AI throughout the attack chain — for crafting social engineering lures, selecting targets, and conducting device code phishing. The takedown involved Health-ISAC, Cloudflare, Coinbase, OpenAI, and SpyCloud.

CERT Polska detailed 'MikroTrick,' a chained exploit combining an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in RouterOS login (CVE-2026-86060), enabling full administrative takeover of internet-exposed MikroTik routers without credentials or SSH keys. Attack logs confirm real-world exploitation is already occurring. Network defenders managing MikroTik RouterOS devices should patch immediately given the no-auth, full-control impact.

Security firm DepthFirst published a working exploit for CVE-2026-80521 (CVSS 7.8), a use-after-free in the Linux kernel's AF_UNIX socket subsystem that enables container escape to host root. Although the upstream kernel patch was merged August 6, Ubuntu 26.04, 24.04, and 22.04 LTS have not yet shipped the fix. Container-based deployments on Ubuntu are directly exposed until distro patches are released.

A financially motivated threat actor is leveraging open-source AI agent frameworks to compromise online retail sites at scale, injecting payment card skimmers across 100+ sites and stealing more than 600,000 credit card records. The AI-assisted attack automation represents a significant escalation in Magecart-style campaign reach and speed. E-commerce security teams should audit third-party script integrity and CSP configurations urgently.

Check Point confirmed active exploitation of CVE-2026-85102, a critical pre-authentication RCE vulnerability in its Security Gateway product's VPN certificate-handling functionality. The flaw enables remote attackers to execute code without authentication, and Check Point has issued patches alongside a warning urging immediate action. Organizations using Check Point Security Gateway for VPN should prioritize patching given confirmed in-the-wild exploitation.

Arista Networks released emergency patches for a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that is actively being exploited, allowing remote attackers to access privileged internal functionality without authentication. The flaw is rated critical severity, and Arista urged immediate patching for all on-premises VCO deployments. SD-WAN administrators running Arista VeloCloud should treat this as an urgent remediation priority.