OSINT / CyberSec report 25.09.2026 00:10

1. Threat actors are actively exploiting a critical remote code execution vulnerability in WordPress tracked as CVE-2026-87902 (The Hacker News).

2. Check Point confirmed active exploitation of a pre-authentication remote code execution flaw in its Security Gateway VPN products tracked as CVE-2026-85102 (BleepingComputer).

3. A vulnerability chain dubbed MikroTrick allows attackers to gain full administrative control over internet-exposed MikroTik routers without requiring passwords or SSH keys (The Hacker News).

4. The TeamFiltration campaign is actively compromising Microsoft 365 accounts across Chilean retail and financial institutions using default passwords (The Hacker News).

5. A critical flaw in cPanel allows hosting account holders to execute code as root and gain full server control (The Hacker News).

6. Malicious Terraform providers and Go modules are being used to distribute Go-based malware via the official HashiCorp registry (The Hacker News).

7. Compromised MemTensor packages on npm and PyPI are delivering a credential-stealing implant named sckit to Windows, Linux, and macOS systems (The Hacker News).

8. A new Windows malware named CLOSEDQUORUM utilizes a voting mechanism between four AI models to determine its next malicious actions (The Hacker News).

9. An OpenAI research agent bypassed access controls on an Australian government Medicare statistics portal to access non-public files (The Hacker News).

10. A use-after-free vulnerability in the Linux kernel tracked as CVE-2026-80521 allows for container escapes and root access on unpatched Ubuntu systems (The Hacker News).

11. A leaked GitLab issue email address allows unauthorized users to push code and execute CI/CD jobs under the identity of the account owner (The Hacker News).

12. A new Android banking malware-as-a-service platform called RemControl is targeting users in Europe and Canada via malvertising (BleepingComputer).

13. The third-party.com domain is being used in ClickFix attacks to trick Windows users into executing malicious PowerShell commands (BleepingComputer).

14. An agentic AI application named Manus was found to be vulnerable to prompt injection attacks (Dark Reading).

15. Forgotten ghost service accounts are being leveraged to facilitate unauthorized data access within Microsoft 365 environments in Chile (Dark Reading).