Critical Infrastructure Threat Intelligence Briefing

September 22, 2026

Command View

Verification cutoff

September 22, 2026, 14:23:19 UTC.

This edition prioritizes compromise of network and backup control planes, confirmed supply-chain and recruitment tradecraft, and newly disclosed attack paths affecting Internet-facing websites. The most urgent actions concern Zyxel GS1900 switches and Veeam Agent for Microsoft Windows endpoints, where exploitation evidence means patching must be accompanied by integrity checks and credential review.

Priority posture

RED: CVE-2026-7273 is being exploited against Zyxel GS1900 switches, with sensitive data reportedly exfiltrated from 996 devices across 48 countries. Arctic Wolf reports multiple stages of exploitation activity involving Veeam Agent CVE-2026-32996. Orkes Conductor exploitation and the three CISA-listed Linux kernel vulnerabilities from the prior edition remain open response workstreams where affected systems are not confirmed clean.

AMBER: The North Korean WaterPlum campaign uses fraudulent recruitment, malicious developer files, and laptop farms to reach IT professionals and potentially their employers. An ongoing npm campaign hides malware in runtime code rather than install scripts. WordPress Click2Shell has public technical details and a proof of concept for a chain that can reach PHP execution through a logged-in administrator’s browser session.

WATCH: A new public Microsoft Defender proof of concept can interfere with platform and signature updates, but the code is described as buggy and no exploitation has been confirmed. Attribution claims surrounding the Zyxel activity remain qualified; “Chinese-speaking” is an assessment, not a conclusive state attribution.

Today’s decisions

Network operations — close Zyxel exposure by September 24 where applicable: inventory every GS1900 switch, install the model-specific fixed firmware, remove factory credentials, restrict management access to authorized administration networks, and preserve configuration and log evidence before or during remediation.
Backup and endpoint owners — upgrade Veeam immediately: move affected Veeam Backup & Replication deployments to 13.0.2.29 or later, verify the Veeam Agent build, identify systems with local-user access, and hunt for suspicious use of the Veeam service, named pipe, and endpoint logs.
Incident response — do not close exploitation cases at patch installation: for Zyxel, Veeam, Orkes, Linux, GitLab, Cisco, or Acronis exposure, validate device or host integrity, rotate credentials and tokens that may have been readable, and confirm recovery artifacts independently.
Software supply-chain owners — block and investigate runtime package execution: quarantine indexed-btree and related packages, review lockfiles and package caches, inspect build and developer hosts for outbound Slack, Telegram, or blockchain-related connections, and rebuild affected artifacts from trusted source.
Security, procurement, and engineering leadership — harden developer recruitment and contractor access: verify identity and work location, prohibit unsupervised remote control of company devices, use isolated managed workstations, and require restricted-mode handling of unknown code and Visual Studio Code projects.
Web platform owners — patch WordPress and reduce administrative attack surface: update to the applicable 7.1.1 or backported security release, restrict theme and plugin installation, review administrator sessions and recently written files, and treat an unexpected theme-preview event as a possible compromise signal.

Threat and Resilience Ledger

[RED] — Network switching and edge infrastructure | Global — Zyxel GS1900 exploitation has reached nearly 1,000 devices

Zyxel vulnerability CVE-2026-7273, CVSS 8.8, is a stack-based buffer overflow in the GS1900 web-management CGI program. An unauthenticated attacker who can reach the management service from the local or adjacent network can send a crafted HTTP request and execute operating-system commands. Zyxel released model-specific firmware fixes on June 16, but GreyNoise reports that a suspected Chinese-speaking actor exploited the flaw beginning around August 17 and exfiltrated configuration data, network information, and hashed root credentials from 996 switches in 48 countries. SecurityWeek reports that 564 of the compromised devices retained factory-default credentials. CISA added the CVE to its Known Exploited Vulnerabilities action set on September 21; the resulting three-day Federal Civilian Executive Branch deadline is September 24.

The affected population includes ten GS1900 models used in small and midsize networks, schools, hospitality, retail, service-provider, and government environments. Exposure is especially serious when management interfaces are reachable beyond a tightly controlled administration segment, when switches retain default credentials, or when switch configuration and logs are not centrally preserved. GreyNoise links the activity to the same or a related cluster it calls Red Heron, but that relationship and any state sponsorship remain unconfirmed. Operators should assume a vulnerable device may have disclosed credentials or topology even if its configuration appears unchanged.

Evidence: confirmed vulnerability; exploitation and data theft observed by GreyNoise and reported by multiple security publications; CISA KEV inclusion reported through a forwarding-safe news source and CISA’s public notification channel.
Attribution: suspected Chinese-speaking actor; relationship to Red Heron assessed but unconfirmed; state sponsorship unknown.
Confidence: high for the vulnerability, affected models, fixed firmware, and exploitation of 996 devices; moderate for actor linkage.
Uncertainty: complete victim population, persistence mechanisms, whether stolen hashes were cracked or reused, and whether compromised switches were used for lateral movement.
Sources: Zyxel; GreyNoise; SecurityWeek; BleepingComputer; CVE and NVD records.

[RED] — Backup integrity and Windows endpoint control | Global — Veeam Agent CVE-2026-32996 exploitation activity requires immediate closure

CVE-2026-32996 is a high-severity local privilege-escalation vulnerability in Veeam Agent for Microsoft Windows. Veeam identifies Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds as affected and assigns CVSS 4.0 score 7.3. A low-privileged local user can abuse the Veeam Endpoint Backup service’s handling of elevated client sessions over a local gRPC named pipe. Session identifiers written to a readable endpoint log can be used to obtain an elevated session and execute commands as NT AUTHORITY\SYSTEM. Public technical details and proof-of-concept code appeared September 14.

Arctic Wolf’s September 16 security bulletin says it detects multiple stages of the exploitation chain. That does not establish a broad victim count, a named actor, or ransomware deployment in every observed case, but it is sufficient to treat exposed Veeam Agent endpoints as active investigation targets rather than ordinary patch candidates. The vendor fix is Veeam Backup & Replication 13.0.2.29 or later, which updates the Veeam Agent for Windows to build 13.0.3.1220. Prioritize administrator workstations, backup servers, shared systems, help-desk systems, and endpoints where an attacker may already possess a low-privileged account.

Evidence: confirmed vulnerability and public PoC; Arctic Wolf reports detection of multiple stages of an exploitation chain.
Attribution: unknown.
Confidence: high for affected versions and remediation; moderate for the prevalence and operational outcomes of exploitation.
Uncertainty: initial-access paths, victim count, whether attackers used the flaw to attack backup data, and whether any observed chains progressed to persistence or ransomware.
Sources: Veeam KB4852; Arctic Wolf; CVE record; corroborating security reporting.

[RED] — Workflow orchestration and AI automation | Global — Orkes Conductor exploitation remains an open control-plane incident condition

The prior edition’s CVE-2026-58138 remains materially active. The unauthenticated remote-code-execution flaw affects Orkes Conductor releases 3.21.21 through 3.30.1 and is fixed in 3.30.2. Attackers can submit inline workflow definitions containing JavaScript or Python expressions that reach arbitrary operating-system command execution. Conductor is not merely an application server when it can launch microservice workflows, access cloud credentials, or control AI-agent activity; it is a privileged orchestration plane.

Fortinet and independent researchers reported exploitation attempts, including activity observed from August 21 and roughly 1,300 blocked attempts during September 8–9. No authoritative victim count or complete downstream-impact assessment has been published. Operators should restrict the workflow API, verify authentication and network exposure, review workflow definitions and child-process creation, inspect cloud metadata and outbound connections, and rotate secrets available to the service if suspicious activity is found.

Evidence: confirmed vulnerability; exploitation attempts reported by Fortinet and corroborated by independent research and security reporting.
Attribution: unknown.
Confidence: high for the vulnerability, affected range, fixed release, and exploitation attempts; moderate for victim scope.
Uncertainty: successful-compromise count, tenant separation, downstream services reached, and secrets accessed.
Sources: Fortinet FortiGuard; SecurityWeek; CVE and NVD records; Conductor OSS release documentation.

[AMBER] — Developer identity and software supply chain | Japan, United States, Europe, and global contractor networks — WaterPlum combines fake recruitment with malware and laptop farms

A joint advisory dated September 18 from Japan’s National Police Agency, Japan’s National Cybersecurity Office, the FBI, the U.S. Defense Cyber Crime Center, Australia’s ACSC, Germany’s BND, and Germany’s BfV describes North Korean WaterPlum, also known as Contagious Interview. The group poses as prospective employers or recruiters to target software developers, web professionals, cryptocurrency specialists, and other IT workers. During interviews or coding assignments, victims may be directed to download malicious files or NPM packages containing BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle malware. The advisory says the campaign infected at least 30,000 devices in more than 100 countries, obtained funds or credentials from more than 7,000 cryptocurrency wallets, and transferred 1.7 billion Japanese yen, approximately 10.71 million U.S. dollars, to North Korea.

The enterprise risk is broader than cryptocurrency theft. A compromised developer, contractor, or outsourced worker can expose source code, browser credentials, cloud sessions, package-publishing rights, and employer networks. The joint advisory describes Japanese authorities dismantling a North Korean laptop farm, where devices associated with employment were physically hosted and remotely operated by North Korean personnel. The agencies assess WaterPlum actors and some North Korean IT workers as operating under the same North Korean military-industrial bureau. That is a public government assessment, not a claim that every suspicious contractor or every recruitment fraud case is North Korean.

Evidence: joint government advisory describing observed tradecraft, infrastructure, scale, malware families, and law-enforcement action.
Attribution: public FBI/NPA assessment links WaterPlum and certain North Korean IT-worker activity to North Korea’s 313 General Bureau; individual incidents still require case-specific attribution.
Confidence: high for the advisory’s documented techniques and government assessments; moderate for the complete campaign scale and downstream corporate impact.
Uncertainty: affected employers, stolen enterprise credentials, active persistence, and the portion of the reported device population that reached corporate networks.
Sources: FBI Internet Crime Complaint Center; Japan National Police Agency; SecurityWeek.

[AMBER] — Open-source package infrastructure and CI/CD | Global — Runtime-triggered npm malware bypasses install-script defenses

Checkmarx reports an ongoing npm supply-chain campaign centered on the malicious indexed-btree package, which impersonates the legitimate sorted-btree library. The malware does not depend on a pre-install or post-install script. Instead, its trigger is hidden inside the package’s normal JavaScript prototype behavior and fires when an application uses the library. Checkmarx reports nearly two million weekly downloads for indexed-btree before detection; related packages, including ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, and neighbor-key-map, had more than five million downloads when removed.

The malware fingerprints hosts, exfiltrates information through Slack and Telegram, retrieves a second stage through an Ethereum smart contract, and cleans traces. The campaign demonstrates why blocking package lifecycle scripts does not establish package safety: code can execute during ordinary import or runtime behavior. SecurityWeek and Checkmarx report an apparent 109-ether profit, but that financial estimate does not identify victims or prove compromise of critical-infrastructure operators. The operational risk is the path from a developer or build host into credentials, source, release artifacts, and downstream software.

Evidence: confirmed malicious packages and technical analysis by Checkmarx; package-removal and campaign details corroborated by security reporting.
Attribution: unknown.
Confidence: high for the malicious package behavior and campaign mechanics; moderate for the download totals and financial estimate as a measure of actual use.
Uncertainty: organizations that imported or executed the packages, data exfiltrated, persistence after package removal, and downstream artifact exposure.
Sources: Checkmarx Zero; SecurityWeek; npm package and repository records as applicable.

[AMBER] — Internet-facing web administration | Global — WordPress Click2Shell creates a public path from an administrator visit to PHP execution

WordPress 7.1.1, released September 17, fixed eleven security issues, including a flaw in which specially crafted URLs could automatically install and preview an inactive theme from WordPress.org. Pwn.ai’s technical disclosure calls the chain Click2Shell. An attacker does not need a WordPress account, but the practical chain requires a logged-in administrator or other privileged user to visit the crafted link. The browser’s handling of the theme-preview value can cause WordPress to invoke its own theme-install control; vulnerable third-party themes can then load PHP during preview and expose an installer path that writes and executes attacker-supplied plugin code.

The issue has no CVE identifier in the public materials reviewed at cutoff. WordPress’s official release page lists fixed releases for current and older branches, including 7.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, and 5.2.27. The complete RCE chain is demonstrated code, not confirmed widespread exploitation. Site owners should patch, restrict theme and plugin installation, review administrator sessions, and inspect recently created files and accounts.

Evidence: confirmed vendor fix and public technical disclosure with proof of concept; active exploitation not confirmed at cutoff.
Attribution: not applicable.
Confidence: high for the WordPress fix and demonstrated chain; moderate for the frequency with which the chain can be reproduced against varied themes.
Uncertainty: future CVE assignment, affected theme population, exploitation attempts, and whether compromised sites have already been used in campaigns.
Sources: WordPress.org; pwn.ai; SecurityWeek.

[WATCH] — Endpoint security control plane | Global — BigDiskBuster PoC can block Microsoft Defender updates

Researcher Abdelhamid Naceri, known online as Nightmare Eclipse or Chaotic Eclipse, published the BigDiskBuster proof of concept for a Windows Defender update denial-of-service condition. The project claims to prevent Defender platform and signature updates on supported Windows versions, but its author describes it as buggy and requiring further work. The public material does not provide a CVE, Microsoft has not confirmed the issue in the available reporting, and exploitation in the wild is not established. The operational concern is defensive degradation: a host can appear to have antivirus installed while its signatures or platform are no longer current.

Endpoint teams should verify Defender update success through independent management telemetry, alert on repeated update failures or unexpected policy changes, and retain an independent detection layer on high-value administrative and engineering systems. Do not treat the PoC as evidence of a new zero-day or a confirmed campaign.

Evidence: public proof of concept; no confirmed exploitation or vendor validation at cutoff.
Attribution: not applicable.
Confidence: high that the public repository exists and claims the described behavior; low for real-world exploitability and impact.
Uncertainty: whether supported Windows builds are consistently affected, whether Microsoft will issue a fix, and whether attackers are using the technique.
Sources: BigDiskBuster GitHub repository; SecurityWeek.

Defensive Posture Changes

Package and build provenance

Runtime-triggered npm malware requires testing beyond install-time script review. Pin and review lockfiles, use an internal registry or allowlist for production builds, scan package behavior during representative application execution, and deny build hosts unnecessary outbound access to messaging platforms, public blockchain endpoints, and arbitrary repositories. Revoke tokens available to developer machines and CI jobs that imported suspicious packages, then rebuild artifacts from a trusted dependency graph.

Recruitment and contractor access

Recruitment, freelance, and outsourced-development processes are now part of the software supply-chain boundary. Validate identity, work location, employment history, and device ownership; require managed devices or tightly controlled virtual workspaces; prohibit unknown code execution on systems holding credentials or source; and limit contractor access by repository, environment, and time. Treat unusual requests for remote control, cryptocurrency payment, unexplained background activity, or a coding assignment that requires running opaque commands as security signals.

Web administration

WordPress administrators should update before investigating the new chain in depth, then review the investigation surface: administrator logins, theme and plugin installation events, recently modified PHP files, new users, outbound requests, and database changes. Restrict theme and plugin installation to a small administrative group, require reauthentication for high-risk actions where supported, and keep production sites separated from credentials that can administer other infrastructure.

Endpoint defense validation

The BigDiskBuster PoC is not a confirmed campaign, but it is a reminder that endpoint protection must be measured by successful update and detection telemetry rather than by the mere presence of an agent. Verify Defender platform and signature currency independently, alert on policy changes and repeated update failures, and maintain an additional detection path for high-value administrative, engineering, and recovery systems.

Network-device integrity

Treat small managed switches as security-relevant infrastructure, not disposable appliances. Verify firmware by model, not by product family, and compare current configuration against a known-good baseline. Disable or isolate HTTP management where operationally possible, restrict management VLAN access, replace factory credentials, centralize logs, and inspect for unexpected configuration changes, reboots, port mirrors, VLAN changes, outbound connections, and credential reuse. A patched switch that disclosed hashed root credentials should still trigger credential rotation and a review of systems that trusted the switch’s management network.

Backup and recovery trust

Veeam Agent exploitation reinforces that backup software belongs in the privileged-control inventory. After upgrading, verify both the Veeam Backup & Replication build and the installed Agent build on endpoints. Review local account activity, named-pipe access, Veeam service behavior, the relevant endpoint log, new SYSTEM processes, and changes to backup jobs or repositories. Independently validate restore points and recovery credentials; a successful software update does not prove that an attacker did not already alter or exfiltrate backup material.

Regional and Sector Pulse

North America

The Zyxel deadline is immediately relevant to U.S. federal civilian agencies, but the device exposure is global and the same firmware and credential risks apply to utilities, schools, local government, service providers, and small businesses. Water-sector operators should add switch-management integrity to the control-system review already prompted by the Colorado incidents and the broader Siemens PLC targeting. No new public evidence at this cutoff links the Zyxel campaign to the water incidents.

Asia-Pacific

Japan is a principal source of new government reporting: its authorities dismantled a North Korean laptop farm and contributed to the WaterPlum advisory. The WaterPlum operation also demonstrates how remote work, recruiting platforms, NPM packages, and cryptocurrency infrastructure can form a cross-border access chain. The suspected Chinese-speaking Zyxel activity has global victims, including Asia-Pacific networks, but the public evidence does not establish a government sponsor.

Europe and global managed services

GreyNoise observed affected Zyxel switches across 48 countries, and WaterPlum infected devices in more than 100 countries. These are global product and identity risks rather than evidence of one regional campaign. European operators should nevertheless treat outsourced development, cloud contractors, and lightly managed network equipment as supplier-risk surfaces, particularly where access crosses national or organizational boundaries.

Continuity from prior editions

Orkes Conductor, Linux kernel, Cisco, GitLab, Acronis, Siemens, and maritime investigations remain open where the relevant systems have not undergone compromise assessment and trust validation. No new public evidence at this cutoff changes the previously stated attribution qualifiers or establishes that patching alone closed those cases.

Vulnerability and Supplier Watchlist

Zyxel GS1900 switches

Issue: CVE-2026-7273, CVSS 8.8; unauthenticated LAN/adjacent-network stack overflow leading to OS-command execution.
Affected scope: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, and 48HPv2 at or below the model-specific vulnerable firmware listed by Zyxel.
Fixed release: GS1900-8 2.90(AAHH.2)C0; 8HP 2.90(AAHI.2)C0; 10HP 2.90(AAZI.2)C0; 16 2.90(AAHJ.2)C0; 24 2.90(AAHL.2)C0; 24E 2.90(AAHK.2)C0; 24EP 2.90(ABTO.2)C0; 24HPv2 2.90(ABTP.2)C0; 48 2.90(AAHN.2)C0; 48HPv2 2.90(ABTQ.2)C0.
Severity: High; CVSS 8.8.
Status: RED — exploitation and data exfiltration observed; CISA federal remediation deadline September 24.

Veeam Agent for Microsoft Windows

Issue: CVE-2026-32996; local privilege escalation to SYSTEM; CVSS 4.0 score 7.3.
Affected scope: Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds; local access and a low-privileged account are required.
Fixed release: Veeam Backup & Replication 13.0.2.29 or later; Veeam Agent for Windows build 13.0.3.1220 or later.
Severity: High.
Status: RED — public PoC and Arctic Wolf detection of multiple exploitation-chain stages.

Orkes Conductor

Issue: CVE-2026-58138; unauthenticated RCE through inline workflow expressions; CVSS 9.8.
Affected scope: Releases 3.21.21 through 3.30.1.
Fixed release: 3.30.2 or later.
Severity: Critical.
Status: RED — exploitation attempts reported; workflow and AI-agent control-plane exposure.

Linux kernel

Issue: CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266; distinct flaws involving TLS receive-path behavior, AF_ALG concurrent writes, and ebtables SNAT memory corruption.
Affected scope: distribution-specific; verify the vendor kernel build rather than relying on the CVE number or a generic upstream version.
Fixed release: distribution-specific; Ubuntu security notices identify fixed and work-in-progress states by kernel branch.
Severity: Mixed; CISA action set.
Status: RED where affected hosts remain unpatched or unrestored after the September 21 federal remediation date.

WordPress Core and themes

Issue: Click2Shell; crafted theme-preview URL can force installation and preview of an inactive theme, with a demonstrated chain to PHP execution through vulnerable third-party themes; no CVE assigned by cutoff.
Affected scope: WordPress before 7.1.1, with older supported branches covered by backported releases.
Fixed release: 7.1.1; backports include 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, and 5.2.27.
Severity: Vendor has not published a final CVSS rating; pwn.ai assessed the demonstrated chain as critical.
Status: AMBER — public PoC and credible administrator-session path to site compromise; exploitation not confirmed.

Microsoft Defender

Issue: BigDiskBuster public PoC claims denial of Defender platform and signature updates; no CVE.
Affected scope: Claimed by the researcher to include supported Windows versions; independent validation is incomplete.
Fixed release: None published by cutoff.
Severity: Unrated.
Status: WATCH — defensive-control degradation is plausible, but the PoC is described as buggy and exploitation is unconfirmed.

Outlook and Uncertainty

Next 24 hours

Watch the September 24 Zyxel remediation deadline and for additional GreyNoise indicators, especially evidence of persistence, credential reuse, or lateral movement from compromised switches.
Watch Veeam and Arctic Wolf for victim scope, endpoint indicators, and evidence that exploitation reached backup repositories or recovery infrastructure.
Watch Orkes maintainers and incident responders for new indicators, fixed-build clarifications, or evidence of downstream cloud and AI-agent compromise.
Watch WordPress for CVE assignment, additional affected themes, exploitation reports, or a security clarification about the administrator-session prerequisite.
Watch the WaterPlum advisory’s partner agencies for further laptop-farm takedowns, employer victims, and identity or infrastructure indicators.
Watch npm registries and Checkmarx for package reappearance, additional linked packages, and evidence of CI/CD credential theft from the btree campaign.

What is not known

The full Zyxel victim population, persistence method, and use of stolen hashes remain unknown. Veeam exploitation has been observed as a chain, but its initial access, attacker identity, and post-escalation objectives are not public. WaterPlum’s reported device count does not reveal how many enterprise networks were reached. The npm campaign’s download totals do not equal confirmed execution or compromise. Click2Shell’s affected-theme population and real-world exploitation status remain unresolved. The BigDiskBuster PoC has not been independently validated across supported Windows releases.

Trigger for escalation

Escalate Zyxel cases immediately if a device shows unauthorized configuration, port mirroring, new outbound traffic, changed credentials, or unexplained reboot behavior. Escalate Veeam cases if a vulnerable Agent endpoint shows suspicious local-account activity, use of the Veeam service or named pipe, SYSTEM process creation, backup-job changes, or repository access. Escalate WaterPlum, npm, or WordPress cases if developer credentials, package-publishing rights, cloud tokens, administrator sessions, PHP files, or downstream artifacts are exposed.

Source Register

Zyxel GS1900 exploitation and CISA action

BleepingComputer — “CISA orders feds to patch Zyxel flaw exploited for data theft” — September 22, 2026:
https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday/

SecurityWeek — “Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers” — September 22, 2026:
https://www.securityweek.com/recent-zyxel-switch-vulnerability-exploited-by-chinese-hackers/

GreyNoise — “Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation” — September 21, 2026:
https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation

Zyxel — “Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches” — June 16, 2026:
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

CVE Record — CVE-2026-7273:
https://www.cve.org/CVERecord?id=CVE-2026-7273

National Vulnerability Database — CVE-2026-7273:
https://nvd.nist.gov/vuln/detail/CVE-2026-7273

CISA Cyber — public notification of CVE-2026-7273 addition — September 21, 2026:
https://x.com/CISACyber/status/2102122524972568782

Veeam Agent exploitation

Arctic Wolf — “UPDATE: Active Exploitation CVE-2026-32996 of Veeam Agent” — September 16, 2026:
https://arcticwolf.com/resources/blog/update-active-exploitation-cve-2026-32996-of-veeam-agent/

Veeam — “Vulnerabilities Resolved in Veeam Backup & Replication 13.0.2” — updated August 17, 2026:
https://www.veeam.com/kb4852

Veeam — “Release Information for Veeam Backup & Replication 13”:
https://www.veeam.com/kb4738

The Hacker News — “Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access” — September 22, 2026:
https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html

CVE Record — CVE-2026-32996:
https://www.cve.org/CVERecord?id=CVE-2026-32996

National Vulnerability Database — CVE-2026-32996:
https://nvd.nist.gov/vuln/detail/CVE-2026-32996

Orkes Conductor exploitation

Fortinet FortiGuard — “Orkes Conductor Evaluator Remote Code Execution”:
https://www.fortiguard.com/outbreak-alert/orkes-conductor-rce

Fortinet FortiGuard Threat Signal Report — “Orkes Conductor Evaluator Remote Code Execution” — September 9, 2026:
https://www.fortiguard.com/threat-signal-report/6527/orkes-conductor-evaluator-remote-code-execution

SecurityWeek — “Critical Orkes Conductor Vulnerability Exploited in Attacks” — September 18, 2026:
https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks/

CVE Record — CVE-2026-58138:
https://www.cve.org/CVERecord?id=CVE-2026-58138

National Vulnerability Database — CVE-2026-58138:
https://nvd.nist.gov/vuln/detail/CVE-2026-58138

Conductor OSS — release v3.30.2:
https://github.com/conductor-oss/conductor/releases/tag/v3.30.2

WaterPlum and North Korean IT-worker activity

FBI Internet Crime Complaint Center and partner agencies — “North Korean ‘WaterPlum,’ commonly referred to as ‘Contagious Interview,’ Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe” — September 18, 2026:
https://www.ic3.gov/CSA/2026/260918.pdf

Japan National Police Agency — “Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers”:
https://www.npa.go.jp/bureau/security/northkorea_IT/NK_IT_202607.html

SecurityWeek — “Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme” — September 22, 2026:
https://www.securityweek.com/japan-dismantles-first-north-korean-laptop-farm-as-us-and-allies-detail-wider-scheme/

Checkmarx Zero — “npm ‘btree’ Malware Campaign Affects Millions of Downloads, No Need for Install Script” — September 17, 2026:
https://checkmarx.com/zero-post/npm-btree-malware-campaign-affects-millions-of-downloads-no-need-for-install-script/

SecurityWeek — “Malicious B-tree NPM Package Accumulates Millions of Downloads” — September 22, 2026:
https://www.securityweek.com/malicious-b-tree-npm-package-accumulates-millions-of-downloads/

WordPress Click2Shell

WordPress.org — “Version 7.1.1”:
https://wordpress.org/documentation/wordpress-version/version-7-1-1/

Pwn.ai — “Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain” — September 18, 2026:
https://pwn.ai/blog/click2shell

SecurityWeek — “WordPress Patches ‘Click2Shell’ Vulnerability” — September 22, 2026:
https://www.securityweek.com/wordpress-patches-click2shell-vulnerability/

Microsoft Defender BigDiskBuster proof of concept

GitHub — MSNightmare/BigDiskBuster — public repository:
https://github.com/MSNightmare/BigDiskBuster

SecurityWeek — “Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity” — September 22, 2026:
https://www.securityweek.com/nightmare-eclipse-drops-new-microsoft-defender-exploit-after-revealing-identity/

Linux kernel carry-forward action

CISA — “CISA Adds Two Known Exploited Vulnerabilities to Catalog” — September 18, 2026:
https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog

SecurityWeek — “Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities” — September 21, 2026:
https://www.securityweek.com/organizations-warned-of-3-exploited-linux-kernel-vulnerabilities/

CVE Record — CVE-2025-39682:
https://www.cve.org/CVERecord?id=CVE-2025-39682

CVE Record — CVE-2025-39964:
https://www.cve.org/CVERecord?id=CVE-2025-39964

CVE Record — CVE-2026-53266:
https://www.cve.org/CVERecord?id=CVE-2026-53266

Ubuntu Security Notice — CVE-2025-39682:
https://ubuntu.com/security/CVE-2025-39682

Ubuntu Security Notice — CVE-2025-39964:
https://ubuntu.com/security/CVE-2025-39964

Ubuntu Security Notice — CVE-2026-53266:
https://ubuntu.com/security/CVE-2026-53266

Jonathan Brown writes independent, decision-focused analysis on cybersecurity, infrastructure resilience, and operational risk, with an emphasis on primary-source verification and explicit uncertainty.

Support this work by sharing the briefing with operators who can act on it. Corrections supported by primary evidence are welcomed; material errors should be amended transparently. Feel free to subscribe, comment, or buy us a coffee! Thanks.