The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with
WatchGuard fixes 15 Fireware OS flaws, including a critical RCE bug that could give attackers root access to vulnerable Firebox appliances. WatchGuard has released security updates for Fireware OS that address 15 vulnerabilities, including a critical code injection flaw, tracked as CVE-2026-86131 (CVSS score of 9.2), that could allow an attacker to execute commands with root privileges on a vulnerable Firebox. “A code injection vulnerability in WatchGuard Fireware OS’s BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.” reads the advisory. The flaw affects the way Fireware OS handles configurations for BOVPN over TLS clients, a feature used to create VPN tunnels between WatchGuard Firebox appliances. The attack requires the threat actor to control the remote VPN server to which the vulnerable Firebox connects. If successfully exploited, the attacker can execute arbitrary commands as root on the connecting appliance. The vulnerability does not require user interaction or prior privileges. BOVPN over TLS uses a client-server model and can send VPN traffic over TCP port 443, a port commonly allowed through network firewalls. This makes the feature useful in environments where traditional IPsec traffic cannot easily pass through the network. WatchGuard addressed CVE-2026-86131 in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21. The affected branches include Fireware versions below those releases, depending on the platform. The vendor also addresses 13 high-severity vulnerabilities affecting different Fireware OS components. The flaws include vulnerabilities that could lead to remote code execution, authorization bypass, denial-of-service conditions, unauthorized SSLVPN access and arbitrary file reads. One example is CVE-2026-86101 (CVSS score of 7.2), a high-severity authorization flaw in the SAML login process. A remote authenticated SAML user with access to the Access Portal could abuse a specially crafted request to obtain unauthorized Mobile VPN with SSL access. “An improper authorization vulnerability in WatchGuard Fireware OS’s SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.” states the advisory. WatchGuard fixed the issue in the same Fireware OS releases. Another patched issue allows an attacker with adjacent network access to send specially crafted DHCP traffic that can trigger a stack-based buffer overflow in the fingerd process. The flaw, tracked as CVE-2026-81433 (CVSS score of 8.7), can lead to arbitrary code execution or a crash. “A stack-based buffer overflow vulnerability in WatchGuard Fireware OS’s DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.” the company states. The update also includes a medium-severity authorization issue that could allow unauthorized access to web applications. The vendor pointed out it is not aware of exploitation of these Fireware OS vulnerabilities in the wild. The company has published the fixes and recommends customers update affected Firebox appliances to the appropriate patched release. Organizations using Firebox appliances should therefore review their Fireware OS versions and prioritize the September 29 security updates, particularly where BOVPN over TLS is enabled. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Fireware OS)
Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. Formerly known as SD-WAN vManage, Catalyst SD-WAN Manager is network management software that lets admins monitor and manage up to 6,000 SD-WAN devices from a single dashboard. "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," the company warned on Wednesday. "Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability." The CVE-2026-76504 vulnerability affects all deployments regardless of system configuration, was found in API session-based authentication management, and allows unauthenticated attackers to access vulnerable systems remotely with admin privileges.
Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service, and it affects appliances with DTLS enabled. That’s particularly relevant for NetScaler Gateway because DTLS is enabled by default for VPN virtual servers unless an administrator has explicitly disabled it. The bug is triggered during the appliance’s first handshake, before any login is required. NetScaler’s packet engine processes incoming DTLS traffic to set up the encrypted connection. A specially crafted or fragmented header can corrupt its memory, allowing an attacker to run arbitrary code with root privileges on the underlying FreeBSD system, without needing any credentials. There are also signs of a successful attack in the logs. You may see an SSL handshake failure using DTLSv1.0 with the message “Handshake failure-Internal Error.” At the same time, the packet engine process crashes and the appliance’s watchdog fails to restart it. If these events happen close together, they could indicate that the exploit was successfully triggered. “While Google Threat Intelligence Group does not possess exploit code, analysis of frontline telemetry suggests that transmitting specially malformed or fragmented record headers induces heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.” reads Google’s report. “Successful exploitation attempts generated two log artifacts: 0-PPE-0 : default SSLLOG SSL_HANDSHAKE_FAILURE 0 : SPCBId - ClientIP - ClientPort - VserverServiceIP - VserverServicePort 443 - ClientVersion DTLSv1.0 - CipherSuite "TLS1-AES-256-CBC-SHA" - Session New - Reason "Handshake failure-Internal Error"" Once inside, the attacker’s first move is installing a web shell, and the installation trick itself is worth appreciating for its pettiness. In some intrusions, the attacker edited the appliance’s Apache config to treat .deb files as executable PHP scripts, then dropped a web shell wearing that fake extension. Nobody expects a Debian package to run code, which is exactly the point. A stealthier version does the same trick with .sig files instead, and adds a redirect so that a request for a harmless looking .ico icon file actually gets served by the hidden PHP shell. Someone requesting /vpn/media/e6ee7c85.ico unknowingly triggers e6ee7c85.sig. Mandiant even noticed some of these requests returning a normal-looking 404 error while taking unusually long to process, which is the kind of detail that only stands out once you know to look for it. Getting root access the first time is easy because the exploit already runs with root privileges. To keep that access for future web requests, the installer makes /bin/sh setuid, so commands run through the shell continue to run as root. It then forces a full reboot of the appliance to make sure the changes stay in place. Simple, effective, and a pretty clever way to make the compromised system keep giving the attacker root access. The two custom tools doing the real work are called WHIPSHOT and SLAPSHOT, and Mandiant hadn’t seen either before. “Following successful exploitation, the initial web shell payload self-installs by modifying target httpd.conf files, configuring the system to treat specified non-script file types as executable PHP scripts, setting the stage for the deployment of additional custom malware including WHIPSHOT (a PHP web shell) and SLAPSHOT (a Python proxy/tunneler).” states the report. WHIPSHOT is the PHP web shell, disguised as a Debian package, that reads commands hidden inside sequential HTTP header fields, decodes them from Base64, and forwards them over a local loopback connection. It also quietly kills its own error reporting and always answers with a 404, so a scan of the web server logs shows nothing unusual on the surface. SLAPSHOT is what lets the attacker move beyond the compromised appliance. It creates a simple Python proxy that opens a local port and forwards TCP traffic into the internal network. In one confirmed attack, the attacker used it to explore the network and look for credentials. The connection started from an internet-facing gateway, giving the attacker a tunnel into the internal network. SLAPSHOT even cleans up after itself if nobody’s using it, closing idle sessions after 15 minutes and shutting itself down entirely after 10 minutes with no activity, deleting its own port and lock files on the way out. That’s not laziness, that’s someone who’s thought about what a forensic analyst would go looking for and decided not to leave it lying around. This is not a new problem. Edge devices such as VPN gateways, load balancers and firewalls are often targeted because they are exposed to the internet, are usually outside standard endpoint security tools, and may contain credentials that provide access to the internal network. Mandiant recommends patching to the fixed versions first. Isolating a remote-access gateway can cause major disruption. If patching is not immediately possible, disabling DTLS and blocking inbound UDP/443 can stop this specific attack path, but it does not protect against the second zero-day. If an appliance may have been compromised, assume that all credentials it handled are exposed. This includes admin accounts, SSH keys, TLS certificates, LDAP and RADIUS credentials, and other secrets used to access internal systems. Rotate them after the appliance has been patched, not before. “This campaign underscores the continued targeting of edge devices to gain initial access to victim networks, a trend that GTIG has tracked across a range of threat actors. Notably, these vulnerabilities made up about half of the enterprise-related zero-days in 2025.” contludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Citrix NetScaler)
Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler
A Vietnamese national was charged with money laundering for his role in a massive "pig butchering" scam, which defrauded a victim out of $16 million worth of cryptocurrency. 37-year-old Trung Nguyen Van entered the United States through the San Ysidro, California / Mexico pedestrian border entry point on September 22 and was arrested before boarding a flight to Taiwan out of Los Angeles International Airport on September 24. One of Van's victims transferred about $16 million in cryptocurrency between June and August 2024 in transfers directly traceable to Van's cryptocurrency wallet, believing they were investing in a crypto investment platform called "Triangle." After collecting the funds, the defendant transferred them to a private, unhosted crypto wallet off the centralized blockchain network.
American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability. Formerly known as Accellion, it operates a Private Content Network (PCN) that integrates enterprise email, file sharing, Managed File Transfer (MFT), APIs, and web forms into a single platform. Kiteworks provides services to thousands of global corporations and government agencies, and its Private Data Network has over 100 million end-users. The secure file-sharing software company urged customers worldwide on Saturday to temporarily shut down their servers after receiving a warning of a potentially imminent cyberattack from federal intelligence authorities. On Monday, the company brought all hosted customer systems back online after finding no evidence of compromise and no suspicious activity.
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity. AI-CYBERSECURITY Newsletter Exclusive: US military had close call after using AI for false intelligence report, sources say The Closed Quorum: Inside the first reported autonomous AI C2 implant OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files The Closed Quorum: Inside the first reported autonomous AI C2 implant Tech leaders to UN: For the sake of humanity, please control the AI technology we created MikroTrick: technical analysis, disclosure process, and the use of LLM agents Altman, Amodei Call for Global Cooperation on AI to Boost Safety Tech leaders to UN: For the sake of humanity, please control the AI technology we created Top 10 attacks on Claude Code and what each one actually broke CARBONATO: a botnet built around an AI agent Are AIs Still Struggling with CAPTCHAs? AI expert warns ‘machine-speed’ cyberthreats may require faster defenses than human-led responses Anthropic launches Claude Opus 5.5 with stricter safeguards for cybersecurity OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft SharePoint and Mikrotik RouterOS flaws flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-65660 (CVSS score of 8.8) Microsoft SharePoint Code Injection Vulnerability CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability CVE-2026-65660 is a code-injection vulnerability in Microsoft SharePoint Server that allows an authenticated, low-privileged attacker to execute arbitrary code remotely. The flaw affects SharePoint Server 2016, 2019, and Subscription Edition. The second flaw added to the catalog, tracked as CVE-2026-67279 (CVSS score of 6.9), is an SSH protocol flaw in MikroTik RouterOS that allows an unauthenticated attacker to bypass the normal authentication flow, open a session channel and execute commands, potentially creating or modifying files on the device. CERT Polska confirmed that the flaw is being actively exploited in the wild and that, when chained with CVE-2026-86060, it can lead to full administrative access without authentication. CERT Polska reported successful attacks against internet-exposed RouterOS devices dating back to at least September 2, 2026, with attackers using the MikroTrick chain. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by September 28, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
CARBONATO exploits exposed Docker daemons, installs an AI agent, steals API keys and spreads across networks with autonomous command execution. CARBONATO is a Docker-based botnet that has been active since at least October 2024. ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet. The registry contained the attackers’ entire toolchain and revealed details about how the botnet operates. In just one day of passive, read-only collection, researchers gathered 4.3 GB of image data, including 59 repositories, 234 tags, and 605 verified file blobs. The registry also exposed the configuration history of the images, revealing command-and-control addresses, bot tokens, and even the shared password for the attackers’ own AI gateway. The operation appears to be linked to Costa Rica, although researchers say the infrastructure could also be used by someone operating from elsewhere. The initial infection method is relatively simple. The bot scans for Docker daemons accepting unauthenticated connections on port 2375, a configuration that thousands of hosts still run publicly reachable. When it finds one, it uses the Docker API itself to launch a privileged container with the host filesystem mounted, then runs commands directly on the underlying machine through that container. The host’s own daemon does most of the work. “The container starts by running entry.sh. The script opens a reverse SSH tunnel from the victim to a relay in Costa Rica, giving the operators a path back into the host. Its remote port is derived from the MD5 hash of the victim’s IP address, so the crew can calculate the same port whenever it needs to reconnect.” reads the report published by Threatdown. “The script also installs an SSH server, adds the crew’s key, and sends a deployment report to Telegram with the container ID, hostname, IP address, and country.” Source Threatdown report: entry.sh v5.3, tier 1: the foothold, the deterministic tunnel port, and the Telegram deployment report. Once in, a script opens a reverse SSH tunnel back to a relay in Costa Rica, installs an SSH server, adds the crew’s own key, and sends a deployment report to a Telegram chat. The tunnel port isn’t random: it’s derived from the MD5 hash of the victim’s IP address, so the operators can calculate which port to reconnect to without storing anything. The deployment reports are written in voseo Spanish, the regional form using “vos” instead of “tú,” which narrows the linguistic origin considerably even if it doesn’t name a country. Persistence gets layered on through cron jobs, systemd timers, rc.local, and OpenRC, and every one of those files gets marked immutable afterward so a cleanup attempt can’t just delete them. A paired watchdog monitors the deployment and re-pulls the implant from the registry if its container disappears. The container itself runs under the name “systemd-resolved” and displays a fake systemd-networkd resolver banner, while its process arguments imitate a kernel thread called [kworker/u2:0]. A quick process review on a compromised host would see nothing obviously wrong. The part that makes CARBONATO genuinely new is what comes after persistence is established. The implant installs Hermes Agent, an MIT-licensed open-source framework from Nous Research, entirely unchanged. “At the center of the botnet is Hermes Agent, an MIT-licensed open-source agent framework. The implant installs the framework unchanged, then overwrites its SOUL.md persona file.” the report states. “The 39-line prompt directs it to execute tasks received through Telegram, maintain persistence, and collect credentials.” The attackers only modify one file: the agent’s SOUL.md persona file. This 39-line prompt renames the agent “GH0ST” and tells it what to do. The Hermes framework itself remains unchanged. The malicious behavior comes from the instructions loaded when the agent starts, making the modified agent harder to detect through the binary alone. The instructions are straightforward. GH0ST is told to act as a post-exploitation tool, maintain persistence, and carry out commands sent by the operators through Telegram. It is also given one priority above all others. The prompt lists 14 providers by name: OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API. It ranks those keys above SSH credentials, above access tokens, above databases. The reason becomes clear when you look at the operation’s own LLM gateway, which was still live on September 3, running on a free tier while advertising 12 models and serving 27 through its API. These operators are funding their own AI compute with stolen credentials from the machines they’ve already compromised. The actual workflow is a loop. An operator sends a task through Telegram. Hermes Agent forwards that task, along with the SOUL.md persona, to the LLM gateway. The model writes terminal commands, reads the output, decides what to do next, and reports back to the same Telegram chat that receives deployment notifications. It’s an interactive command interface that adapts as the host reveals new information, without the operators needing to write custom tooling for each situation. The botnet spreads without using AI. Every five minutes, a script checks the networks connected to the compromised host and its Docker bridges, then scans the surrounding /24 networks for exposed Docker daemons on port 2375. When it finds another vulnerable host, it checks whether it is already infected and, if not, deploys the malware. The new host then joins the same scanning process, allowing CARBONATO to spread across the network without further instructions from the operators. Several clues point to Costa Rica. Fourteen of 162 image configurations contain UTC-06:00 timestamps matching the country’s timezone. The operators also use the Telegram handle “Carbo506,” while +506 is Costa Rica’s country code. In addition, the reverse SSH tunnels connect to infrastructure in AS262145, a Costa Rican network. None of these clues would be enough on its own, but together they provide stronger evidence linking the operation to Costa Rica. “Three additional signals point toward Costa Rica. Fourteen of 162 image configurations use UTC-06:00 timestamps matching the America/Costa_Rica timezone. The Telegram handle is Carbo506, and +506 is Costa Rica’s country calling code. The reverse SSH tunnels also terminate at a sink in AS262145, a Costa Rican network.” states the report. “Each signal comes from a different part of the botnet operation: build configuration, operator identity, and active infrastructure. Taken together, they support a Costa Rica assessment for the botnet operators.” If you’re running Docker anywhere, the fix for the infection vector is simple: don’t expose the daemon API to the network unauthenticated, and lock down every registry with authentication, because as this case shows, an open registry is simultaneously a leak and a delivery mechanism for the implant itself. For detection, don’t blocklist hermes-agent outright since it’s a legitimate package with real users. Hunt for the abuse signature instead: a /root/.hermes/SOUL.md containing “GH0ST,” a .env file carrying CARBONATO_API_KEY, or unexplained Telegram traffic leaving your servers. And if you store AI API keys anywhere on your infrastructure, treat them the way this crew explicitly does: “The doctrine ranks them first, so inventory where they live, rotate them, and monitor their usage.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CARBONATO botnet)
Confirm this action.
Leaving now will discard your changes.