As your dedicated cybersecurity services provider, CyberOne equips you with timely and in-depth information about current cyber attacks. Discover a weekly cybersecurity report of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape.
Weekly Cybersecurity Report | Week 39, 2026
Information security updates and events from the past week
1. Chinese Threat Actors Exploit ZyXEL Switch Flaw (CVE-2026-7273) for Global Data Theft
Summary: On September 22, 2026, threat intelligence firm GreyNoise disclosed that a Chinese state-sponsored threat group (linked to the Red Heron cluster) actively exploited CVE-2026-7273 across 996 ZyXEL GS1900 series switches in 48 countries. The flaw, a stack-based buffer overflow rated CVSS 8.8, allows unauthenticated remote attackers to execute operating system commands via crafted HTTP requests. The attackers exfiltrated hashed root credentials, device configurations, and internal network maps, with over 18,000 records stolen from a Western governmental organization. Prompted by active exploitation, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog with a three-day remediation mandate.
Impact / Significance: Compromise of edge network routing hardware. Exfiltrating router and switch configuration files and administrative credentials gives adversaries deep architectural visibility into internal subnets, facilitating stealthy lateral movement and man-in-the-middle data collection.
Recommendations:
Apply ZyXEL’s firmware updates for all affected GS1900 switch models immediately.
Audit managed switches for factory-default passwords and immediately replace them with strong, unique credentials.
Restrict switch administrative management interfaces (HTTP/HTTPS) to dedicated out-of-band management VLANs rather than public-facing or general corporate networks.
Source: SecurityWeek — Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers | Ground News — CISA Orders Feds to Patch Zyxel Flaw Exploited for Data Theft
2. Malicious B-Tree NPM Packages Harvest System Credentials Across Millions of Installs
Summary: On September 22, 2026, Checkmarx reported an ongoing software supply-chain campaign targeting the NPM JavaScript ecosystem. Attackers published packages such as indexed-btree (masquerading as the legitimate sorted-btree utility), accumulating over 2 million weekly downloads and more than 5 million total downloads before removal. The malware bypasses automated install-script security scans by embedding its payload inside the package’s prototype method (BTree.prototype.set). Once executed in production environments, the code exfiltrates host metadata to Slack and Telegram channels, fetches encrypted second-stage payloads from a smart contract on the Ethereum Sepolia testnet and deploys cryptocurrency-stealing logic.
Impact / Significance: Advanced evasion in open-source dependencies. Embedding malicious triggers directly into operational object prototypes rather than installing scripts allows malware to evade standard static analysis tools while gaining execution inside live backend application logic.
Recommendations:
Audit application dependencies across JavaScript and Node.js projects for packages including indexed-btree, ordered-kv-index, btree-leaderboard, and related variants.
Implement dependency locking via strictly hashed package lockfiles (package-lock.json, pnpm-lock.yaml) and utilize Software Bill of Materials (SBOM) analyzers to identify unexpected package introductions.
Restrict outbound network progresses from build runners and production servers to authorized external APIs only.
Source: SecurityWeek — Malicious B-tree NPM Package Accumulates Millions of Downloads
3. WordPress Resolves ‘Click2Shell’ Vulnerability Enabling One-Click Remote Code Execution
Summary: On September 22, 2026, security researchers at pwn.ai and WordPress core maintainers detailed “Click2Shell,” a critical flaw resolved in WordPress version 7.1.1 (and backported across earlier versions to 4.7). The flaw stems from a discrepancy in how theme-preview URLs are parsed between the WordPress Themes API and browser-side JavaScript, allowing unsanitized input into a jQuery selector. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in site administrator, silently installs an inactive theme from the official repository and executes malicious PHP code via the Customizer preview, granting complete server takeover without changing the site’s visible theme.
Impact / Significance: Unauthenticated remote code execution (RCE) via administrative social engineering. Because the site’s primary theme remains active during exploitation, site administrators receive no visual indication that an unauthorized theme was fetched and executed in the background.
Recommendations:
Update all self-hosted WordPress installations immediately to version 7.1.1 or the corresponding patched security release.
Audit web server file roots (/wp-content/themes/) for unexpected or unfamiliar theme folders and verify file integrity.
Deploy Web Application Firewall (WAF) rules that filter and inspect incoming administrator query strings for theme-preview URL parameter abuse.
Source: SecurityWeek — WordPress Patches ‘Click2Shell’ Vulnerability
4. Fake LastPass Installers Deploy Kernel Driver to Terminate 145 EDR and Security Tools
Summary: On September 21, 2026, LastPass and security consultancy Delphos published findings on a widespread corporate impersonation campaign. Threat actors deployed SEO-poisoned GitHub pages offering fraudulent LastPass Authenticator applications for Windows and macOS. When executed on Windows, the installer side-loads a malicious DLL (created via the Cruciferra PUROSANGUE crypter framework) that installs a Microsoft-attested kernel driver disguised as an NVIDIA component. The driver systematically terminates 145 antivirus and Endpoint
Detection and Response (EDR) agents before launching the ‘Rapuncel’ infostealer to exfiltrate browser credentials, 30 cryptocurrency wallet stores, and session tokens.
Impact / Significance: Kernel-level defensive evasion (Bring Your Own Vulnerable Driver / BYOVD). By running in kernel space (Ring 0), the attacker driver overrides user-mode and kernel-mode security hooks, permanently neutralizing defensive software on the host and establishing persistence via an automated boot service.
Recommendations:
Enable Windows Defender Application Control (WDAC) and enforce Microsoft’s Vulnerable Driver Blocklist to block known abused and vulnerable kernel drivers.
Restrict local administrator privileges on corporate endpoints to prevent unauthorized driver installation.
Instruct employees to obtain authenticator applications and password managers exclusively from official corporate software portals or verified vendor websites.
Source: SecurityWeek — Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer
5. Cyberattacks Target Operational Technology Systems at Colorado Water Utilities
Summary: On September 21, 2026, Colorado state officials confirmed that foreign threat actors breached industrial control systems (ICS) and operational technology (OT) networks at two private water utilities in Colorado. The attackers altered water treatment equipment settings, disabled remote telemetry and safety alarms, and manipulated pumping cycles before the activity was identified and contained. State officials noted that the intrusions align with ongoing nationwide campaigns by foreign actors targeting internet-exposed municipal water and wastewater infrastructure.
Impact / Significance: Physical disruption risk to critical infrastructure. Manipulating programmable logic controllers (PLCs) and pumping cycles can alter chemical balances or cause water line pressure surges, demonstrating continued vulnerabilities in municipal utility networks.
Recommendations:
Completely disconnect operational technology (OT) networks and programmable logic controllers from the public internet.
Mandate phishing-resistant multi-factor authentication (MFA) on all remote administrative gateways and virtual private networks connected to municipal utilities.
Establish out-of-band physical fail-safes and manual override mechanisms that prevent software adjustments from exceeding safe chemical or pressure parameters.
Source: SecurityWeek — Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems
The cybersecurity attacks highlighted in this report aren’t just incidents, they’re blueprints of the adversary’s arsenal. To protect your business you need the right partner. CyberOne is here to help! Check out our services.
