SecBlog Weekly — Issue 002

Week of Sep 8, 2026 · secblog.reedcloudsec.com

SecBlog Weekly Issue 002: Patch Now, Trust Nothing.

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's own largest security update to date — BleepingComputer counts 966 flaws, SecurityWeek counts 974; the gap looks like a difference in what each outlet bundled in (BleepingComputer notes 204 additional flaws were fixed earlier in the month across Azure, Copilot, and other services and aren't in today's count), not a real disagreement about what shipped. Either way, it dwarfs July's 570 and August's 400, and Microsoft attributes part of the jump to its own AI-powered vulnerability discovery system finding more than manual review used to catch. Two of the fixes are actively exploited zero-days: CVE-2026-81963, a link-following flaw in the Windows Update Stack, and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC — both local elevation-of-privilege flaws, both already exploited in the wild. Neither needs a network path to be dangerous: a local EoP is exactly the second stage an attacker wants after landing through any of this month's several hundred other bugs, so patching this month isn't optional even for the "it's just local, not remote" fixes — those are precisely the ones that turn an initial foothold into full control. Worth flagging — unconfirmed by any public status report as of writing — sources within healthcare dev and networking teams have described Azure and Visual Studio outages coinciding with this rollout, raising the question of whether some of this month's fixes destabilized specific configurations on the way out. Nothing here traces that to a specific patch yet — it's a "watch this" rather than a confirmed cause, but healthcare dev and networking teams specifically should hold off on unattended mass deployment until that's sorted out.
via BleepingComputer & SecurityWeek · Sep 8, 2026

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit (CVE-2025-53521)
The vulnerability itself has a history worth knowing: it was originally filed as a denial-of-service bug in March 2025 and only later reclassified as a critical remote-code-execution flaw — a reminder that a CVE's initial severity rating isn't necessarily its final one, and quietly-upgraded CVEs deserve a second look even if you triaged past them the first time. The payload here, dubbed PoisonedRefresh by researchers at Sophos and ESET, is a genuinely nasty piece of engineering: it infects the Apache httpd binary itself and intercepts PHP file loading to inject a fileless web shell directly into memory, hidden inside legitimate-looking PHP files like apm_css.php3 — the files on disk never change, which specifically defeats file-integrity-style detection. It also drops a password-protected local Unix socket for an interactive Bash shell and modifies SELinux configuration for persistence. ShadowServer counted roughly 795 still-exposed vulnerable endpoints online as of September 7 — no confirmed patch status was available at the time of writing, so check F5's own advisory directly before assuming a version bump alone covers this.

The detection lesson matters beyond F5 specifically, and it's worth being precise about why file integrity monitoring alone falls short here: a kernel-level rootkit like this one can intercept the exact syscalls your FIM tool relies on — stat() and read() — showing the checker a clean version of the file while serving the malicious version to php-fpm underneath it. Once an attacker has kernel or build-pipeline persistence, anything measured from inside the host is fundamentally unreliable, because the host itself is what's lying to you. The fix is layering, not swapping one tool for another. Out-of-host verification — hashing and comparing files from entirely outside the guest, via hypervisor disk introspection, cloud-provider snapshot diffing, or an agent reading the raw block device from a genuinely separate trust boundary — can't be lied to by a rootkit, since the rootkit only controls what the guest OS reports back. Pair that with runtime behavioral monitoring at the tracepoint/syscall level: alert on php-fpm spawning a shell (sh, bash, curl, wget) or writing to the webroot, since that's the actual moment of compromise regardless of what the filesystem claims. On the PHP side: harden the runtime by disabling dangerous functions (exec, shell_exec, eval) via disable_functions, and lock opcache so it's populated once at deploy time rather than left open to runtime poisoning. And make the webroot itself immutable — mount it read-only at the OS level, with only the deploy process holding write access through a separate mount that gets remounted read-only the moment deploy finishes.
via BleepingComputer (Sophos/ESET research) · Sep 8, 2026

Attackers breached JetBrains Cadence via unpatched TeamCity, extracting AWS credentials (CVE-2026-63077, CVSS 9.8)
An unauthenticated deserialization flaw in TeamCity let attackers execute arbitrary OS commands with the TeamCity server's own privileges — no login required. From there they reached a 2024 backup of JetBrains' Cadence service and pulled multiple AWS IAM users and their associated credentials, including some belonging to JetBrains employees, plus PyCharm project source synced through the service and S3 bucket access. The part worth sitting with: those were 2024-vintage credentials that had been sitting live in a backup for the better part of two years — exactly the kind of standing, long-lived access this pillar keeps flagging as the thing to eliminate rather than merely monitor. JetBrains' own remediation guidance is the textbook response — revoke and rotate everything, invalidate every PyCharm Cadence plugin token, audit connected systems, review repos for unauthorized changes — and the compromised server remains offline while that happens. The broader point: an unauthenticated RCE on a build server isn't just a build server problem — it's direct access to every credential that server was ever trusted with.
via The Hacker News · Sep 5, 2026

FreeIPA flaw chain lets anonymous clients create reusable administrator credentials (CVE-2026-76578, CVSS 9.8 · CVE-2026-76560, CVSS 7.5)
This one is worth reading closely because the bug is in the logic of access control, not a missing check. FreeIPA has a rule letting users manage their own one-time-password tokens without prior login — reasonable on its own. Separately, the underlying 389 Directory Server compares client identities as plain text, and an unauthenticated client's identity compares as empty — which then matches other empty stored values, silently passing an ownership check meant to stop exactly this. Chain the two together and an anonymous client can write a token entry with blank ownership fields and smuggle in a Kerberos identity and password in the same write — anonymous to admin-equivalent credentials in one step, no login ever required. FreeIPA is fixed in 4.13.4, and 389-ds-base shipped fourteen advisories on September 8 — but Red Hat Enterprise Linux's own ipa packages were not yet patched as of publication, so version-checking FreeIPA alone isn't sufficient if you're running RHEL's bundled packages. Until patched, Red Hat's own guidance is to restrict LDAP (389/636) at the firewall and disable anonymous binds outright. This is as clean an illustration as you'll find of why every access-control rule needs its edge cases audited, not just its intended path — "empty matches empty" is the kind of assumption that reads as harmless right up until it isn't.
via The Hacker News · Sep 8, 2026

ChatGPT flaw let a planted prompt send a victim's Gmail data to another account
Framed correctly up front: this was a research proof-of-concept from Check Point, responsibly disclosed and already fixed — not an attack that happened to real users. Check Point found they could plant hidden instructions three ways (a prompt the user pastes in, a shared conversation the user opens, or a custom GPT's builder instructions, which the user never sees), causing ChatGPT's Thinking mode to run a second, invisible task alongside the visible one: checking a hidden mailbox for attacker instructions, carrying them out using the tools already available in the user's own session, and reporting the result back. The actual exfiltration path ran through an internal package-management service whose cached-file metadata was readable across different users' accounts — an unintended side channel that let data (Gmail content, chat history, conversation files) cross a boundary that was never supposed to be crossed. OpenAI confirmed the finding and took the internal service offline; no user action was required. The lesson outlasts this specific fix: agentic AI platforms that share internal infrastructure across user sessions are creating a new category of confused-deputy risk, and "the user can't see this instruction" is doing a lot of the same work an unvalidated input field used to do.
via The Hacker News (Check Point Research) · Sep 8, 2026

Hackers return $263 million stolen from Liquid Network
Worth including for the ambiguity as much as the number. Attackers found a real vulnerability in Elements — the underlying blockchain framework Liquid's sidechain runs on — and used it to move roughly $320 million (4,000 BTC) out. They then identified themselves on-chain as "whitehats," negotiated publicly, returned about $266.5 million, and kept $47 million (598.5 BTC) as a self-declared "reward" they'd never actually been offered — while demanding the vulnerability get patched before the rest came back. That's not the same thing as a bug bounty, and "whitehat" is arguably the wrong label entirely — this reads closer to a mercenary category worth its own name: green hat, green for the dollar sign rather than any neutral middle ground, for an actor who isn't malicious enough to call black hat and isn't disinterested enough to call white hat, but treats finding the flaw as leverage and "returning most of it" as the negotiation. A real bounty has agreed-upon terms set before the vulnerability is used, not a unilateral cut taken during the theft and dressed up afterward as good faith; the debate this set off online was warranted, not a footnote. Vito Corleone would recognize the move immediately — make an offer, take a cut, and call it protection. The practitioner takeaway isn't really about this specific incident — it's that a defined, funded bug bounty program that exists before someone finds your critical flaw is what actually prevents this exact ambiguity from having room to exist in the first place.
via SecurityWeek · Sep 8, 2026

That's Issue 002. Free weekly, no spam, unsubscribe anytime — secblog.reedcloudsec.com