The 48-hour period from September 6-7, 2026 revealed a concerning landscape of both targeted ransomware campaigns and widespread vulnerability exploitation. Seven organizations across government, healthcare, and engineering sectors were compromised by ransomware groups including DYSPHOR1A, direwolf, Vexy, chaos, and Panzer. Critical authentication bypass vulnerabilities (CVSS 9.8) were disclosed in WordPress plugins Frontend Admin and HivePress Authentication, enabling account takeover without authentication. The threat landscape also featured extensive SQL injection vulnerabilities across multiple applications, Mozi botnet infrastructure expansion with 49+ malware distribution URLs, and sophisticated phishing techniques using invisible Unicode characters to evade email security. A $10 million reward was posted for information on Iranian IRGC Cyber-Electronic Command leader Amir Yaryab, allegedly orchestrating attacks on critical infrastructure.
The most critical immediate concerns include three CVSS 9.8 vulnerabilities enabling unauthenticated remote code execution and account takeover, particularly CVE-2026-75816 (Frontend Admin plugin) and CVE-2026-86165/CVE-2026-86167 (Tenda HG10 router). The ransomware activity demonstrates continued targeting of healthcare and government sectors, with Myanmar's Road Transport Administration Department suffering a complete database compromise (1.08 GB). Defenders should prioritize patching WordPress installations, monitoring for ASCII smuggling phishing techniques, and implementing enhanced authentication controls.
Multiple critical vulnerabilities disclosed with CVSS scores 9.8, enabling authentication bypass and remote code execution without user interaction.
Critical authentication bypass vulnerability in Frontend Admin by DynamiApps plugin (all versions up to 3.29.12). The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits authentication, enabling unauthenticated attackers to take over any user account including administrators.
Critical buffer overflow in Tenda HG10 firmware 300001138. The formURL function in /boaform/admin/formURL fails to validate Keywd/urlFQDN parameters, allowing remote unauthenticated code execution. Public exploit available.
Critical OS command injection in Tenda HG10 firmware via formgponConf function in Boa web server. Manipulation of fmgpon_loid parameter enables remote code execution. CVSS 9.9. Public exploit disclosed.
High-severity vulnerability in SureCart plugin (before 4.6.3) allows subscriber-level users to modify other users' email addresses, including administrators, leading to account takeover through inconsistent permission checks during customer updates.
Authentication bypass in HivePress Authentication plugin (up to 1.1.4) via access_token parameter. Facebook authenticator forwards attacker-supplied tokens to Facebook API without validation, allowing identity spoofing and unauthorized access.
PostgreSQL Anonymizer allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries with untrusted expressions evaluated in the extension's masking context. CVSS 8.8.
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds. Unauthenticated attackers can supply arbitrary provider URLs via x-base-url header or baseUrl parameter to access cloud instance metadata services and extract credentials.
Seven organizations compromised by ransomware groups in 48 hours, spanning government, healthcare, and engineering sectors across multiple countries.
Myanmar government transportation authority compromised with full database dump totaling 1.08 GB. RTAD provides public transport services, driving license issuance, vehicle registration, and safety regulations at rtad.gov.mm.
Healthcare billing organization (dentalbilling.com) compromised by direwolf ransomware group. eAssist provides dental practice management and billing services.
Elderly care services provider (mylaurelhealth.com) compromised by direwolf ransomware group, potentially exposing sensitive patient health information.
Saudi Arabian healthcare design and engineering consultancy (kfoco.com) with 25+ years experience compromised by Panzer ransomware. Firm specializes in hospital and medical facility architecture.
German electronics design and research organization (edacentrum.de) compromised. Edacentrum is a recognized innovation accelerator designing R&D for electronics value chain methodology.
Contract Development and Manufacturing Organization (evergenbio.com) specializing in biomaterial solutions for regenerative medicine compromised by chaos ransomware group.
Indian real estate and construction company (sancity.in) incorporated in 2012 compromised by Vexy Ransomware group. Active unlisted public company in real estate marketing and sales.
Sensitive personal information of current and former Natural Resources Wales employees exposed through inadvertent publication of employee spreadsheet on public website, revealing personally identifiable information.
49 malware distribution URLs identified, dominated by Mozi botnet variants targeting IoT devices across multiple architectures, plus SalatStealer and generic stealer activity.
46 active Mozi botnet distribution URLs identified targeting ARM, MIPS, and x86 architectures. Malware delivered via compromised IoT devices on ports 37833, 60965, 38254, 47543, 39446, 42580, and others. Predominantly targeting routers and IoT devices globally.
Coordinated Mirai botnet campaign from IPs 176.65.139.217 and 176.65.139.221 distributing ELF binaries for multiple architectures (arm, arm5, arm6, arm7, mips, mpsl, x86, i686, m68k, ppc). Binaries disguised with kernel process names like kblockd0, ksoftirqd0, cfg80211d, bioset0.
SalatStealer malware distributed via 91.92.242.236 infrastructure, dropped by Amadey malware. File: file_434e7262b777edc2.exe. C2 monitoring active, indicating operational stealer campaign targeting credentials and sensitive data.
Stealer malware distributed from 78.159.131.228/k/jjscotttbpl.dat targeting credential theft and browser data exfiltration.
Novel phishing evasion techniques and sophisticated application-layer attacks identified.
Threat actors adopting ASCII smuggling technique using invisible Unicode characters to conceal phishing lures and evade email security filters. This technique allows attackers to bypass content inspection by hiding malicious content within seemingly benign messages.
Bifrost HTTP transport before 2.0.0 accepts enabled custom plugins with HTTP URL paths through unauthenticated POST /api/plugins when management authentication is disabled (default). Shared-object loader treats http-prefixed paths as downloads, enabling remote code execution. CVSS 8.1.
h3 library versions before 2.0.1-rc.18 fail to validate chunk count in setChunkedCookie() and deleteChunkedCookie() functions. Attackers send crafted cookies with extremely large chunk counts triggering O(n²) cleanup loops, causing server hangs and denial of service.
PocketMine-MP before 4.7.2 fails to handle exceptions from JSON parsing library when processing skin geometry data. Attackers send login or skin packets with invalid geometry JSON to trigger unhandled RuntimeException and crash server.
17 SQL injection vulnerabilities disclosed across multiple web applications, all with public exploits available and remote exploitation capability.
Six SQL injection vulnerabilities (CVE-2026-86225, CVE-2026-86224, CVE-2026-86223, CVE-2026-86222, CVE-2026-86221, CVE-2026-86220) in version 1.0 affecting mysqli_query functions across /admin/modal_add_room.php, modal_add_product.php, modal_add_coursea.php, modal_add_course2.php, modal_add_course1.php, and modal_add_course.php. All remotely exploitable with public exploits. CVSS 7.3.
Four SQL injection flaws (CVE-2026-86162, CVE-2026-86161, CVE-2026-86160, CVE-2026-86159) in version 1.0 affecting /ajax.php with actions login, delete_category, delete_voting, and save_user. Remote exploitation possible with public exploits. CVSS 7.3.
Additional SQL injection vulnerabilities in Mstfakts College-Management-System (CVE-2026-86214, CVE-2026-86213), code-projects Task Management System (CVE-2026-86180), code-projects Content Management System (CVE-2026-86168), and rabindralamsal inventory-management-system (CVE-2026-86211). All remotely exploitable with public exploits. CVSS 7.3.
US government offers $10 million reward for information on senior Iranian IRGC cyber operations leader.
US State Department posted $10 million reward for information on Amir Yaryab, senior Iranian official allegedly leading Islamic Revolutionary Guard Corps' (IRGC) Cyber-Electronic Command (CEC). Yaryab accused of directing cyberattacks against US critical infrastructure. Represents significant escalation in attribution and response to Iranian state-sponsored cyber operations.
New York State Comptroller releases municipal cybersecurity audit findings.
New York State Comptroller DiNapoli released multiple municipal cybersecurity audits covering audit period January 2024 - August 2025, including Town of Wilton assessment (2026M-48). Audits identify gaps in local government cybersecurity controls and incident response capabilities.
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.