Security
CISA orders urgent patching of three exploited Linux kernel flaws
A 14-year-old kernel race condition, an ebtables out-of-bounds write and a kTLS logic flaw are under active attack, with federal fixes due today.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
CISA flags active exploitation of three Linux kernel flaws, one critical
CISA warned that attackers are exploiting three Linux kernel vulnerabilities, rated medium to critical, and ordered federal agencies to apply updates and mitigations by the end of today. CVE-2025-39964, a race condition in the AF_ALG cryptographic socket interface that existed for 14 years, can corrupt per-socket state and alter cryptographic results or crash systems. CVE-2026-53266 is an out-of-bounds write in ebtables SNAT handling; CVE-2025-39682 is a kTLS receive-path logic flaw. STAR Labs found CVE-2025-39964 without AI help and demonstrated privilege escalation and container escape in Google’s kernelCTF. Public exploits exist for two flaws, and CISA requires forensic triage of affected assets.
CISA alerts of active exploitation of three Linux kernel flaws →
Blockchain-hosted malware rises 440% as AI lowers the barrier
Chainalysis reports malicious blockchain activity jumped 440%, with daily entries rising from 2.06 to 11.1 after high-capacity Chinese open models arrived. Attackers hide malware instructions in transaction data or smart contracts, so infected machines can retrieve commands and updated addresses even if a conventional server is taken down. A North Korean-linked operation tied to UNC5342 routes through TRON and Aptos before pulling encrypted instructions via BNB Chain, while suspected Iranian actors embed routing data in Bitcoin transactions. Russian-speaking criminals sell Polygon-based infrastructure, and one operator controls more than 50 BNB Chain resolver contracts. State-linked groups accounted for about two-thirds of newly observed activity in Q2 2026. Blocking blockchain traffic risks disrupting legitimate wallets and DeFi services.
WordPress Click2Shell flaw enabled pre-auth PHP execution
A cross-site request forgery flaw in WordPress Core, named Click2Shell, let attackers install any theme from the official catalog and execute an arbitrary PHP file, achieving pre-authenticated remote code execution. Researcher Paulos Yibelo of pwn.ai found it and reported it on August 22; WordPress fixed it in version 7.1.1 by escaping the theme slug and restricting the jQuery selector to actual theme cards. The exploit required a logged-in administrator to visit a crafted URL, after which a Customizer preview ran the inactive theme’s PHP. Patchstack said only administrators can trigger the chain, and sites with DISALLOW_FILE_MODS enabled cannot be forced to install the theme.
WordPress Click2Shell flaw lets hackers execute PHP on the server →
Sonoma macOS infostealer poses as Zoom, Brave and Slack downloads
Crazy Evil, a traffer-style operation targeting crypto and collaboration-software users, is running a new macOS infostealer marked SONOMAC1 and called Sonoma. It spreads via DMG or ZIP files posing as StreamYard, Zoom, Slack, DocSend, Brave Talk, Toria and other apps. A universal Mach-O launcher strips quarantine attributes, decrypts embedded config and runs a second stage; a hidden Swift core steals browser databases, extension wallets such as MetaMask and Phantom, desktop wallet data from Ledger Live and Exodus, developer secrets from ~/.aws/ and ~/.ssh/, and host details. A fake installer re-prompts for the Mac login password until valid, then unlocks the Keychain. Data is exfiltrated to 109[.]94[.]171[.]225:443.
Downloading Zoom or Brave? Could Be New Mac Malware ‘Sonoma’ In Disguise | HackerNoon →
ShinyHunters defaces Cl0p ransomware leak site
On the night of Friday, September 18, the Tor leak site Cl0p used to pressure victims was defaced with Pokémon artwork, an ASCII Umbreon and the message THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS, plus a link to ShinyHunters’ own platform. ShinyHunters says it entered through an unauthenticated file-upload flaw in Grav, the CMS behind the site, and stole Cl0p’s source code, plugins and logs. It also claims to hold the private keys to Cl0p’s onion service, a detail analysts call unproven. ShinyHunters issued a 72-hour ultimatum; the feud appears to date to October 2025, when Cl0p used an Oracle E-Business Suite zero-day that ShinyHunters claims was its work. Cl0p has not commented.