(Another) Record Patch Tuesday, AI PowerShell Malware, and a Passkey Mandate - Blumira Briefings

Welcome to Blumira Briefings, your top headlines and trends for your security practice!In this week's edition:- PHP Releases Emergency Fixes for Critical Remote Code Execution Vulnerabilities - WordPress Sites Backdoored Through Compromised UpdraftCentral Management Keys - Major Browsers Block Indian Certificate Authority Certificates Over Key Compromise--Have a security topic you want us to cover?Let us know in the comments!--Sources:PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flawshttps://securityaffairs.com/201403/security/php-prepares-emergency-fixes-for-two-critical-remote-code-execution-flaws.html-- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Siteshttps://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html-- Google, Mozilla revoke eMudhra intermediates after private key compromisehttps://www.csoonline.com/article/4238338/google-mozilla-revoke-emudhra-intermediates-after-private-key-compromise.html

Welcome to Blumira Briefings, your weekly download of the top headlines and trends for your security practice!In this week's edition:- Attackers Exploit Three Ivanti VPN Zero-Days, Steal Credentials, Evade Detection - Microsoft Releases Record 1,400+ Patches, Including Fix for Actively Exploited Windows Zero-Day - US Authorities Charge 14 in North Korean Remote IT Worker Scheme for Covert Network Access--Have a security topic you want us to cover?Let us know in the comments!--Sources:Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilitieshttps://securityaffairs.com/200895/hacking/volexity-uncovers-stealthy-ivanti-vpn-attack-using-three-zero-day-vulnerabilities.html-- Microsoft Patches More Than 1,400 Security Flawshttps://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/-- DOJ charges 14 over a sprawling North Korean remote work schemehttps://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/

Welcome to Blumira Briefings, your top headlines and trends for your security practice!In this week's edition:- FBI Warns FortiBleed Campaign Actively Compromising Fortinet Firewalls and VPNs - Critical Atlassian Vulnerability Affects Eight Enterprise Products, Patch Immediately - AI-Discovered Critical Flaw in Rejetto HFS Now Under Active Exploitation--Have a security topic you want us to cover?Let us know in the comments!--Sources: Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attackshttps://cyberscoop.com/fortibleed-fortinet-vpn-ransomware-fbi-warning/-- Atlassian’s critical flaw turns eight enterprise products into one big security problemhttps://www.csoonline.com/article/4231527/atlassians-critical-flaw-turns-eight-enterprise-products-into-one-big-security-problem.html-- Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.https://securityaffairs.com/200444/ai/anthropic-mythos-found-a-bug-in-rejetto-hfs-attackers-are-now-exploiting-it.html

Welcome to Blumira Briefings, your weekly download of the top headlines and trends for your security practice!In this week's edition: - F5 Emergency Patch for BIG-IP APM Zero-Day: Unauthenticated Remote Code Execution Under Attack - Chinese State-Aligned Hackers Exploit Chrome and Windows Zero-Days in New Attacks - Sophisticated Infostealer Impersonates LastPass on GitHub, Disables Wide Range of Security Software--Have a security topic you want us to cover?Let us know in the comments!--Sources:F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servershttps://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html-- Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defectshttps://cyberscoop.com/volexity-uta0565-china-exploit-chain-chrome-microsoft/-- Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Toolshttps://securityaffairs.com/199577/malware/fake-lastpass-on-github-led-to-an-infostealer-that-killed-145-security-tools.html

Welcome to Blumira Briefings, your weekly download of the top headlines and trends for your security practice!In this week's edition:- Apple has addressed more than 260 CVEs across all of its operating systems, browsers, and other software products, marking the largest single patch cycle in Cupertino's history.- Critical ConnectWise ScreenConnect Vulnerability Actively Exploited; Organizations Urged to Patch Now - Cisco Emergency Patches Address Zero-Day Exploit Granting Root Access on Email Gateways - China-Linked Actors Use Same Chrome and Windows Zero-Days in Espionage Campaigns--Have a security topic you want us to cover?Let us know in the comments!--Sources:The vulnpocalypse rains iBugs down on Apple with record-setting number of patches https://www.theregister.com/security/2026/09/15/the-vulnpocalypse-rains-ibugs-down-on-apple-with-record-setting-number-of-patches/5296679- Critical ScreenConnect flaw now actively exploited in attackshttps://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/Cisco warns customers of actively exploited zero-day in email gatewayshttps://cyberscoop.com/cisco-secure-email-gateway-zero-day-exploited/One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Firehttps://securityaffairs.com/199104/apt/one-exploit-chain-two-espionage-campaigns-chrome-and-windows-under-fire.html

Welcome to Blumira Briefings, your weekly download of the top headlines for your security practice!In this week's edition:- Critical Remote Code Execution Vulnerability in Gitea Actively Exploited, CISA Warns - Critical WordPress SAML Plugin Authentication Bypasses Actively Exploited While Unpatched - Microsoft Advises Network Controls as Vulnerability Patching Window Rapidly ShrinksSources: Hackers now exploit critical Gitea flaw in code injection attackshttps://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks/-- Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerablehttps://securityaffairs.com/197815/security/two-cvss-9-8-auth-bypasses-in-miniorange-saml-wordpress-plugin-were-exploited-before-any-database-even-listed-the-paid-editions-as-vulnerable.html-- Microsoft warns patch window is collapsing, urges shift to network-level containmenthttps://www.csoonline.com/article/4214135/microsoft-warns-patch-window-is-collapsing-urges-shift-to-network-level-containment.html-- 

Welcome to Blumira Briefings, your top headlines and trends for your security practice!This week:- Microsoft fixes record number of vulnerabilities in July Patch Tuesday, including actively exploited zero-days. - Microsoft mandates passkeys as default authentication method for Entra ID by September 2026. - Attackers now using artificial intelligence to create custom PowerShell reconnaissance malware.--Have a security topic you want us to cover?Let us know in the comments!--Sources:Patch Tuesday roundup: Microsoft fixes a monthly record 569 holes; SAP patches a critical memory corruption bughttps://www.csoonline.com/article/4196940/patch-tuesday-roundup-microsoft-fixes-a-monthly-record-569-holes-sap-patches-a-critical-memory-corruption-bug.html-- Microsoft is forcing an enterprise transition to passkeyshttps://www.csoonline.com/article/4197086/microsoft-is-forcing-an-enterprise-transition-to-passkeys-2.html-- Attacker Used AI to Build Custom PowerShell Recon Malwarehttps://securityaffairs.com/195321/hacking/attacker-used-ai-to-build-custom-powershell-recon-malware.html

Welcome to Blumira Briefings, your weekly download of the top headlines and trends for your security practice!In this week's edition: - CISA Confirms Microsoft Defender Flaw Actively Exploited in Ransomware Campaigns for System Access - Critical SimpleHelp Authentication Bypass Actively Exploited, Puts Managed Service Providers at Risk - Advanced Phishing Kit Resembles Business Email Compromise Platform, Bypasses Multi-Factor Authentication--Have a security topic you want us to cover?Let us know in the comments!--Sources:CISA Warns BlueHammer Flaw Is Now Exploited in Ransomware Attackshttps://securityaffairs.com/194577/security/cisa-warns-bluehammer-flaw-is-now-exploited-in-ransomware-attacks.html-- U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities cataloghttps://securityaffairs.com/194503/security/u-s-cisa-adds-simplehelp-flaw-to-its-known-exploited-vulnerabilities-catalog.html-- This phishing kit looks more like BEC-as-a-servicehttps://cyberscoop.com/artoken-bec-platform-cisco-talos/-- 

Welcome to Blumira Briefings, your weekly download of the top headlines and trends for your security practice!This week:- Cyber Broker Exposes Access to Over 73,000 Fortinet Firewalls for Sale - New Mistic Remote Access Trojan Utilized by Ransomware Initial Access Brokers in Active Campaigns - Supply Chain Attack Infects WordPress Plugins, Stealing Credentials and 2FA SecretsSources:FortiBleed: The Broker Who Turned 73,000 Firewalls Into a Product Cataloghttps://securityaffairs.com/194132/cyber-crime/fortibleed-the-broker-who-turned-73000-firewalls-into-a-product-catalog.html-- Stealthy Mistic backdoor linked to ransomware access broker KongTukehttps://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/-- ShapedPlugin Supply Chain Attack Backdoors Pro Plugin Updateshttps://securityaffairs.com/194059/hacking/shapedplugin-supply-chain-attack-backdoors-pro-plugin-updates.html

Welcome to Blumira Briefings, your weekly download of the top headlines and trends for your security practice!In this week's edition:- CISA Directs Agencies to Patch Actively Exploited Cisco and cPanel Vulnerabilities This Week - FortiSandbox Vulnerabilities Actively Exploited, Urgent Patching Recommended for Critical Flaws - Rokarolla Android Trojan Actively Spreads, Stealing Banking and Crypto Credentials, Bypassing Security--Have a security topic you want us to cover?Let us know in the comments!--Sources:U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities cataloghttps://securityaffairs.com/193684/security/u-s-cisa-adds-cisco-catalyst-and-litespeed-cpanel-plugin-flaws-to-its-known-exploited-vulnerabilities-catalog.html-- Active exploitation of FortiSandbox flaws prompt urgent patching calls from security expertshttps://www.scworld.com/news/three-critical-fortisandbox-bugs-rated-98-actively-exploited-- New Rokarolla Android Trojan Targets 217 Banking and Crypto Appshttps://securityaffairs.com/193745/cyber-crime/new-rokarolla-android-trojan-targets-217-banking-and-crypto-apps.html