Daily Security Intelligence Briefing — September 23, 2026
Tier 1 — Priority Targets (Must-Read)
1. Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
Source & Article Link: The Hacker News
Technical Severity / Domain: Endpoint & OS / CVE-2026-85046, CVE-2026-87491, CVE-2026-85880 (Active Zero-Day Chain)
Why You Must Read This: Threat actor UTA0565 chained two Chrome vulnerabilities with a Windows ALPC privilege escalation flaw to achieve full remote sandbox escape and host takeover. The exploit chain was weaponized in zero-day drive-by compromises prior to vendor patches. Because these components span enterprise endpoints globally, unpatched systems face immediate automated compromise.
Recommended Immediate Action: Force immediate enterprise browser updates for Chrome and enforce application of Microsoft September security updates across all Windows endpoints.
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. Active Zero-Day Exploitation Hits F5 BIG-IP APM and Check Point Management Servers
Domain: Network Infrastructure Security
Subject / Topic Summary: Emergency patches address active zero-day exploitation in F5 BIG-IP APM (CVE-2026-94127) and Check Point Security Management Server (CVE-2026-93616). The F5 bug permits unauthenticated remote code execution on OAuth servers, while Check Point's flaw allows unauthenticated remote script execution on management web interfaces.
Key Technical & Strategic Takeaways: F5 CVE-2026-94127 allows unauthenticated RCE when BIG-IP APM acts as an OAuth authorization server.; Check Point CVE-2026-93616 enables unauthenticated script execution and has been targeted in wild attacks since July 2026.
Essential Direct Quote: Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026.
Source: Help Net Security
2. Exploit Released for Unpatched Ubuntu Linux Host-Root Container Escape
Domain: Container & Linux Security
Subject / Topic Summary: Security researchers published proof-of-concept exploit code for CVE-2026-80521, a use-after-free in the Linux kernel's AF_UNIX socket subsystem. While patched upstream, Ubuntu LTS versions 22.04, 24.04, and 26.04 remain unpatched, allowing containerized workloads to escape isolation and gain root access on the host.
Key Technical & Strategic Takeaways: Exploit enables low-privilege container workloads to escape and achieve host root privileges.; Ubuntu LTS releases lack official vendor patches despite upstream kernel fixes being public since August.
Essential Direct Quote: The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases.
Source: The Hacker News
3. WordPress 7.1.2 Fixes Critical Unauthenticated Path Traversal Vulnerability
Domain: Web Application Security
Subject / Topic Summary: WordPress released core update 7.1.2 to fix CVE-2026-87902, a critical path traversal flaw permitting unauthenticated attackers to force the application to load arbitrary PHP files outside active theme directories. On susceptible server configurations, this flaw leads directly to remote code execution.
Key Technical & Strategic Takeaways: Patches have been backported to all supported WordPress release branches back to version 4.7.; Unauthenticated attackers can achieve server code execution under specific theme and server conditions.
Essential Direct Quote: WordPress released version 7.1.2 to fix a critical flaw that lets an unauthenticated attacker make the software load a PHP file of the attacker’s choosing from outside the site’s active theme folders.
Source: Help Net Security
4. Microsoft and Allies Disrupt EvilTokens AI-Powered PhaaS Network
Domain: Identity & Phishing Defense
Subject / Topic Summary: A coalition led by Microsoft disrupted EvilTokens, an AI-enhanced phishing-as-a-service platform responsible for breaching over 12,000 Microsoft 365 accounts across 10,000 organizations. The platform leveraged AI agents to parse stolen mailboxes, evaluate high-value targets, and streamline business email compromise.
Key Technical & Strategic Takeaways: EvilTokens combined adversary-in-the-middle device-code phishing with AI-automated mailbox analysis.; Court-authorized seizure disrupted domain infrastructure and service operations globally.
Essential Direct Quote: The EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations, has been disrupted by a coalition of law enforcement and private-sector partners...
Source: Help Net Security
5. Critical Next.js ImageResponse Flaw Allows Server Code Execution
Domain: Application Security
Subject / Topic Summary: Vercel patched a critical flaw in Next.js ImageResponse, a feature used to render dynamic social preview images. When user-controlled input from web requests is passed directly to the component, remote attackers can execute arbitrary code on the application server.
Key Technical & Strategic Takeaways: ImageResponse component vulnerability allows code execution via manipulated SVG input.; Developers must update Next.js instances and avoid passing unvalidated URL parameters into image generators.
Essential Direct Quote: The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image.
Source: The Hacker News