Session CRT-20260925 — 25 September 2026 · Afternoon Edition

Four-hour ranking: 1) Check Point, 2) F5 BIG-IP APM, 3) WSO2. Today’s Check Point evidence closes the strongest attack chain: Check Point and Qualys report active exploitation; CVE-2026-85102 permits unauthenticated remote code execution during VPN negotiation, while CVE-2026-93616 permits pre-authentication file upload and script execution on management and logging servers. WSO2 CVE-2026-5430 is reportedly exploited in the wild, but the available evidence does not establish its exploit primitive or post-exploitation indicators. That uncertainty puts it third—not on hold.

Check Point: hotfix-and-hunt is acceptable only if every gateway and management/logging server is inventoried, patched, and covered by complete VPN-negotiation, web-access, audit, process, file-integrity, and egress telemetry for its entire exposure period. Internet exposure plus any material logging gap means isolate and preserve disks, memory, configuration, and logs. Uploaded scripts, unexpected child processes, unauthorized policy or administrator changes, or unexplained egress trigger rotation of all credentials and private keys accessible from the affected system. Confirmed execution, persistence, management-plane modification, or unverifiable filesystem integrity means rebuild from known-good media.

F5: yesterday’s operational conclusion stands, but the technical characterization needs caution. The available reporting says CVE-2026-94127 is actively exploited; a Picus write-up describes it as a heap-overflow attack, but the exact exploitation primitive and privilege context remain pending stronger primary-source confirmation. Patch-and-hunt requires complete APM request, daemon, audit, crash/core, configuration-change, authentication, and egress records. Exposure combined with missing logs, unexplained crashes or restarts, configuration drift, or suspicious process activity means isolate and preserve evidence. Rotate APM-accessible credentials, sessions, and keys after suspected execution or unauthorized configuration access; rebuild when persistence, privileged execution, management-plane tampering, or unresolved integrity loss is present.

WSO2: patch immediately, but do not pretend sparse exploit detail supports precise IOC hunting. Hotfix-and-hunt requires complete ingress/API, application-audit, process, filesystem, workload, and egress telemetry across the exposure window. An exposed control plane with missing telemetry moves to isolation and evidence preservation. Unexpected child processes, file or image drift, new users or tokens, and unexplained egress trigger rotation of OAuth clients, signing material, API tokens, and service credentials reachable from WSO2. Confirmed execution, persistence, or unverifiable image integrity means redeploy from a known-good image.

• Strix/Cairn/Hermes: Multiple articles repeat Gambit’s findings, but that is one evidentiary lineage—not independent corroboration. Moderate confidence in the observed sequence—Strix reconnaissance, Cairn exploitation, then Hermes—and low confidence in the “27 organizations,” “600,000 cards,” and “Chinese-speaking operator” characterizations without victim confirmation or raw telemetry. Executives should not convert language settings into Chinese nationality or state attribution.

• Operation Master: CVE-2026-0257 and active GlobalProtect exploitation are independently supported by Palo Alto Unit 42 and Rapid7, consistent with T1190, Exploit Public-Facing Application. But the “Operation Master” campaign, seven working VPN sessions, stolen databases, and invoice-fraud pipeline currently trace to SOCRadar alone. High confidence that exploitation is occurring; low-to-moderate confidence that independently observed exploitation belongs to this named operation. Avoid calling Operation Master a confirmed at-scale campaign or attributing it to a named actor.

• Chrome-to-Windows chain: The technical narrative—phishing redirects, Chrome exploitation, sandbox escape, Windows privilege escalation, and separate GRIMWEDGE/LONGTALE payloads—is repeated by several outlets, but the available reporting appears derivative of one underlying disclosure. That supports T1566.002 and T1203, not independent attribution. Moderate confidence in targeted NGO exploitation; low-to-moderate confidence in the China linkage. Executives should avoid collapsing UTA0560 and JungleBamboo/APT31 into one actor or describing the campaign as Chinese government-directed.

Tonight’s collection priority: obtain GlobalProtect authentication logs, session artifacts, source infrastructure, and passive-DNS/certificate pivots matching SOCRadar’s indicators. The immediate question is whether independently confirmed CVE-2026-0257 exploitation can actually be linked to Operation Master.

The evidence supports a real operational shift, but not a novel intrusion class. Gambit’s reporting says the Strix/Cairn/Hermes workflow compromised at least 27 companies during one September window, stole more than 600,000 payment-card records from two victims, and installed skimmers on multiple stores. Separate analysis describes the components as commodity or low-cost and the operation as consistent with a solo actor, with no reported state-sponsorship indicators. My assessment is that AI reduced the cost of coordinating discovery, exploitation, and persistence—it did not invent new exploitation primitives. The capability shift is economic: one operator can sustain more parallel intrusion work. The exact degree of end-to-end autonomy remains uncertain because the public evidence is principally vendor reporting rather than independently reproduced telemetry.

SalesBleed exposes the same underlying trust-boundary failure in a cleaner form. Zenity demonstrated that attacker-controlled Web-to-Lead content could become an instruction executed with Agentforce’s CRM authority; two flaws enabled zero-click exfiltration, while another could make the agent post phishing content into internal Slack. URL controls were also bypassable because of domain-recognition and parsing weaknesses. Salesforce reportedly fixed the reported Trusted URLs bypasses within roughly two weeks. In both cases, untrusted input crossed from “data the agent reads” into “commands the agent may execute,” while the resulting actions inherited excessive authority. That is prompt injection plus excessive agency—not a model developing intent.

Before enabling browsing, tools, or payment/CRM access, I would require three controls: (1) an external, deny-by-default capability broker using separate short-lived identities, object-level least privilege, and human approval for exports, messages, writes, or destructive actions; (2) strict separation of content from control, with retrieved text marked untrusted, tool calls constrained to validated schemas, and no direct content-to-action path; (3) independently enforced egress and data controls—canonical destination allowlists, network-layer blocking of arbitrary HTTP/DNS beacons, PAN/PII redaction, rate and volume limits, complete action logging, and a kill switch. Prompt filters alone are not a reliable authorization boundary.

Halil, these are three separate failure classes. Fact: KelpDAO’s lawsuit concerns an approximately $292 million rsETH bridge event; reporting alleges a single-verifier configuration, compromised RPC infrastructure, and DDoS-related failover, but those remain contested allegations rather than a final liability finding. Fact: In Payy’s roughly $1.83 million USDC loss, the reported transaction invoked verifyRollup and withdrew funds from the Ethereum rollup contract; the available evidence does not establish whether the decisive failure was proof verification, a compromised backend, or privileged-key control. Fact: Meter’s roughly $2.3 million event involved unbacked wMTRG minting attributed in reporting to a validation failure. No reliable actor attribution is established for any of the three.

The shared operational lesson is narrow: no value-moving transition—withdrawal, cross-chain delivery, or wrapped-asset mint—should depend on one validation path whose infrastructure, signer set, or backend can fail together. It becomes misleading to call all three “verifier exploits.” Kelp concerns alleged bridge-verifier and infrastructure concentration; Payy is presently an unauthorized rollup withdrawal with root cause unresolved; Meter is a backing-integrity failure caused by accepting an invalid mint condition. Their accounting consequences also differ: rsETH custody exposure, USDC removed from a rollup contract, and newly created unbacked wMTRG cannot be reconciled as the same type of loss.

Same-day controls

• 0–1 hour: Pause affected message execution, minting, and withdrawals; disable automated failover; revoke or quarantine verifier, relayer, prover, sequencer, admin, and backend credentials; impose per-message and per-epoch value caps.
• 1–4 hours: Require an independent M-of-N approval path; verify source chain, destination domain, nonce, message ID, state root, and backing before execution; reconcile wrapped supply against locked collateral; notify relevant token issuers, exchanges, custodians, and tracing partners with transaction and destination details.
• 4–24 hours: Rebuild signers from clean systems, separate RPC and cloud dependencies, test replay and forged-message rejection, and reopen only after an independent supply-and-reserve reconciliation—not merely because funds were returned or execution was patched.

Preserve transaction hashes, calldata, receipts, message IDs and nonces, state roots and proofs, bytecode and proxy slots, signer/verifier configuration, RPC responses and failover history, DDoS telemetry, sequencer/prover batches, backend database snapshots, KMS/HSM and cloud audit logs, CI/CD changes, and balance/supply snapshots. Operators should publish that evidence without prematurely assigning fault: KelpDAO-versus-LayerZero liability is disputed, Payy’s backend-versus-verifier cause is unknown, and Meter’s validation failure does not by itself identify an attacker or prove who ultimately benefited.