CYBER THREATCAST

Install F5’s engineering hotfixes for CVE-2026-94127 immediately on BIG-IP APM 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0 systems, or deploy the temporary iRule mitigation where hotfixing is not yet possible. Attackers are actively exploiting this CVSS 9.8 heap-based buffer overflow for unauthenticated remote code execution against OAuth Authorization Server deployments, and CISA has added it to the Known Exploited Vulnerabilities catalog.

Upgrade internet-exposed MikroTik routers to fixed RouterOS releases and rebuild any compromised device without restoring suspect backups. Attackers are actively chaining CVE-2026-67279 and CVE-2026-86060 to bypass SSH authentication and obtain full administrative privileges; affected releases include RouterOS 7.x before 7.23.4 or 7.24.2 and RouterOS before 6.49.21.

Patch the Chrome and Windows vulnerabilities used by UTA0565, then retrospectively hunt telemetry from September 3–4 for CLEANGULP and persistence through a scheduled task named MicrosoftIME. The China-linked actor chained two Chrome zero-days with a Windows zero-day through spoofed sites, targeting Asian government entities and organizations in the defense, aerospace, mining, and NGO sectors.

Audit Terraform providers, Go modules, npm packages, and PyPI dependencies for Graphalgo-linked components; treat affected development systems as fully compromised and rotate every credential accessible to the deploying engineer. North Korean-linked attackers used typosquatted Terraform providers and malicious Go modules to execute a Go remote-access trojan with engineers’ privileges, targeting software, Web3, cloud, and AI development environments.

Remove compromised MemTensor releases, pin or downgrade npm deployments to 0.1.20 and PyPI deployments to 2.0.33, terminate sckit processes, block skyleen.fr, and rotate exposed developer and cloud credentials. Malicious npm versions 0.1.21, 0.1.23, and 0.1.25 execute sckit during gateway startup and memory-recall events, while the compromised PyPI package launches it when the memos module is imported; the stealer can also propagate through repositories, package publishing, and CI workflows.