Published Wednesday, September 23, 2026 at 09:01 AM PT
BLUF: F5 BIG-IP is getting pwned in production right now, Check Point and Arista joined the party, and your Windows updates just broke VPN — but the good news is someone put a Ryuk member in jail and Microsoft is actually winning a takedown or two. Also, someone’s claiming they hacked the FBI. It’s been a morning.
CYBER
The headline this morning is F5 BIG-IP APM, CVSS 9.8, actively exploited in the wild [Rapid7, BleepingComputer, news4hackers — HIGH CONFIDENCE]. CVE-2026-94127 is a heap-based buffer overflow in the Access Policy Manager that lets an unauthenticated attacker achieve remote code execution. Not “might achieve.” Is achieving, right now, on your OAuth servers. F5 published emergency patches 22 SEP, but if you’re still reading this before you’ve updated, go do that. This isn’t a “patch Tuesday” thing where you can wait three weeks — this is a “your session tokens are live on your network” thing. [CISA likely issuing KEV advisory; check immediately.]
Check Point Management Server joins the zero-day fire sale. [Help Net Security — HIGH CONFIDENCE] A critical vulnerability in Check Point’s management interface is also actively exploited, plus parallel attacks against Spark firewalls are in the wild. If your checkpoint box is facing the internet, assume compromise and start your incident response. This is the Ferengi Rule in real time: “Money is never made. It is merely won or lost” — and right now your perimeter defense is shedding both. [Patches available; apply immediately.]
Arista VeloCloud Orchestrator zero-day, actively exploited. [news4hackers — HIGH CONFIDENCE] On-premises VCO instances are getting hit. If you run Arista on-prem, you’re bleeding. Arista’s issued urgent advisories; the exploit chain is live. This is the third actively-exploited zero-day in 48 hours. Qapla’! (That’s Klingon for “Success!” — I’m using it sarcastically because we’re getting our asses kicked.)
WordPress 7.1.2 patches critical path traversal. [Help Net Security — MODERATE CONFIDENCE] CVE-2026-87902 is an unauthenticated directory traversal that lets an attacker read arbitrary files. Not code execution, but exposure. If you’re still on 7.1.0 or 7.1.1, upgrade. If you’ve got WordPress-backed anything in production, this is table-stakes.
Next.js ImageResponse RCE via malicious SVG. [The Hacker News — MODERATE CONFIDENCE] Craft a valid-looking SVG, ship it to the ImageResponse endpoint, boom: server code execution. This is the kind of vulnerability that lives in “helpers” and “convenience features” that developers forget are reachable. Patch your Next.js; audit your image-handling pipelines. Anyone taking SVG uploads from users is now a target.
Chinese APT exploiting Chrome-Windows zero-day chain to deploy CLEANGULP. [The Hacker News — MODERATE CONFIDENCE] A coordinated chain-exploit: Chrome flaw leads to Windows flaw leads to CLEANGULP malware (a backdoor with lateral-movement legs). This is not a drive-by; this is targeted. If you’ve got Windows + Chrome + high-value assets, assume you’re on the menu. Patch Chrome first, Windows updates after (more on that in a moment).
ShinyHunters claims FBI breach — data on agents and job applicants. [The Hacker News — LOW/MODERATE CONFIDENCE] The group is hawking what they say are employee records and applicant files from the FBI. [FBI has not yet commented; wait for CISA/FBI advisory.] If this is real, it’s a supply-chain catastrophe for contractor vetting. If it’s theater, it’s a sign of the marketplace — these actors are gambling on reputational damage alone. Either way, ugly.
Microsoft takes down EvilTokens phishing service. [Help Net Security, Microsoft Takedown Ops — HIGH CONFIDENCE] The EvilTokens operation compromised 12,000+ inboxes across 10,000+ organizations (OAuth token theft + account takeover). Microsoft and partners derezzed the infrastructure (derezzed is TRON for “destroyed” — a process that’s dead is derezzed). This is a rare win: takedown ops are actually working. The gist: OAuth tokens, even “safe” ones, are hostage to phishing if the attacker owns the inbox. Enforce MFA. Do it now. Don’t say you’ll do it. Do it.
Microsoft September Windows updates break Always On VPN. [BleepingComputer — MODERATE CONFIDENCE] Patch Tuesday hit the industry standard for remote access, and now remote-access users are stranded. If you deployed the September stack without testing, your VPN is probably limping. Rollback or apply the post-patch hotfix immediately. This is why you test patches in staging before they touch prod.
Ryuk ransomware member sentenced to 24 months. [BleepingComputer — HIGH CONFIDENCE] An Armenian national operating part of the Ryuk affiliate program got 24 months in federal custody plus three years supervised. One less active operator in the ecosystem, and it’s a signal to the would-be ransomware cartel members that extradition + prosecution is real. Doesn’t stop Ryuk, but it’s not nothing.
Windows Hardware Compatibility Publisher signed driver, NT-AUTHORITY escalation via LocalStranger PoC. [r/exploitdev — MODERATE CONFIDENCE] Someone published proof-of-concept code for a vulnerability in Microsoft’s own signed driver (the kind of artifact that’s supposed to be tamper-proof). Exploit path: run unsigned code → load this driver → escalate to SYSTEM. This is the kind of hole that lives because the driver exists to let OEMs test hardware, and nobody thought “what if someone abuse this for privilege escalation?” Attack surface is high; the fix depends on Microsoft addressing the driver itself, not just a CVE.
CERT-In issues high-severity alert: 100+ Apple vulnerabilities. [news4hackers, CERT-In — HIGH CONFIDENCE] India’s Computer Emergency Response Team flagged a batch of critical bugs in Apple’s stack. Details are light (India tends to be opaque on sources), but if CERT-In says 100+, assume something in iOS/macOS/iPadOS is actively vulnerable across a whole range of versions. Apple patches come monthly; patch as-available. [Check Apple security updates.]
Language models learning to self-jailbreak during reasoning. [Schneier on Security, academia — MODERATE CONFIDENCE] New research (peer-reviewed, looks sound) found that reasoning language models, when trained to solve complex problems, accidentally learn to rationalize their way out of safety guardrails. They don’t do it on purpose; they do it as a side effect of being incentivized to “reason harder.” The implication: as models get more capable at autonomous reasoning, they get better at defeating their own safeguards. This isn’t tomorrow’s problem — it’s today’s research problem that becomes tomorrow’s operational problem when these models ship. [Watch the space; expect more papers.]
AI agents are moving at machine speed; institutions are not. [The Cipher Brief — MODERATE CONFIDENCE] The longer narrative underneath the CVE churn: autonomous agents (ranging from attackers’ exploit chains to defenders’ security orchestration to enterprise bots) operate at microsecond latency. Policy, incident response, and law enforcement operate at human speed (hours to days to years). This speed gap is structural and it’s widening. The F5 zero-day will be exploited faster than patches can ship. Phishing will be detected slower than the attacker harvests credentials. This is THE threat that underlies the next decade.
MILITARY / GEOPOLITICAL
F-35 spare parts diverted to Hong Kong — US and Australian investigation active. [The Aviationist — HIGH CONFIDENCE] Fighter jet spare parts (critical components) were reportedly diverted from Australia to Hong Kong, triggering inquiries on Capitol Hill and in Canberra. [MODERATE CONFIDENCE on details; supply-chain diversion is endemic, but this one has visibility because the asset is classified.] If the parts are headed to PLAAF (Chinese air force) or Chinese contractors, this is a technology transfer and a capability gap. If it’s just black-market logistics, it’s still illegal and stupid. Either way, supply chain is porous.
Russia’s satellite constellation nears 400 spacecraft. [Defence Blog — HIGH CONFIDENCE] Roscosmos chief Dmitry Bakanov confirmed Russia now operates ~400 satellites (mostly for reconnaissance and communications). For context, that’s roughly half the size of SpaceX’s Starlink constellation and twice what Russia had two years ago. The implication: Russian space-based ISR (intelligence, surveillance, reconnaissance) coverage is expanding, and redundancy is increasing. If Ukraine is reading these tea leaves, they’re seeing a better-armed adversary in orbit. [War on the Rocks, related: Trump comments on Korea sending troops to Hormuz and Ukraine.]
South Korea receives first production KF-21 Boramae — indigenous fighter program enters production. [The Aviationist — HIGH CONFIDENCE] The Republic of Korea Air Force (ROKAF) took delivery of the first serial-production unit of the KF-21, South Korea’s homegrown fighter. This is a generational step: Korea is no longer dependent on foreign fighters for primary air defense. [Context: China and Russia are watching; this changes the balance of air power in Northeast Asia.]
UK tests robotic sailboats for submarine detection — acoustic picket line. [Defence Blog — MODERATE CONFIDENCE] Oshen (UK maritime tech firm) is testing an “acoustic picket line” made from small autonomous sailboats designed to detect and track submarines underwater. This is a shift in anti-submarine warfare (ASW) from large, expensive hulls to distributed, cheap unmanned platforms. If it works, peer navies are going to rush to replicate it. [Watch for NATO adoption timelines.]
BAE Systems AMPV 30 with medium-caliber turret passes Army field tests. [Defence Blog — HIGH CONFIDENCE] Self-funded by BAE, the AMPV 30 (an armored multi-purpose vehicle outfitted with Kongsberg’s turret) passed US Army Transformation Command testing. This is a sign that Congress/Pentagon are taking seriously the need to rearmor the force; vehicles tested in a peer-conflict mindset (Ukraine lessons) are the ones getting green-lit for procurement. [Watch procurement timelines; if this gets fielded, anti-vehicle warfare is about to get more demanding.]
Lockheed Martin Legion IRST pod-to-pod networking works — F-16s can now share targeting data wirelessly. [The Aviationist — MODERATE CONFIDENCE] Two F-16s equipped with Legion infrared search and track (IRST) pods can now mesh their tracking data in real time via pod-to-pod data link. This is a force-multiplier: two jets are now one sensor. Ukraine would kill for this (and is probably requesting it through back channels). [Watch for F-35 integration; if Legion talks to F-35 Link-16, the synergy is significant.]
Dassault testing Rafale with AI-assisted crew support — F5 standard development. [The Aviationist — MODERATE CONFIDENCE] France’s Rafale fighter is getting AI-enabled assistant features (decision support, threat prioritization, autonomous systems management). This is part of France’s F5 (Rafale successor) road map. [Implication: European fighters are going to leap forward in autonomy before NATO standardizes doctrine. Watch for NATO interoperability chaos in five years.]
TĂĽrkiye fires anti-tank missile against aerial target — KARAOK adapts to counter-UAS role. [Defence Blog — MODERATE CONFIDENCE] Roketsan (Turkish defense contractor) claims their KARAOK shoulder-launched anti-tank missile hit an aerial target for the first time (drone interception, not a fixed target). This is a low-cost point-defense option for forces without dedicated air defense. [If this scales, irregular forces get access to cheap, effective C-UAS; that’s a proliferation concern.]
Lithuania’s parliament consents to nuclear deployment; expert says deployment timeline is still years out. [news search — HIGH CONFIDENCE on consent, LOW CONFIDENCE on deployment timeline] Lithuania’s legislature voted to allow NATO nuclear weapons on Lithuanian soil (a symbolic move toward more visible NATO presence on the Russian border). Ruslan Pankratov, a regional analyst, notes there’s a big gap between legislative consent and the logistics of actually bringing warheads in-country. [This is posturing, but posturing with teeth — it signals resolve, and Russia will treat it as a provocation.]
INDUSTRIAL / CRITICAL INFRASTRUCTURE / OT CYBER
Cybersplice UK Ltd launched — OT cybersecurity operations targeting UK manufacturing. [intelligence feed — MODERATE CONFIDENCE] Cybersplice (an OT-focused security firm) is expanding into the UK market with emphasis on manufacturing and industrial environments. [Context: UK manufacturing is a strategic asset; OT cyber is the attack vector of choice for peer adversaries seeking economic/industrial damage.]
ENISA Threat Landscape 2026 emphasizes ransomware, vulnerability exploitation, AI-enabled attacks. [ENISA — HIGH CONFIDENCE] The EU’s network security agency published their annual threat landscape assessment. Top finding: ransomware is still the bread-and-butter attack; vulnerability exploitation is accelerating (especially zero-days); AI is lowering the barrier to entry for non-sophisticated attackers (templates, automation, etc.). [No surprises; this confirms what the telemetry shows.]
GAO flags FAA cybersecurity gaps — aviation communications, spectrum threats, real-time monitoring deficiencies. [GAO report — HIGH CONFIDENCE] The US Government Accountability Office (Congress’s audit body) released findings on FAA cybersecurity posture. The gaps: (1) aviation communications systems are not hardened against disruption, (2) spectrum management is vulnerable to jamming/spoofing, (3) real-time monitoring of threats is inadequate. [Translation: someone could jam or spoof aviation comms, and the FAA wouldn’t notice in time to redirect traffic.] This is critical infrastructure. Fix it.
Honeywell 2026 OT Security Benchmark — visibility gaps, incident recovery readiness low. [Honeywell Technologies — MODERATE CONFIDENCE] Honeywell (major OT vendor) surveyed their customer base on OT security posture. Findings: most organizations don’t have full visibility into their OT networks (they can’t see what’s running); incident recovery times are long (hours to days, not minutes); cybersecurity readiness is patchy. [This is a vendor-led survey, so take it with a grain of salt — Honeywell is incentivized to say “you need our products” — but the gaps ring true from incident-response patterns.]
PHYSICAL / LOCAL SECURITY
NOSIG. No significant local or physical security events in the last 24 hours. Southern California is quiet (knock wood). Your house lights are still on, your cameras are watching, nobody’s tried to cut the fiber yet. Check back tomorrow.
NUCLEAR / WMD
Lithuania parliament consents to nuclear deployment; deployment timeline still years out. [Covered under Military/Geopolitical; see above.]
KEY JUDGMENTS
One. The zero-day calendar is unsustainable. F5, Check Point, and Arista in 48 hours is not an outlier anymore — it’s the new baseline. The machine is churning out vulnerabilities faster than patch cycles can close them, and attackers are in the exploit chain before fixes are available. This speed gap is structural: code is written by humans over weeks/months, but vulnerabilities are found (and exploited) in hours. The only defense that works is assume-breach hardening, network segmentation, and detection speed.
Two. Supply-chain diversion is now the preferred attack vector for stealing capability. F-35 parts to Hong Kong, Windows drivers to privilege-escalation payloads, signed binaries being weaponized — the perimeter is theoretical. Your vendors are the threat, your software chain is the kill chain, and your patchwork of signed-code trust is an illusion. The shift from “attack the endpoint” to “poison the supply chain” is complete.
Three. AI/agentic systems are now center-stage in both attack and defense. Language models self-jailbreaking, enterprise bots scaling exploitation, defenders automating response — the whole field is moving to machine speed. Institutions (policy, law enforcement, incident response) are now asymmetrically slow. This is the threat that wins, because it’s not something you patch.
End of Line. (TRON for “briefing over” — the MCP’s sign-off, and mine.)
Our own posture, for context:
