W1RETAP Intel Report — 2026-09-24
W1RETAP INTEL REPORT
THURSDAY, SEPTEMBER 24, 2026
========================================================================
SEVERITY: 7/10 — ELEVATED TO HIGH
Two unauthenticated, CVSS 9.8-class RCE flaws (Check Point Security Gateway, F5 BIG-IP APM) are under active exploitation and have triggered emergency federal remediation orders within the last 48 hours, and a webmail pre-auth SQLi is also being abused in the wild. No single mass-casualty breach event dominates today, which keeps this out of SEVERE/CRITICAL territory, but the stacked, actively-exploited critical bugs on edge/VPN infrastructure justify an elevated posture.
TOP STORY:
Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution flaw in the VPN certificate-handling code of its Security Gateway and Spark Firewall products (CVSS 9.8). Patches shipped September 9 with Check Point initially reporting no in-the-wild abuse, but attackers began hitting Spark Firewall customers worldwide on September 12 using anonymization infrastructure and forged VPN certificate subjects. CISA added the flaw (alongside CVE-2026-93616) to its Known Exploited Vulnerabilities catalog on September 22 and invoked Binding Operational Directive 26-04, which gives federal agencies just three days to remediate internet-exposed, "total control" systems. That compliance deadline lands tomorrow, September 25. Any organization running Check Point Security Gateway or Spark Firewall with Site-to-Site or Remote Access VPN enabled should treat this as immediate-patch-now territory.
BREACHES & INCIDENTS:
The dominant breach story of the month remains in motion: IDScan.net, a Louisiana-based identity-verification provider used by car rental firms, retailers, and cannabis dispensaries, confirmed unauthorized access to its cloud platform after a dark-web marketplace called "Nexus" surfaced advertising over 153 million U.S. and Canadian driver's license scans, plus 10 million ID cards, 3 million travel documents, and 579,000 medical cards. The FBI's New Orleans field office has opened an investigation. This broke in early September and continues to develop rather than being new in the last 24-48 hours, but it remains the largest identity-document exposure of the year and is still generating fresh reporting.
On the supply-chain front, researchers disclosed a malicious npm package, "tw-pkgprobe-7731," posing as a Twilio security tool while harvesting developer secrets, and separately flagged compromised MemTensor packages on npm and PyPI pushing a credential stealer ("sckit") alongside Go-based malware targeting developer and cloud credentials.
VULNERABILITIES & EXPLOITS:
Beyond the Check Point flaw above, F5 disclosed and hotfixed a critical zero-day (tracked as CVE-2026-94127) in BIG-IP Access Policy Manager on September 22 that allows unauthenticated remote code execution against BIG-IP systems configured as an OAuth authorization server — already under active attack. Canada's Cyber Center updated its advisory on September 21 warning that CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin (affecting versions before 1.6.16 LTS / 1.7.1), is being actively exploited against internet-facing mail servers; patch immediately if you run Roundcube. Separately, attackers moved within hours from probing to actively exploiting CVE-2026-87902, a WordPress flaw that lets them write files to disk that execute shell commands when accessed. Rounding out the month, Google's Chrome V8 zero-day (CVE-2026-85046, CVSS 8.8) — patched September 4 and added to KEV the same day — carried a federal remediation deadline of September 18 that has now passed; if your fleet hasn't updated past Chrome 152.0.7977.82/.83, it's overdue.
TOOLS & TECH:
Cisco Talos disclosed "ClosedQuorum" (aka CLOSEDQUORUM), a Go-based Windows malware that queries up to four commercial AI models — Gemini, DeepSeek, Qwen, and Mistral — in a voting system to autonomously decide its next post-compromise action (credential theft via LSASS dumping, browser credential theft, crypto-wallet extraction, or process injection), with DeepSeek holding tie-breaking priority. Talos's analysis is dated back to June, meaning the malware has been operating for at least three months before public disclosure. On the defensive side, Talos released CAIRN alongside the report — an open-source tool built specifically to hunt for malware that calls out to AI services, giving defenders a new detection primitive for this emerging malware class.
U.S. GOVERNMENT CYBER MOVES:
CISA had an active week: it added the Check Point Security Gateway/Management Server flaws to KEV on September 22 under a rare 3-day BOD 26-04 remediation window (deadline September 25), added three Linux kernel CVEs to KEV with a September 21 deadline the week prior, and issued a fresh batch of Industrial Control Systems advisories on September 22 (ICSA-26-265-01 through -09) covering multiple vendors. The agency has been running a steady cadence of KEV catalog updates and ICS advisories throughout September, consistent with sustained federal focus on both IT edge infrastructure and OT/ICS exposure. The FBI's New Orleans field office confirmed it is actively investigating the IDScan.net breach.
TRENDS TO WATCH:
AI is showing up on both sides of the fight this week: Nimbus Manticore, an Iranian IRGC-affiliated APT, continues incorporating AI-assisted development into its malware (including a new backdoor called MiniFast), while ClosedQuorum shows criminal malware delegating tactical decisions to commercial LLMs rather than human operators or static C2 logic. Expect more "AI-in-the-loop" malware disclosures and a parallel buildout of AI-behavior detection tooling like Talos's CAIRN. Separately, the cluster of pre-auth RCE flaws hitting VPN gateways and OAuth-fronting load balancers (Check Point, F5) this month reinforces that internet-exposed edge/remote-access infrastructure remains the highest-value initial-access target for both criminal and state actors.
------------------------------------------------------------------------
Report window: approximately the 24-48 hours preceding September 24, 2026, with select still-developing stories from earlier in September noted as background where relevant. Compiled from open-source reporting (BleepingComputer, The Hacker News, Krebs on Security, SecurityWeek, CISA.gov, and others).