Threat Digest — September 16, 2026: Zero-Days & MCP

Top Stories

Google patches actively exploited Android zero-day

Google released its September 2026 security updates for Pixel devices, addressing 110 vulnerabilities. The update includes a zero-day that Google says is being exploited in targeted attacks, according to BleepingComputer.

The supplied reporting does not identify a CVE for the exploited Android issue. Organizations should therefore treat the device update as urgent even without a CVE identifier.

Defender impact:

• Prioritize Pixel devices used by administrators, executives, journalists, public officials, and other high-risk personnel.
• Confirm update installation rather than relying only on mobile-device-management assignment status.
• Review devices that handle privileged authentication, password managers, administrator consoles, or sensitive communications.
• Treat delayed installation as an exception requiring documented risk acceptance.

Acronis warns of exploitation in backup plugins

Acronis disclosed a high-severity Linux local privilege-escalation flaw in its backup plugin for cPanel, WebHost Manager, and Plesk. The issue may be exploited in the wild, according to BleepingComputer.

Backup and hosting-control systems are especially sensitive because they commonly have broad access to customer websites, credentials, scheduled jobs, and stored backup data.

Defender impact:

• Inventory Acronis plugin deployments across cPanel, WebHost Manager, and Plesk hosts.
• Check the vendor’s current remediation guidance and apply available fixes.
• Review recent local privilege changes, unexpected processes, scheduled tasks, and modifications to hosting accounts.
• Separate backup infrastructure from general server administration where possible.

Malicious Admin Menu Editor Pro versions backdoor WordPress sites

Malicious versions of the Admin Menu Editor Pro WordPress plugin were distributed after the maintainer’s website was compromised. The versions created hidden user accounts on approximately 1,500 sites, according to BleepingComputer.

Removing the plugin alone is not sufficient if an attacker created administrator accounts or modified PHP files.

Defender impact:

• Identify affected plugin versions and remove compromised copies.
• Reinstall only from a trusted source after confirming the package’s integrity.
• Review administrator accounts, authentication logs, scheduled tasks, modified plugins, themes, and uploads.
• Rotate WordPress, hosting, database, SSH, SFTP, API, and deployment credentials.
• Inspect for PHP web shells and persistence before restoring normal access.

Attackers exploit WooCommerce Wholesale Lead Capture

Attackers are actively exploiting a critical vulnerability in the premium WooCommerce Wholesale Lead Capture plugin to upload PHP backdoors, according to BleepingComputer.

Because exploitation can result in arbitrary file upload and server-side persistence, site owners should handle affected installations as potential compromises rather than routine patching events.

Defender impact:

• Inventory the plugin across production, staging, and abandoned WordPress sites.
• Apply the vendor-provided fix if available, or disable and remove the plugin when it is not required.
• Review web-server logs for unexpected POST requests, PHP files in uploads directories, and access to recently created scripts.
• Search for new administrator accounts, modified .htaccess files, injected JavaScript, and outbound connections from the web server.
• Rotate credentials after containment and validate the site from a known-clean backup.

Governments warn about Iranian spyware targeting dissidents

The United Kingdom, United States, and Netherlands warned that Iranian spyware is targeting dissidents, according to Al Jazeera’s report. The supplied source link is a Google News redirect.

Organizations supporting dissidents, activists, journalists, political groups, or sensitive international operations should raise phishing, mobile-device, and account-takeover monitoring for potentially targeted users.

CenterPoint Energy confirms customer data theft

CenterPoint Energy confirmed that a cyberattack exposed some customers’ personal information after attackers leaked data allegedly stolen from the utility, according to BleepingComputer.

Affected organizations and individuals should rely on official notices for the exact data categories and required actions. Security teams should also watch for follow-on phishing and fraud using utility-related personal information.

BambooToken uses MQTT to control Windows and Linux systems

A previously unknown malware framework called BambooToken has controlled Windows and Linux systems through MQTT communications since at least 2023, according to BleepingComputer.

MQTT traffic can blend into legitimate IoT and operational technology communications. Defenders should baseline expected brokers, clients, topics, and outbound destinations rather than block the protocol indiscriminately.

Windows Server 2022 approaches mainstream-support end

Windows Server 2022 will reach the end of mainstream support next month and enter extended support through October 2031, according to BleepingComputer.

This transition does not immediately end security updates, but it should trigger an upgrade and lifecycle review. Identify systems that depend on features or applications requiring a newer Windows Server release, and document which systems will remain on extended support.

Critical Vulnerabilities

CVE-2026-59971: MySQL MCP Server exposes unauthenticated SQL execution

• Severity: CVSS 10.0
• Affected product: MySQL MCP Server before 0.4.2
• Fixed version: 0.4.2
• References: NVD, GitHub advisory, version 0.4.2 release

When SSE transport is enabled, the service may expose unauthenticated SQL execution. The service lacked authentication and DNS-rebinding protection and bound to 0.0.0.0 by default. A network attacker could disclose or modify configured databases and potentially access server files or achieve code execution when MySQL FILE privileges are available.

Action: Upgrade to 0.4.2, disable unnecessary SSE transport, bind the service to a trusted interface, require authentication, and restrict database privileges.

CVE-2026-57138: PraisonAI codeMode sandbox escape

• Severity: CVSS 9.9
• Affected versions: 1.4.0 through 1.7.1
• Fixed version: 1.7.2
• References: NVD, GitHub advisory, project release reference

PraisonAI’s JavaScript sandbox for codeMode could be escaped by an attacker who controls codeMode input. Successful exploitation could expose host files and credentials, execute subprocesses, or exhaust the host process.

Action: Upgrade to 1.7.2, prevent untrusted users from controlling codeMode input, and run the service with a dedicated low-privilege account.

CVE-2026-91998: Casdoor authorization bypass in /api/mcp

• Severity: CVSS 9.9
• Affected versions: Casdoor through 4.4.0
• Fixed version: No fixed version was listed in the supplied data.
• References: NVD, Casdoor project, technical finding

An attacker with any application’s clientId and clientSecret may obtain unrestricted cross-organization user-administration access through /api/mcp. Potential actions include creating administrator accounts and modifying or deleting users.

Action: Restrict access to /api/mcp, rotate application credentials, review cross-organization administrative activity, and search for newly created administrator accounts while awaiting a vendor fix.

CVE-2026-57139: PraisonAI exposes unauthenticated MCP HTTP endpoints

• Severity: CVSS 9.8
• Affected versions: 1.5.0 through 1.7.1
• Fixed version: 1.7.2
• References: NVD, GitHub advisory, project release reference

PraisonAI exposed MCP HTTP endpoints without authentication and bound without host restrictions. A reachable network client could invoke tools, read resources, or trigger registered handlers using server-side credentials and privileges.

Action: Upgrade to 1.7.2, bind the service to trusted interfaces, place it behind authenticated access controls, and block direct Internet exposure.

CVE-2026-57141: PraisonAI codeMode permits operating-system command execution

• Severity: CVSS 9.8
• Affected versions: 1.5.0 through 1.7.1
• Fixed version: 1.7.2
• References: NVD, GitHub advisory, project release reference

PraisonAI’s codeMode could escape its JavaScript sandbox through the global Function constructor and dynamically constructed child_process access. Attackers who influence code input could read or modify files, obtain environment credentials, and execute operating-system commands.

Action: Upgrade to 1.7.2, eliminate untrusted codeMode input, restrict process permissions, and rotate credentials exposed to vulnerable instances.

What Defenders Should Do Today

1. Deploy Google’s September Pixel update. Prioritize devices used by administrators, executives, journalists, and other potentially targeted users. Verify installation on the device.
2. Inventory high-risk software. Search production, development, staging, and hosting environments for MySQL MCP Server, PraisonAI, Casdoor, Acronis backup plugins, Admin Menu Editor Pro, and WooCommerce Wholesale Lead Capture.
3. Patch and isolate MCP services. Upgrade MySQL MCP Server to 0.4.2 and PraisonAI to 1.7.2. Disable unnecessary SSE or HTTP endpoints, require authentication, bind to trusted interfaces, and block direct Internet access. Review the edge security hardening checklist when validating exposed services.
4. Contain Casdoor exposure. Restrict /api/mcp, rotate application credentials, review administrative activity across organizations, and investigate new or modified administrator accounts.
5. Treat affected WordPress sites as potentially compromised. Remove malicious or vulnerable plugins, reinstall from trusted sources, rotate credentials, review administrator accounts, and inspect PHP files for web shells.
6. Investigate Acronis plugin deployments. Check cPanel, WebHost Manager, and Plesk systems for fixes, unexpected privilege changes, suspicious local processes, and unauthorized persistence.
7. Hunt for BambooToken-style activity. Review Windows and Linux systems for unusual MQTT connections, unknown brokers, unexpected topics, anomalous outbound traffic, persistence, and command execution.
8. Prepare for targeted spyware activity. Strengthen phishing-resistant authentication, verify mobile-device integrity, and increase monitoring for users handling dissident, activist, executive, or sensitive customer information. Encourage them to use a trusted password manager such as Try 1Password →.
9. Assess CenterPoint-related exposure. Follow official breach notices, identify potentially affected customers or employees, and prepare for phishing or identity-fraud attempts.
10. Plan beyond Windows Server 2022 mainstream support. Assign system owners, measure patch coverage, identify upgrade blockers, and document systems that will remain on extended support.

Technical Notes

Check exposed MCP services

Use network and host inventory to identify services listening on all interfaces. The following commands are examples and should be adapted to the operating system and deployment method:

# Linux: inspect listening TCP services
ss -lntp

# Search common configuration and deployment locations
grep -RInE '0\.0\.0\.0|sse|mcp|PraisonAI|mysql' \
  /etc /opt /srv 2>/dev/null | head -200

A listener on 0.0.0.0 is not automatically vulnerable, but it increases exposure when the service lacks authentication or is reachable from untrusted networks.

# Example: test whether a service is reachable from a controlled scanner host
nmap -sV -p <port> <host>

Do not run intrusive tests against systems you do not own or have permission to assess.

Restrict service binding and network access

Use a private interface or loopback binding where supported:

# Example configuration pattern; use the application's actual setting names
host = 127.0.0.1
require_authentication = true
enable_sse = false

Enforce the restriction at the network layer as well:

# Example Linux firewall policy pattern
sudo ufw deny <port>/tcp
sudo ufw allow from <trusted-management-subnet> to any port <port> proto tcp

The exact configuration syntax varies by product. Validate the effective listener and firewall rules after making changes.

Hunt WordPress for unexpected accounts and PHP files

Review administrator accounts through the WordPress management interface or WP-CLI:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Search common web roots for recently modified PHP files. Establish a baseline before treating every result as malicious:

find /var/www -type f -name '*.php' -mtime -14 -print

# Review PHP files in upload directories, where executable code is usually unexpected
find /var/www -path '*/wp-content/uploads/*' -type f -name '*.php' -print

Check web-server logs for suspicious upload and execution activity:

grep -E 'POST|multipart|xmlrpc|wp-login|admin-ajax|\.php' \
  /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null | tail -200

Preserve logs and suspicious files before cleaning an affected site so incident responders can determine the initial access path and scope.

Hunt unusual MQTT traffic

For systems that do not require MQTT, identify and block unexpected outbound connections. For systems that do, compare connections against an approved broker inventory:

# Linux: inspect established network sessions
ss -ntp | grep -E ':(1883|8883)\b'

# Review processes associated with network connections
sudo lsof -nP -iTCP -sTCP:ESTABLISHED

Look for unknown brokers, unusual geographic destinations, clients communicating outside normal operating windows, and topic activity inconsistent with the host’s role. Encrypted MQTT on port 8883 still requires endpoint, certificate, DNS, and process-level visibility.

Review identity changes in Casdoor

Export or query identity-management audit logs for:

• New administrator accounts
• Changes to application credentials
• Cross-organization user modifications
• Unexpected account deletion or disablement
• Administrative requests to /api/mcp
• Activity from unfamiliar source addresses or service accounts

Rotate credentials after collecting evidence, and ensure new credentials are not exposed in client-side code, public repositories, logs, or deployment artifacts.

Bottom Line

The highest-priority actions today are deploying the Pixel security update, removing public exposure from MCP services, upgrading affected MySQL MCP Server and PraisonAI deployments, containing Casdoor’s /api/mcp endpoint, and treating compromised WordPress plugins as incident-response cases. Backup infrastructure, hosting control panels, and identity systems deserve the same urgency because compromise can provide broad access to downstream customers and administrative data.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.