Skip to content
eastbaycyber

Threat Digest: AI Agent Attacks and Critical CVEs

Threat digests 10 min read
EC
East Bay Cyber Editorial Team Reviewed 2026-09-20
Week of 20 SEP 2026

This cybersecurity threat digest for September 20, 2026, covers AI browser-agent attacks, WaterPlum activity, ransomware disruption and five critical vulnerabilities requiring accelerated triage.

TL;DR - Malicious browser extensions can hijack AI agents, while WaterPlum activity reportedly affected 30,000 devices. - Prioritize five critical vulnerabilities, especially exposed D-Link R95 routers and internet-facing security sensors. - Hunt for unauthorized agent actions, malware persistence and exploit attempts today.

Top Stories

OpenAI breach claims raise concerns about AI infrastructure

Individuals described as hackers who previously breached OpenAI are warning that the AI industry has systemic security weaknesses. The reporting increases scrutiny of AI infrastructure, model access controls, internal applications and the handling of sensitive prompts, credentials and training data.

The practical concern is broader than one provider. Organizations deploying AI services should treat model access, agent tools, plugins, retrieval systems and internal development environments as privileged infrastructure. Teams can also review CI/CD security hardening practices for AI development environments and automate access reviews with 1Password or another approved password manager.

The Washington Post report provides the source context.

BragJack campaign targets AI browser agents

The BragJack campaign uses malicious browser extensions to hijack AI browser agents. Extensions operating inside a browser can potentially observe page content, influence navigation, capture sensitive information or cause an agent to perform unauthorized actions.

Organizations adopting delegated browsing should verify that browser extensions are centrally managed and that agent workflows enforce explicit boundaries for credentials, downloads, payments and external communications. Centralized identity controls, including single sign-on (SSO), can also help limit access when agent workflows are abused.

Read the BleepingComputer report on BragJack.

WaterPlum reportedly infected 30,000 devices

North Korean-linked WaterPlum activity reportedly infected 30,000 devices worldwide. The scale makes endpoint hunting, containment and infrastructure-wide scoping more important than investigating isolated alerts.

Defenders should correlate endpoint, DNS, proxy, identity and network telemetry. Prioritize devices showing anomalous downloads, new persistence mechanisms, suspicious scripting activity or connections to infrastructure not associated with normal business operations.

See BleepingComputer’s report on the WaterPlum campaign.

ShinyHunters reportedly compromises Clop leak site

ShinyHunters reportedly compromised Clop’s leak site and threatened to extort the ransomware group. Criminal-on-criminal attacks can disrupt negotiations, destroy or alter leak-site evidence and create uncertainty about whether an alleged victim dataset is authentic.

Organizations facing extortion should preserve communications, validate claimed data exposure independently and avoid treating a leak-site posting as the sole evidence of compromise.

Read the BleepingComputer report on the reported compromise.

AI hotline reportedly performs face scans and mood analysis

A viral AI actress hotline reportedly performs face scans on callers and analyzes their moods. The behavior raises privacy and data-governance concerns involving biometric information, sensitive inferences, consent, retention and third-party processing.

Security and privacy teams should identify whether employees or customers are using similar services, verify consent language and retention controls, and block unapproved integrations that process video or emotionally sensitive data.

See BleepingComputer’s coverage of the hotline.

Intel changes bug bounty coverage

Intel reportedly suspended its bug bounty program, which paid up to $100,000 per vulnerability. A new Intigriti disclosure program reportedly offers no rewards. Changes to vendor disclosure programs can affect researcher incentives and the volume or timing of vulnerability reports.

Security teams should continue monitoring vendor advisories, product security pages and disclosure platforms rather than assuming that a program change means fewer vulnerabilities or reduced risk.

See Tom’s Hardware’s report.

Critical Vulnerabilities

CVE-2026-93985: OpenPanel js-runtime sandbox escape

  • CVSS: 9.9
  • Affected product: OpenPanel js-runtime
  • Risk: Project writers may be able to escape the JavaScript webhook template sandbox and execute arbitrary code in the worker process through computed member access to constructor chains.
  • Action: Prioritize remediation using the OpenPanel security advisory. Restrict project-writer permissions, review webhook templates and inspect worker processes for unexpected child processes or outbound connections.

The VulnCheck advisory provides additional technical context.

CVE-2026-78030: Perl DBI and DBD::DBM code execution risk

  • CVSS: 9.8
  • Affected product: Perl DBI / DBD::DBM
  • Risk: Unvalidated dbm_type and dbm_mldbm connection attributes can cause arbitrary modules or files to be loaded and executed.
  • Action: Audit applications that accept database connection parameters, restrict connection configuration to trusted administrators and update affected Perl components using the DBI security advisory.

Review the DBI change history and the oss-security discussion.

CVE-2026-94083: Suricata DoH2 invalid free

  • CVSS: 9.4
  • Affected product: OISF Suricata
  • Risk: A type-confusion issue can cause an invalid free when an HTTP/1-to-HTTP/2 upgrade is processed as a DoH2 request.
  • Action: Upgrade to Suricata 8.0.7 or the applicable fixed release. Monitor sensors for crashes, malformed HTTP/2 traffic and unexpected process restarts.

The fix is documented in the Suricata 8.0.7 release discussion and the 8.0.6 to 8.0.7 comparison.

CVE-2026-94084: Suricata HTTP/2 use-after-free

  • CVSS: 9.4
  • Affected product: OISF Suricata
  • Risk: Http2ThreadMultiBuf can experience a use-after-free when rules inspect transactions using http.response_header with and without a transform.
  • Action: Upgrade to Suricata 8.0.7 or the applicable fixed release, then review sensor stability and rule behavior during rollout.

Consult the Suricata release discussion and source comparison.

  • CVSS: 9.1
  • Affected product: D-Link R95 BE9500
  • Risk: Remote OS command injection through manipulation of the NTPServer argument in the DHMAPI component. Public exploit information is available.
  • Action: Patch immediately if a supported fix is available, remove router administration interfaces from the internet and restrict management access to trusted networks. Replace unsupported devices if remediation is unavailable.

Track the CVE record, public exploit repository and D-Link security bulletins.

None of the five listed vulnerabilities is identified in the supplied data as being in CISA’s Known Exploited Vulnerabilities catalog. However, the public exploit information for CVE-2026-93958 and the severity of all five issues justify accelerated triage.

What Defenders Should Do Today

  1. Inventory affected products. Identify OpenPanel, Perl DBI and DBD::DBM, Suricata and D-Link R95 BE9500 deployments. Prioritize internet-facing, privileged and business-critical systems.
  2. Upgrade Suricata. Deploy version 8.0.7 or the applicable fixed release. Watch for process crashes, sensor restarts and malformed HTTP/2 traffic during and after rollout.
  3. Restrict OpenPanel privileges. Review project-writer assignments and webhook templates. Investigate constructor-chain access, unexpected worker child processes and outbound connections.
  4. Audit Perl connection parameters. Search application configuration and request paths for user-controlled dbm_type or dbm_mldbm values. Review recent module and file loads.
  5. Secure D-Link routers. Remove exposed administration interfaces, restrict management access, review NTP configuration changes and investigate suspicious requests involving NTPServer.
  6. Hunt for malicious browser extensions. Review extension inventories, installation events, browser policy changes and unauthorized AI-agent activity. Pay particular attention to new extensions installed outside approved channels.
  7. Scope WaterPlum exposure. Correlate endpoint, DNS, proxy and identity logs for anomalous downloads, persistence, scripting and command-and-control behavior. Isolate systems with credible indicators.
  8. Review AI data governance. Confirm consent, retention and access controls for face scans, voice data and mood or sentiment analysis. Disable unapproved biometric integrations.
  9. Preserve incident evidence. Retain browser-extension metadata, endpoint telemetry, router logs, webhook activity, process creation events and relevant identity records before remediation where possible.
  10. Track follow-up advisories. Monitor product security pages, disclosure platforms and incident reporting for new fixes, exploitation evidence and revised impact assessments.

Technical Notes

Search for suspicious OpenPanel worker activity

The following examples are starting points for Linux-based environments. Adapt paths, process names and time ranges to the deployment:

# Review recent child processes from likely worker services
journalctl --since "24 hours ago" | grep -Ei \
  'worker|webhook|child process|exec|spawn|curl|wget|python|perl|sh|bash'

# Find recently modified webhook or application configuration files
find /etc /opt /srv -type f -mtime -2 \
  \( -iname '*webhook*' -o -iname '*template*' -o -iname '*.json' \) \
  -print 2>/dev/null

Look for unexpected shells, interpreters, archive utilities, network clients, temporary-file execution and outbound connections from worker processes. These observations are not proof of exploitation and require correlation with authorized application behavior.

Audit Perl DBI connection configuration

Search code and configuration repositories for the affected attributes:

grep -RInE --exclude-dir=.git \
  'dbm_type|dbm_mldbm|DBI:[^"]*DBM' \
  /srv /opt /etc 2>/dev/null

Review whether connection attributes can be supplied through HTTP parameters, job definitions, environment variables, tenant configuration or uploaded files. Restrict those inputs to validated allowlists and trusted administrative workflows.

Validate Suricata rollout and stability

Confirm the installed version and inspect service health after upgrading:

suricata --build-info | head -40
systemctl status suricata --no-pager
journalctl -u suricata --since "24 hours ago" --no-pager

A basic configuration test before restart can reduce deployment risk:

suricata -T -c /etc/suricata/suricata.yaml

Review sensor logs for repeated crashes, invalid frees, use-after-free symptoms, malformed HTTP/2 parsing and unexpected service restarts. Preserve crash artifacts according to the organization’s incident-response procedures.

Detect unauthorized browser-extension changes

Centralized browser-management telemetry should be queried for:

  • Extensions installed outside approved policy
  • New extension IDs or changes to extension permissions
  • Extensions requesting access to all websites
  • Browser automation actions outside approved workflows
  • Agent requests involving credentials, downloads, payments or external messaging

A generic endpoint search pattern may help identify recent extension changes:

process_name in ("chrome", "msedge", "firefox")
AND event_type in ("extension_install", "extension_update", "policy_change")
AND event_time >= now()-24h

Map the query to the fields and event taxonomy used by the endpoint or browser-management platform.

At the network edge, identify devices exposing administration or management services to untrusted networks:

# Example inventory query against an approved scanner
nmap -Pn -p 80,443,22,23 <router-management-subnet>

Do not scan networks without authorization. Review router logs for unexpected NTP configuration changes, requests containing the NTPServer parameter and outbound connections originating from the router. If the device cannot be patched or securely isolated, replacement is the safer remediation path.

Sources

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-09-20

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.