Skip to content
eastbaycyber

Cybersecurity Threat Digest: September 25, 2026

Threat digests 8 min read
EC
East Bay Cyber Editorial Team Updated
Week of 25 SEP 2026

This cybersecurity threat digest for September 25, 2026, covers active Roundcube exploitation, cryptocurrency theft, Windows update issues, malware campaigns, exposed GitLab information, and critical infrastructure vulnerabilities.

TL;DR - Attackers are actively exploiting a previously patched Roundcube code-injection flaw. - Defenders should prioritize internet-facing email, file-transfer, deployment, Docker, and security-monitoring systems. - Review exposure and patch status today, while investigating suspicious activity across affected platforms.

Analyst’s Take: Roundcube deserves the first response because exploitation is active and the affected service is typically internet-facing. In parallel, isolate exposed HFS2 and Docker systems, then move through the remaining high-severity findings according to exposure and access level. The supplied data does not identify a CVE for the Roundcube flaw, so teams should verify the May security update rather than wait for a matching identifier.

Top Stories#

  • Bitget reports a $351.6 million cryptocurrency theft. Bitget disclosed that suspected North Korean hackers stole funds from hot and warm wallets. Organizations managing digital assets should review wallet approvals, transaction alerts, access controls, and custody separation. BleepingComputer

  • Microsoft warns of Windows desktop loading failures. Some users may encounter black screens and other desktop-loading problems after installing the August 2026 preview updates and subsequent updates. Administrators should validate affected update rings and maintain recovery procedures before broad deployment. BleepingComputer

  • MacSync abuses public iCloud Calendar events. A new macOS malware variant uses public iCloud calendar events to deliver native payloads. Security teams should treat unexpected calendar invitations and events as a possible malware-delivery channel, not merely a productivity nuisance. BleepingComputer

  • Carbonato targets exposed Docker daemons. The malware installs the Hermes Agent AI framework after compromising insecure Docker hosts. Publicly reachable Docker APIs, unnecessary Docker socket mounts, and weak daemon controls create paths for this compromise. BleepingComputer

  • GitLab project documentation may expose developer email addresses. Private project email addresses used to push issues or tasks can be exposed in public documentation, potentially allowing attackers to submit content or push code. Review project documentation, notification settings, branch protections, and commit workflows. Also review public links for typosquatting risks and train staff to protect credentials from shoulder surfing in shared workspaces. BleepingComputer

  • Roundcube exploitation is active. A high-severity Roundcube Webmail vulnerability patched in May is reportedly being used in code-injection attacks. Organizations should verify the relevant update rather than relying on assumed patch compliance, and review webmail logs for suspicious requests. BleepingComputer

  • Security partnerships and AI claims draw attention. KELA and Fujitsu announced a cybersecurity collaboration agreement. Separately, Fortune reported that OpenAI plans to unveil a GPT-6 Cyber model and a related deployment product. Treat announcements as developments to monitor until primary technical documentation and availability details are published. KELA and Fujitsu report · Fortune report

Critical Vulnerabilities#

HFS2

  • CVE-2026-97359, CVSS 10.0: HFS2 2.4.0 and earlier contains an unauthenticated template-injection vulnerability in the multipart upload handler. Malicious syntax in a filename can enable remote code execution.
  • CVE-2026-97360, CVSS 10.0: HFS2 2.4.0 and earlier contains an unauthenticated arbitrary file-access issue that may allow attackers to read, write, append, or delete files accessible to the HFS service account.

Review the HFS2 advisory for CVE-2026-97359 and the CVE-2026-97360 advisory. Upgrade beyond the affected release when a fixed version is available, or remove the service from network exposure.

Velociraptor

  • CVE-2026-19072, CVSS 9.9: An authenticated user with the investigator role can set compiled_collector_args when scheduling a hunt, bypass ACL checks, and execute arbitrary VQL statements as an administrator on the Velociraptor server.

Review the Velociraptor advisory and audit hunt-scheduling activity, investigator permissions, and unexpected compiled collector arguments.

Dokploy

  • CVE-2026-93425, CVSS 9.9: Before version 0.29.13, an authenticated organization member with service:read permission can inject shell metacharacters through repoPath and execute commands as root in the Dokploy container. Deployments exposing the Docker socket may permit further host compromise.

Upgrade to Dokploy 0.29.13 or later, review the security advisory, and remove unnecessary Docker socket access.

Linux kernel

  • CVE-2026-93207, CVSS 9.8: A SUNRPC decoding issue can leave partially decoded credential state mixed with stale data after an early failure. The fix clears the structure on entry to prevent unsafe length and pointer use.

Apply kernel updates from the relevant distribution and prioritize systems using SUNRPC or exposed network services. The referenced fixes are available through the Linux stable kernel commits and additional stable commit. The CVE record provides the identifier and record details.

Exploited Roundcube vulnerability

The supplied intelligence identifies active exploitation of a high-severity Roundcube code-injection flaw but does not provide a CVE identifier. Do not infer or assign one from secondary reporting. Patch internet-facing Roundcube installations immediately, confirm the May security update, and investigate suspicious webmail requests, account activity, and server-side file changes.

None of the listed CVEs are identified as CISA Known Exploited Vulnerabilities in the supplied data. Active exploitation of the Roundcube issue still warrants emergency prioritization.

What Defenders Should Do Today#

  1. Prioritize Roundcube. Inventory all instances, confirm the relevant May security update, restrict administrative access, and review reverse-proxy and application logs for suspicious code-injection attempts.

  2. Remove or upgrade HFS2. Upgrade beyond version 2.4.0 when possible. Until then, take exposed instances offline, restrict upload access, and investigate suspicious filenames, template syntax, and service-account file activity.

  3. Upgrade Dokploy. Move to version 0.29.13 or later. Restrict organization permissions, validate repository-path handling, and avoid mounting the Docker socket into application containers.

  4. Harden Docker exposure. Identify public Docker APIs and daemon endpoints, disable unauthenticated access, restrict management interfaces to trusted networks, and remove unnecessary socket mounts. Investigate unexpected Hermes Agent processes, containers, images, and outbound connections.

  5. Review Velociraptor access. Apply the vendor fix, reduce investigator permissions where possible, and search for unusual hunt creation, compiled_collector_args values, or VQL execution.

  6. Patch Linux systems. Apply distribution kernel updates addressing CVE-2026-93207, with priority given to systems using SUNRPC and internet-facing services. Reboot according to operational policy and verify the running kernel afterward.

  7. Audit GitLab projects. Search public documentation, issue templates, and task settings for private project email addresses. Rotate affected credentials or tokens, enable protected branches, require review for sensitive repositories, and inspect recent pushes from unexpected identities.

  8. Monitor macOS calendar activity. Look for unexpected public iCloud Calendar events, newly installed native binaries, suspicious parent-child process relationships, and outbound connections following calendar synchronization.

  9. Protect digital assets. Review Bitget-related activity where applicable, verify wallet transaction approvals, strengthen hot-wallet limits, and use offline or multisignature safeguards for high-value holdings. Use a reputable password manager such as Try 1Password → to help protect wallet and administrative credentials.

  10. Stage Windows updates. Test the latest updates in a controlled ring, document affected builds, and prepare rollback or recovery procedures for systems showing black screens or desktop-loading failures.

Technical Notes#

Check externally reachable services

Use an approved asset inventory or vulnerability scanner first. For a focused validation of known hosts, administrators can check whether common management ports are reachable from a trusted assessment system:

nmap -Pn -p 80,443,2375,2376,3000,8000,8080,8443 \
  --script http-title,http-headers \
  <approved-host-or-subnet>

A reachable Docker API port, particularly an unauthenticated endpoint, should be treated as an incident-priority configuration issue. Do not run intrusive scripts against systems without authorization.

Review Docker exposure and socket mounts

On hosts under investigation, review listening sockets and container mounts:

ss -lntp
docker ps --no-trunc
docker inspect $(docker ps -q) \
  --format '{{.Name}} {{range .Mounts}}{{.Source}} -> {{.Destination}} {{end}}'

Look for public listeners on Docker API ports, unexpected containers, unfamiliar images, and mounts involving /var/run/docker.sock.

Search webmail logs for suspicious requests

Log formats vary by deployment. Search Roundcube access, reverse-proxy, and PHP application logs for unusual upload requests, encoded parameters, unexpected administrative actions, and requests followed by server-side file changes:

grep -RniE \
  'roundcube|upload|multipart|%[0-9a-f]{2}|base64|eval|system|passthru|shell' \
  /var/log/nginx /var/log/apache2 /var/log/php* 2>/dev/null

Treat matches as triage leads rather than proof of compromise. Correlate timestamps with authentication events, process execution, file creation, and outbound network activity.

Verify the running Linux kernel

After applying a distribution update and rebooting, verify that the running kernel matches the patched package:

uname -a

Use the operating system’s package manager and security advisory data to determine the correct fixed build. Do not rely on the package being installed if the host is still running an older kernel.

Hunt for suspicious macOS calendar-delivered activity

Review recent process execution, launch agents, login items, and newly created binaries on affected Macs. Example commands for local triage include:

ps auxww
launchctl list
find ~/Downloads /tmp /private/tmp -type f -mtime -3 -print 2>/dev/null

Collect endpoint telemetry and preserve relevant calendar, browser, and process evidence before removing suspected files.

Prioritization Summary#

Immediate: Start with Roundcube patch verification and exploitation review. Audit Docker exposure, isolate or upgrade HFS2, and upgrade Dokploy where the Docker socket is exposed.

Today: Review Velociraptor permissions and hunts, patch Linux kernels, audit GitLab documentation and tokens, and investigate macOS calendar delivery.

Planned and monitored: Roll out Windows updates through controlled rings, improve wallet controls, and validate emerging security partnership and AI product announcements.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-09-25

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.