Cybersecurity Threat Digest: September 26, 2026

Threat digests 2026-09-26 10 min read

East Bay Cyber Editorial Team Updated 2026-09-26

Week of 26 SEP 2026

This cybersecurity threat digest for September 26, 2026 covers active exploitation warnings, a Kiteworks shutdown request, telecom-related cybercrime, WordPress and Grav CMS risks, and newly published Linux kernel vulnerabilities.

TL;DR - CISA reports active exploitation affecting SharePoint, WSO2, and Adobe Commerce. - Kiteworks urged customers to shut down servers temporarily amid a potential attack. - Patch exposed CMS, WordPress, and Linux systems, then check for compromise.

Critical Vulnerabilities#

CISA warns of active exploitation in enterprise platforms

CISA warned that attackers are exploiting critical vulnerabilities affecting Microsoft SharePoint, WSO2 products, and Adobe Commerce. The report does not provide enough information here to identify the individual vulnerability IDs, so teams should use the linked alert and applicable vendor advisories to map affected versions accurately.

Prioritize internet-facing instances first. Pair patching with compromise assessment because remediation does not remove an attacker who already established persistence.

Read the CISA-focused report from BleepingComputer.

Linux kernel qla2xxx driver flaws

Two newly published vulnerabilities affect the Linux kernel qla2xxx SCSI driver:

CVE-2026-97527, CVSS 8.8: A race condition involving the NVMe unsolicited-context list can corrupt linked-list state. The fix adds a per-Fibre Channel port lock.
CVE-2026-97528, CVSS 8.8: An NVMe unsolicited context can be freed while still linked, creating use-after-free behavior, list corruption, or a kernel panic.

The associated kernel fixes are available through the referenced stable-kernel commits:

Linux SMB/CIFS client heap overflow

CVE-2026-97555 affects the Linux kernel SMB/CIFS client and has a CVSS score of 8.8. A heap buffer overflow can occur when rewriting DACL owner and group security identifiers because replacement identifiers may be larger than the allocation based on the original DACL.

Organizations using Linux systems as SMB/CIFS clients should prioritize supported kernel updates and validate exposure against their distribution’s advisory. The issue matters most on systems that routinely access Windows file shares or process security descriptors.

References:

HINIC driver validation error

CVE-2026-97957, CVSS 8.8, affects the Linux kernel HINIC network driver. Insufficient mailbox segment-length validation permits a 16-byte heap buffer overflow in the final mailbox segment.

Administrators should identify hosts using the affected driver and apply distribution-provided kernel updates. If a patched kernel is not immediately available, evaluate whether the driver can be disabled without disrupting production services, and document the operational impact before making that change.

References:

x86 memory-management issue

CVE-2026-97525, CVSS 8.2, affects the Linux kernel x86 memory-management subsystem. Split page tables created by CPA were not allocated or marked as kernel page tables through standard routines, resulting in incorrect page-table metadata and potentially unsafe deferred freeing and IOTLB invalidation behavior.

This issue may require more targeted asset analysis than a typical internet-facing application flaw. Kernel teams should identify systems using affected code paths, review the applicable distribution advisory, and schedule updates through normal emergency-kernel procedures.

Reference commits:

The five Linux kernel vulnerabilities listed above are not currently marked as exploited in CISA’s Known Exploited Vulnerabilities catalog according to the supplied data. That status should not be treated as a reason to defer updates on exposed or business-critical systems.

Analyst’s Take: Start with the systems already tied to active exploitation or emergency shutdown guidance, then move to kernel exposure based on actual use of the affected drivers and subsystems. The supplied data does not identify individual CISA vulnerability IDs or establish a confirmed Kiteworks compromise, so vendor and provider advisories remain necessary for asset-level decisions.

What Defenders Should Do Today#

Prioritize exploited enterprise platforms. Review current CISA and vendor advisories for SharePoint, WSO2, and Adobe Commerce. Patch internet-facing systems first, then validate versions across internal environments.
Assess Kiteworks exposure before service restoration. Follow the provider’s emergency shutdown guidance, preserve relevant logs, review authentication and administrative events, and inspect for unauthorized files or configuration changes before bringing systems online.
Patch or remove vulnerable Grav CMS deployments. Confirm the installed version, restrict unnecessary administrative and filesystem access, and check for web shells, unexpected files, altered templates, and new administrator accounts.
Update Elementor and audit WordPress. Review administrator accounts, login history, password-reset events, plugin changes, scheduled tasks, and unexpected content modifications. Rotate credentials if compromise indicators are found.
Apply Linux kernel updates based on actual exposure. Inventory systems using Fibre Channel and qla2xxx, SMB/CIFS client functionality, HINIC networking, and affected x86 memory-management paths. Reboot patched systems where required and confirm the running kernel afterward.
Monitor sensitive data access. Alert on unusual bulk access to call records, text metadata, identity records, credentials, payment data, and customer databases. Enforce least privilege and strong multifactor authentication for administrators and service accounts. Review guidance on what is a brute-force attack when evaluating credential attacks.
Use the Labcorp action as a control review. Confirm that vulnerability remediation, asset inventory, incident response, third-party risk, logging, and executive reporting have accountable owners and measurable evidence.
Recheck critical-infrastructure basics. Water utilities and other essential-service operators should validate asset inventories, secure remote access, network segmentation, tested backups, centralized logging, patching, and incident-response procedures.

Technical Notes#

Check the running Linux kernel and loaded drivers

Use local inventory to determine whether a host requires a kernel update or uses relevant hardware drivers. Run commands with appropriate privileges and avoid making unreviewed production changes.

uname -a
uname -r

# Check for relevant loaded modules
lsmod | grep -E 'qla2xxx|hinic|cifs'

# Review kernel messages for driver and filesystem errors
journalctl -k --since "24 hours ago" | \
  grep -Ei 'qla2xxx|hinic|cifs|BUG|general protection|use-after-free|slab|panic'

A clean log does not prove that a host is unaffected or uncompromised. Confirm the installed kernel against the distribution’s security advisory and reboot into the patched kernel when required.

Audit WordPress administrator accounts and recent changes

The exact commands depend on the hosting environment and whether WP-CLI is available. Export evidence before deleting unknown accounts.

# List WordPress users and roles
wp user list --fields=ID,user_login,user_email,roles,registered

# List installed plugins and versions
wp plugin list --fields=name,status,version,update

# Review recent WordPress application log entries if configured
grep -Ei 'user|login|password|plugin|admin' /var/log/nginx/access.log \
  /var/log/apache2/access.log 2>/dev/null | tail -200

Investigate accounts created outside approved change windows, unexpected administrator role assignments, plugin modifications, and password-reset activity. Preserve suspicious files and logs for incident response rather than overwriting them during cleanup.

Search for suspicious web-server activity

For Grav CMS, WordPress, and other public-facing applications, review requests associated with traversal attempts, administrative endpoints, unusual upload paths, and unexpected response codes.

# Example pattern review for common web-server logs
grep -Ei '\.\./|%2e%2e|wp-admin|wp-login|xmlrpc|upload|shell|passwd' \
  /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null | tail -300

The patterns above are triage indicators, not definitive signatures. Correlate source addresses, timestamps, authenticated sessions, file modification times, and endpoint responses with application and identity-provider logs.

Verify a patched kernel after reboot

uname -r
cat /proc/version

# Confirm the system is not waiting for a reboot after package updates
if command -v needrestart >/dev/null 2>&1; then
  sudo needrestart -b
fi

Use the operating system’s package-management and vendor-advisory processes to determine the correct fixed version. Do not assume that a generic upstream kernel version maps directly to a distribution package.

Bottom Line#

Start with internet-facing enterprise products covered by active-exploitation warnings and any Kiteworks systems subject to the provider’s shutdown guidance. Then patch public-facing CMS and WordPress deployments, update Linux systems according to driver and subsystem exposure, and pair each fix with compromise checks because patching alone cannot remove persistence or explain unauthorized access that occurred before remediation.

For staff connecting from untrusted networks, a reputable VPN such as Check NordVPN pricing → can provide an additional privacy layer, but it does not replace patching, multifactor authentication, or endpoint monitoring.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Cybersecurity Threat Digest: September 26, 2026

Top Stories#

Telecom hacking sentence highlights the value of metadata

Kiteworks advises a temporary server shutdown

ShinyHunters compromises the Clop leak site through Grav CMS

Labcorp faces a $2.3 million cybersecurity fine

Elementor flaw could enable administrator-account creation

Rydox marketplace administrator pleads guilty