Weekly digest: week ending 26 September 2026

Two vulnerabilities reached CISA’s Known Exploited Vulnerabilities catalogue this week with the same 28 September remediation date — one in WordPress core, one in MikroTik RouterOS — and both are reachable without authentication. Alongside that, three national agencies published a joint advisory on a Windows implant used to surveil dissidents and journalists, and a U.S. soldier was sentenced over the 2024 telecom data theft that ran through Snowflake accounts without MFA.

The big three

WordPress core file inclusion, exploited within hours

WordPress shipped a fix on 22 September for a flaw in page-template resolution that lets an unauthenticated attacker influence which PHP file gets included. Under the right server and theme conditions, that inclusion becomes remote code execution. Exploitation was reported within hours of disclosure, and CISA added CVE-2026-87902 to KEV on 25 September with a 28 September due date. Severity: high. Our write-up is at /posts/cisa-adds-actively-exploited-wordpress-core-file-inclusion/.

The patch went out as WordPress 7.1.2 with backports to every supported branch, as far back as 4.7. That detail matters more than the headline version number: sites parked on old long-lived branches are in scope, not excluded.

The preconditions that turn file inclusion into code execution are not enumerated in any of the public reporting we could find. That means you cannot use public sources to argue a specific site is safe. Treat every unpatched install as at risk, and if you are on managed hosting, confirm the patch or edge rule directly rather than assuming it.

MikroTik RouterOS SSH, chained to full admin

CISA also listed CVE-2026-67279, a RouterOS SSH state-machine flaw, with the same 28 September date. On its own it is a protocol problem: an unauthenticated client can get the SSH service to accept a session channel and a command-execution request before authentication completes. Chained with CVE-2026-86060 — described in reporting as argument injection in the login process — the result is administrative control of an internet-exposed router with no password and no key. CERT Polska calls the chain MikroTrick. Details: /posts/mikrotik-routeros-ssh-flaw-added-to-cisa-kev-as-part-of/.

The frustrating part is scope. The sources available to us do not name affected RouterOS version ranges, fixed branches, or a vendor advisory, so “apply the vendor update and confirm the fixed release with MikroTik” is the most precise instruction we can honestly give. Our enrichment returned no CVE severity record for this identifier, so the computed severity is none (no CVE data) — an absence of scoring, not a verdict on impact.

If you have RouterOS devices with SSH reachable from the internet, the exposure question answers itself. CISA’s required action puts the burden of evaluating internet exposure on the asset owner, and states that where mitigations are unavailable the product should be discontinued.

CHOSEN BRICK: three governments describe an Iranian surveillance implant

Agencies in the US, UK and Netherlands, with the FBI, detailed a Windows malware family called CHOSEN BRICK, attributed to Iranian state-linked operators and used against dissidents, activists and journalists. It collects email, Telegram and WhatsApp communications, takes screenshots, and can record audio from the microphone. Each victim is paired with its own Telegram bot for command and control. See /posts/us-uk-and-dutch-agencies-detail-chosen-brick-malware-used/.

There is no exploit in this story. Access comes from a message on WhatsApp or Telegram, sent by someone impersonating a trusted contact or support agent, with a file disguised as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player or KeePass.

One behaviour is worth internalising if you employ journalists, researchers or campaigners: the lures often push the target to run the file on a personal device, on the grounds that corporate controls would block it. The personal side of that person’s computing is part of your threat model whether or not you manage it.

Also this week

• Cameron Wagenius sentenced to 70 months and $294,978 restitution over telecom data theft affecting more than 100 million AT&T customers, via Snowflake accounts without MFA — severity high: /posts/u-s-soldier-sentenced-to-70-months-over-telecom-data-theft/
• Mitsubishi Electric CC-Link IE TSN message-integrity flaw (CVE-2026-13584) lets same-segment attackers tamper with control data across a long list of product families — severity high: /posts/mitsubishi-electric-cc-link-ie-tsn-flaw-lets-on-network/
• CISA reports ransomware gangs exploiting a critical TeamCity flaw: BleepingComputer
• Arista patched an actively exploited VeloCloud Orchestrator zero-day: BleepingComputer
• A Windows Defender zero-day reported to block Microsoft antivirus updates: BleepingComputer
• Malicious AI agents reportedly used to steal 600,000 credit cards and plant skimmers on 100-plus sites: BleepingComputer
• Australia’s prime minister says an OpenAI agent accessed non-public files on a government health website: The Record
• Bruce Schneier on Anthropic’s AI misuse report: Schneier on Security
• ZDI advisory: unauthenticated deserialisation RCE in Cisco Secure Firewall Management Center: ZDI-26-709
• CISA ICS advisories this week include Eufy Omni C20 and Omni X10 Pro (ICSA-26-267-02), Wärtsilä FOS-Onboard (ICSA-26-258-02) and Siemens SIPLUS and SIMATIC products (ICSA-26-265-04)

One thing to do this weekend

Pull the list of every WordPress install your organisation owns — including the ones nobody claims, the marketing microsites and the old campaign domains — and confirm each one is on a patched release. The KEV due date was 28 September, exploitation started the day of disclosure, and an unowned site on an unpatched branch is the likeliest way this flaw becomes your incident.