Cybersecurity News — 2026-09-25

Generated: 2026-09-25 | Sources: CISA, WordPress, Adobe, Check Point, F5, Arista, Microsoft, Varonis, Gambit, Manifold Security, Aikido, ICO, IMY Sweden, The Hacker News, SecurityWeek, BleepingComputer, Help Net Security, Canadian Centre for Cyber Security, Shadowserver, Sansec

1. A Flaw in WordPress Itself Was Being Attacked Five Hours After the Fix Came Out

This is not a plugin problem — it is a flaw in WordPress core, the software roughly two in five websites run on. WordPress 7.1.2, released on 22 September, fixes CVE-2026-87902, rated 9.2 out of 10. The bug is a path traversal: when WordPress decides which theme file to use to draw a page, an attacker can steer that lookup out of the theme folder and point it at some other PHP file already sitting on the server. WordPress then loads that file and the server runs whatever code is inside it. No account is needed and nobody has to click anything. Every version from 4.7.0 to 7.1.1 is affected and the fix has been back-ported to all of them. Exploitation is the striking part: scanning probes started within about five hours of the release, attack traffic rose roughly tenfold the next day, and by 23 September researchers were seeing real compromises, with attackers writing their own PHP files onto servers. Sites on the official WordPress Docker image and on default cPanel setups running older PHP are the easiest to hit.

Why it matters for your business: the patch was out before the attacks started, so this was a race and the deciding factor was how fast site owners moved. Log in to your site today and check the version — it should say 7.1.2. If you have automatic background updates switched on, WordPress will most likely have done it for you, and that is the single best argument for leaving them on. If someone else maintains the site, email them now and ask for the version number, not a reassurance. A patch you have not installed protects nobody.

2. A Flaw in Adobe Commerce Lets a Stranger Step Into a Customer's Account

Adobe Commerce and Magento Open Source power a large share of small and mid-sized online shops. CVE-2026-71362, rated 9.1, is an authorisation flaw: the software fails to properly check whose session is whose, so an attacker can switch a shopping session over to a different customer's account and see whatever that customer can see — order history, addresses, saved details. No account, no admin rights and no action by the victim are required. Adobe shipped a fix in August 2026 and said at the time it had no evidence of attacks, but e-commerce security firm Sansec says it began blocking exploitation attempts shortly after the advisory appeared. CISA added the flaw to its list of vulnerabilities known to be under attack on 24 September, giving US federal agencies until 27 September to fix it. Every version up to and including the July 2026 patch level is affected.

Why it matters for your business: if you sell online through Magento or Adobe Commerce, the exposure here is your customers' data rather than your own systems, which makes it a data-protection problem as much as a security one. Ask whoever runs the shop which patch level it is on and get it to the August 2026 patch or later. Then ask a second question they may not volunteer: if this had been exploited on your store, would you be able to tell? A shop with no logging of session activity cannot answer that, and "we do not know" is a poor thing to say to the Information Commissioner's Office.

3. Attackers Used AI Tools to Break Into Online Shops at Scale and Plant Card Skimmers

Security firm Gambit published research on 22 September describing a campaign in which the attackers handed most of the work to automated AI tooling — one component to hunt for weaknesses, one to exploit them, and one to coordinate the whole thing. The result was volume: more than 100 attack waves between 10 and 15 September alone, at least 27 companies successfully broken into, 119 websites fitted with card skimmers, and over 600,000 payment card records taken from two victims. A skimmer is a snippet of JavaScript quietly added to a checkout page that copies each card number as it is typed. The attackers planted them several different ways — editing the site's JavaScript files, writing them into the database, and poisoning content delivered through the site's content delivery network. Note the through-line with the two stories above: this week the thing under attack is the small business's own website, not its office network. Gambit reports the campaign has been running since at least July.

Why it matters for your business: you cannot see a skimmer by looking at your own checkout page, because it is designed to behave normally. Two practical steps. First, if you take card details on your own site, ask your developer whether you could instead hand payment off to a hosted page from Stripe, Worldpay or similar — card numbers that never touch your server cannot be skimmed from it. Second, ask for file-integrity monitoring, which is simply an alert when a file on the website changes without anyone deploying a change. It is cheap and it is how these are usually caught.

4. A Webmail Flaw Patched in May Is Now Being Exploited

Roundcube is the webmail interface many hosting companies and small internet providers bolt onto a mailbox — the page you get when you read your work email in a browser rather than in Outlook. CVE-2026-48842 is a SQL injection flaw in one of its built-in components, the part that looks up which user maps to which email address. SQL injection means an attacker sends input crafted so that the database treats part of it as a command rather than as data; here it lets them get past the login entirely and pull data out, with no account and no interaction from anyone. The fix arrived in Roundcube 1.6.16 and 1.7.1 back in May 2026. On 22 September the Canadian Centre for Cyber Security updated its advisory to say the flaw is now being exploited in the wild — four months after the patch. The Shadowserver Foundation tracks more than 523,000 Roundcube installations reachable on the internet.

Why it matters for your business: this is the mirror image of the WordPress story. There the gap between the fix and the attack was five hours; here it was four months, and the attacks are landing anyway because the fix was never applied. Attackers do not lose interest in a vulnerability because it is old — they gain interest, because by then the details are public and the unpatched machines are easy to find. If you read your email through a webmail page supplied by your host, send them one line asking which Roundcube version it runs.

5. Small-Business Firewalls From Check Point Are Being Attacked Through Their VPN

Check Point Spark is the firewall line aimed at small offices and branch sites, not at large enterprises — which is what makes this one land closer to home than most appliance stories. Check Point published a fix on 9 September for CVE-2026-85102, rated 9.8, a flaw in how the gateway checks certificate data while setting up a VPN connection; it lets an attacker with no credentials run code on the device. At the time the company had seen no attacks. On 12 September that changed, and Check Point is now reporting a global wave of exploitation attempts against Spark customers, arriving through VPN services and proxies to hide their origin. The same advisory, updated on 22 September, discloses a second critical flaw, CVE-2026-93616 in Check Point's Security Management server, which allows an unauthenticated attacker who can reach its web service to run scripts on it; Check Point Research says it saw a small number of carefully targeted attempts using this one as far back as 23 July. CISA added both to its known-exploited list on 22 September.

Why it matters for your business: a firewall is worth patching before almost anything else you own, because it is deliberately exposed to the internet and everything else sits behind it. If you have a Check Point Spark box — it may well have been installed and configured by an IT supplier rather than by you — ask them today whether the fix from SK1000117 is applied and whether they have reviewed the logs for unusual certificate-based VPN logins. More generally: find out who is responsible for updating your firewall, because in a lot of small businesses the honest answer is nobody.

6. Two More Internet-Facing Network Devices Were Found Under Attack the Same Week

F5 published an advisory on 22 September for CVE-2026-94127, rated 9.8, in BIG-IP APM — the part of F5's kit that handles remote access logins. It is a memory-handling flaw that an attacker can trigger by sending crafted traffic, with no login, to run code on the appliance; it only applies where BIG-IP APM is configured as an OAuth authorisation server, which narrows the affected population considerably but not to zero. F5 published only after establishing that attacks were already happening. The same day, Arista patched CVE-2026-93952 in on-premises VeloCloud Orchestrator, the console used to manage branch-office network links, where weak input checking lets a remote attacker reach privileged internal functions without credentials; that one was found by an outside party already exploiting it. CISA added both, alongside the two Check Point flaws, on 22 September. That makes four network-edge products in a single day, all with the same shape: no login needed, and the vendor learned about it from the attack rather than from a researcher.

Why it matters for your business: most small firms run none of these, and there is no action to take if you do not. The transferable point is about what qualifies as a priority. The devices being hit are the ones that sit at the boundary and decide who gets in — VPN concentrators, remote-access gateways, network controllers. Write down every device at your business that is reachable from the internet, including anything an IT supplier installed years ago and nobody has logged into since. That list is short, you can make it this afternoon, and it is the list that matters when a warning like this week's lands.

7. A Domain Used as a Placeholder in Programming Tutorials Was Turned Into a Trap

For years, developers writing documentation have used third-party.com as a stand-in when they need an example web address — the way example.com is used. Manifold Security found that control of that domain has changed hands and it now serves a ClickFix attack. ClickFix is currently one of the most successful techniques in circulation and it works like this: the page shows what looks like a routine "verify you are human" check, and the instructions tell you to press the Windows key and R and paste something in. What you are actually pasting is a command the page has quietly copied to your clipboard, and pressing Enter runs it on your machine. The technique's strength is that it never has to defeat any security software — it persuades you to run the code yourself. More than 1,500 files across 1,700-plus public code repositories reference the domain, including documentation from well-known projects, so the traffic arrives from places a developer has every reason to trust. Google Safe Browsing has since flagged it.

Why it matters for your business: this is the one item this week that will reach an ordinary member of staff rather than a server. Give everybody one flat rule, and repeat it until it is boring: no legitimate website will ever ask you to copy something, press Windows+R and paste it in. Not to prove you are human, not to fix a display problem, not to install an update. If a page asks, close the tab. That single sentence defends against the entire family of attacks, and it costs nothing to teach.

8. Researchers Showed How a Fake "Extra Security" Step Can Harvest Passwords

Varonis Threat Labs published research on 22 September on a technique it calls TrustSink, affecting Microsoft Entra — the identity system behind Microsoft 365 logins — and in principle any platform that lets an organisation plug in an outside multi-factor authentication provider. An attacker who has already taken over a sufficiently privileged administrator account can register their own rogue provider. From then on, staff signing in normally are shown an extra prompt that looks like Microsoft asking them to confirm their password. It is not Microsoft; the password is captured in plain text, and the rogue provider then returns a valid token so that the login completes without any error to arouse suspicion. It is worth being precise about the risk: this is not a way in. It requires an administrator account to be compromised first, and it is what a competent attacker does next — converting one stolen account into a steady supply of everybody's passwords.

Why it matters for your business: the reason this deserves your attention is that it survives the clean-up. If you ever have an account compromise and your response is "we reset the passwords", something like this would sit there untouched and keep collecting the new ones. Two things to do. Ask whoever administers your Microsoft 365 to look at the authentication methods configured for your tenant and confirm every one of them is something you chose. And keep the number of people holding full administrator rights as small as you can stand — ideally on a separate account used only for administration, not for daily email.

9. TikTok Dropped Its Appeals and Will Pay the ICO's £12.7 Million Fine

The UK's Information Commissioner's Office announced on 24 September that TikTok has withdrawn two appeals and accepted the £12.7 million penalty the regulator issued back in 2023. That fine concerned the handling of children's personal data: the ICO found TikTok had allowed around 1.75 million UK children under 13 to use the platform in 2020, without adequate age checks, sufficient transparency about what data was collected and shared, or parental consent. The second withdrawn appeal was against an information notice — a formal demand that TikTok hand over details of how it processes the data of 13- to 17-year-olds in its recommendation systems, which forms part of a separate ongoing investigation. Deputy Commissioner Emily Keaney framed the outcome around the responsibility that falls on companies designing online services used by young people.

Why it matters for your business: the useful detail for a small business is not the sum, it is the three-year gap between the penalty and the payment. Regulatory action is slow, it is public throughout, and appealing it does not make it go away. If your business collects personal data from anyone under 18 — a tutoring service, a sports club, a children's retailer, anything with an under-18 sign-up — the ICO's Children's Code is aimed squarely at you, and the enforcement that reaches small organisations is usually triggered by a complaint rather than by a proactive audit. Knowing what you collect from young users, and why, is the whole of the preparation.

10. Sweden Fined a Software Supplier After a Breach That Hit 2.2 Million People

Miljödata is a Swedish company supplying HR and workplace-management software to around 80% of the country's municipalities. In August 2025 it was breached, disrupting services across more than 200 local authorities and exposing personal data on 2.2 million people — national identity numbers, contact details, sickness-absence and rehabilitation records, and incident reports involving children. The stolen data was published online. In September 2026 Sweden's data-protection regulator, the IMY, fined the company 1.8 million kronor, roughly £140,000, for breaching Article 32 of the GDPR, the article requiring appropriate security. The regulator's reasoning is the part worth reading: it did not fault the company for being attacked, but for two specific omissions — it did not carry out sufficient checks when installing new software, and it had no automated real-time monitoring that would have detected the intrusion while it was happening.

Why it matters for your business: UK GDPR carries the same Article 32 in the same words, so the reasoning transfers directly. Two points follow. If you supply software or services to other organisations, one breach of yours becomes hundreds of breaches of theirs, and the regulator will judge you on your controls rather than on the attacker's skill. And whichever side of that you sit on, note what was actually criticised: not a missing product, but the absence of any means of noticing. Being able to say when something happened, and how you found out, is a large part of what "appropriate" means in practice.

Sources

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News