Welcome to Issue #36 of the CosmicBytez Labs Weekly Digest — your curated rundown of what mattered in cybersecurity this week.
SD-WAN infrastructure took the hardest hit. Arista disclosed CVE-2026-93952, a perfect CVSS 10.0 pre-authentication privilege escalation in VeloCloud Orchestrator affecting certificate-based enterprise deployments — already under active exploitation before most admins had a chance to patch. Nearly as concerning, Microsoft's own severity labeling failed this week: a SharePoint bug it classified as low-impact "spoofing," CVE-2026-65660, turns out to enable full authenticated remote code execution once the technical details were published — a reminder that vendor severity ratings deserve independent scrutiny, not blind trust.
Nation-state activity stayed busy on two fronts. A Chinese-speaking threat actor breached 996 Zyxel switches and 49 organizations by chaining WordPress plugin flaws with CVE-2026-7273 (now on CISA's KEV list), making off with 18,566 government records. Meanwhile Japan notched a first: working with the US, Germany, and Australia, authorities dismantled the country's first North Korean "laptop farm" tied to the WaterPlum IT-worker fraud scheme, part of a wider haul of roughly 30,000 devices used to funnel fraudulent salaries back to Pyongyang.
Endpoint security had an awkward week too. Researcher Abdelhamid Naceri dropped a public PoC dubbed BigDiskBuster that fills disk space to indefinitely block Windows Defender signature and platform updates — no CVE assigned, no patch available, and it works today. And on the supply-chain side, a stolen OAuth token from May's TanStack npm worm let attackers quietly clone 170 private CrowdSec repositories for four months before anyone noticed — a sobering illustration of how long a single leaked credential can stay useful.
The throughline: this week's worst incidents weren't exotic. A vendor mis-rated a bug's severity, a leaked token sat unused for months, and a maximum-severity SD-WAN flaw was exploited before most teams even saw the advisory. Patch triage that trusts the label on the tin, and credential hygiene that assumes "it's been fine so far," are exactly the assumptions attackers are counting on.
Top Stories
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Arista disclosed CVE-2026-93952, a maximum-severity CVSS 10.0 pre-authentication privilege escalation in VeloCloud Orchestrator, already confirmed under active exploitation against certificate-based enterprise deployments. The flaw lets an unauthenticated attacker escalate to full orchestrator control, putting every SD-WAN edge it manages at risk.
What to do: Patch VeloCloud Orchestrator immediately per Arista's advisory, and treat any pre-patch instance exposed to the internet as potentially compromised — review admin accounts and orchestrator-pushed configuration changes for anything unfamiliar.
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
CVE-2026-65660 shipped in Microsoft's advisories as a low-impact "spoofing" issue, but full technical analysis published this week shows it actually enables authenticated remote code execution against on-premises SharePoint servers. The mislabeling likely pushed the patch down the priority queue for teams triaging purely off severity text.
What to do: Don't rely on vendor-assigned category labels alone — cross-check patch priority against independent technical write-ups, and confirm this SharePoint update is applied regardless of how it was originally classified.
Chinese Hackers Exploit WordPress, Zyxel Flaws to Steal Government Data
A Chinese-speaking threat actor breached 996 Zyxel GS1900 switches and 49 organizations by chaining vulnerable WordPress plugins with CVE-2026-7273, a stack buffer overflow in Zyxel's switch firmware that CISA has since added to its Known Exploited Vulnerabilities catalog. The campaign exfiltrated 18,566 government records.
What to do: Patch Zyxel GS1900-series switches against CVE-2026-7273 now (see this week's Security Corner below), and audit WordPress plugin inventories on any government-adjacent or municipal site for unpatched components.
Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
Japan, the United States, Germany, and Australia jointly detailed the WaterPlum IT-worker fraud scheme, in which North Korean operatives use stolen or fabricated identities to land remote developer jobs at Western companies. Japan's takedown marks the country's first laptop farm disruption tied to the scheme, part of a wider haul across allied nations totaling roughly 30,000 devices.
What to do: Tighten remote-hire identity verification — video interviews, notarized ID checks, and shipping-address consistency checks remain the most effective friction against laptop-farm fraud.
New Windows Defender Zero-Day Blocks Microsoft Antivirus Updates
Researcher Abdelhamid Naceri released a public proof-of-concept called BigDiskBuster that fills available disk space to indefinitely block Windows Defender signature and platform updates. There is no assigned CVE and no patch — the technique works today against fully updated Windows systems, leaving affected endpoints running stale antivirus definitions.
What to do: Monitor disk-space alerts and Defender update-status telemetry as a detection proxy until Microsoft ships a fix, and don't treat "Defender is installed" as equivalent to "Defender is current."
Security Corner
Notable advisories published this week:
-
CVE-2026-94127 — Critical. F5 BIG-IP APM heap-based buffer overflow on virtual servers with OAuth + access policy configured, enabling unauthenticated RCE — added to CISA's KEV catalog as actively exploited.
-
CVE-2026-7273 — High, actively exploited. Zyxel GS1900 switch series stack buffer overflow, the same flaw chained in this week's top story on Chinese government-data theft — now on CISA's KEV list.
-
CVE-2026-77521 — Critical (10.0). MaxKB's SandboxShellBackend skips human approval on its shell tool, letting untrusted input trigger unauthenticated remote code execution.
-
CVE-2026-19658 and CVE-2026-13355 — both Critical (9.8). WordPress plugin flaws in Give Tributes (unauthenticated PHP object injection) and Meta Box AIO (chained shortcode injection to full Administrator takeover) — patch both if installed.
-
CVE-2026-82187 — Critical. Web to Print Online Designer for WooCommerce fails to validate uploads and leaks its own protection token, enabling unauthenticated arbitrary file upload and RCE on print-shop storefronts.
-
CVE-2026-94099 and CVE-2026-94100 — both Critical. Netcore NBR200V2 routers carry both an unauthenticated command injection in the backup-restore endpoint and a remotely triggerable buffer overflow in WAN VLAN handling.
-
CVE-2016-15059 — Critical (9.8), a decade old. A heap buffer overflow in Perl's Net::IDN::Punycode XS encoder was only just scored in NVD this week — a reminder that "old" doesn't mean "triaged."
Browse the full Security Advisories archive for all active CVEs.
Quick Takes
-
Rogue MFA providers can steal passwords mid-login — TrustSink lets a privileged Microsoft Entra ID admin register a rogue external MFA provider that silently captures user passwords in plaintext (read more).
-
Shai-Hulud's stolen token resurfaces at CrowdSec — A stolen OAuth token from May's TanStack npm worm let attackers clone 170 CrowdSec private repositories, undetected for four months (read more).
-
Malicious npm package impersonates a popular library — "indexed-btree" impersonated the legitimate sorted-btree package and hid its malware trigger in a prototype method, racking up millions of downloads (read more).
-
Sweden fines HR vendor over ransomware breach — Regulator IMY fined Miljödata $183,000 after a 2025 ransomware attack exposed sensitive data on 2.2 million Swedish residents (read more).
-
WordPress patches "Click2Shell" CSRF chain — WordPress 7.1.1 fixes a CSRF flaw that let attackers force theme installs and chain to full remote code execution on self-hosted sites (read more).
-
WordPress "Comment2Shell" turns a comment into admin RCE — A parsing gap lets one approved comment auto-execute in an admin's browser, chaining to full server-side remote code execution (read more).
-
BigCommerce merchant data exposed via third-party app — A compromised application key held by third-party app Ribon exposed merchant customer data across affected storefronts (read more).
-
Microsoft and UK police dismantle AI fraud chatbot — Two arrested after Microsoft's Digital Crimes Unit took down "EvilTokens," an AI chatbot that automated account takeover for a $1,500 Telegram fee (read more).
-
D-Link warns of unpatched max-severity router zero-day — Two unpatched flaws disclosed in legacy DIR-822A routers, including a max-severity DHCP stack overflow, both with public PoC exploit code (read more).
-
Meta Muse's hidden setting can be hijacked by local malware — Researcher Patrick Wardle shows how malware already on a Mac can quietly redirect Muse's mic feed and hijack its granted permissions (read more).
-
Google fined €403M over location data transparency — Ireland's DPC fined Google €403 million ($463M) after finding it failed to meet GDPR transparency requirements across three location-tracking features (read more).
Catch up on everything else in this week's news archive.
Upcoming
Next issue (Issue #37): Watch for confirmed downstream compromises from the VeloCloud Orchestrator CVSS-10.0 exploitation now that it's public, whether Microsoft revises its severity-labeling process after the SharePoint "spoofing" miss, and federal patch compliance on the newly KEV-listed Zyxel GS1900 flaw.
On the Labs: Fresh advisories are landing daily in the Security archive, and the howto library keeps growing — this week's SharePoint story makes a strong case for triaging patches by technical impact, not just the label a vendor puts on the advisory.
Stay sharp. A four-month-undetected credential leak and a mislabeled "spoofing" bug that was actually RCE both point the same direction: the gap between what looks urgent and what actually is urgent is where attackers live.
Issue #36 — September 22, 2026. Published weekly by CosmicBytez Labs. To receive this digest by email, subscribe here.