Cyber Threat Brief — September 16 2026

1. WooCommerce WWLC Unauth Upload → Webshell — CVE-2026-27540

TL;DR: Wordfence (Sep 14–16 amplify) + THN/BC: unauthenticated CVE-2026-27540 in premium WooCommerce Wholesale Lead Capture ≤2.0.3.1 — AJAX action wwlc_file_upload_handler trusts attacker-supplied file_settings.allowed_file_types, so forged ["php"] uploads shell.php → RCE. 100k+ WF blocks since disclosure; 99 attempts in last 24h. Patch to ≥2.0.3.2.

What’s New:

• Exploit POST to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, multipart file_settings={"allowed_file_types":["php","jpg"],"max_allowed_file_size":99999999} + uploaded_file = shell.php
• Observed webshell fingerprint: PHP prints host (php_uname) + browser upload form; marker string sohai in sample payload
• Top offender IPs (blocklist): 92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209
• Same THN piece also discloses The Events Calendar CVE-2026-78159 / CVE-2026-78006 (≤6.17.3 / ≤6.17.4) — patch 6.17.3.1 / 6.17.4.1 (no ITW claim in sources; inventory only)

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
Plugin WooCommerce Wholesale Lead Capture ≤2.0.3.1 — CVE-2026-27540	Vulnerable WP plugin	T1190	WP admin Plugins / CMDB / wp plugin list	Upgrade to ≥2.0.3.2 or disable/remove plugin; enable WAF rule for this CVE
HTTP POST /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler + file_settings containing php	Exploit request	T1190 / T1505.003	Web access log (nginx/apache/WAF)	Alert any hit; block source IP; preserve request body / multipart filename
Uploaded file name shell.php (or other .php) under wp-content/uploads/ / wwlc-temp-*	Webshell drop	T1505.003	File integrity / EDR file create / host FS	Hunt unexpected .php in uploads; delete webshells; rotate WP admin + DB creds; restore from clean backup if compromised
Source IPs 92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209	Attacker infrastructure	T1190	Firewall / WAF / web logs	Temporary blocklist; hunt historical wwlc_file_upload_handler from these IPs

Detection

Source	Rule	Gap
Splunk ESCU	None — verified search for CVE-2026-27540 / wwlc_file_upload_handler / Wholesale Lead Capture	ESCU WordPress Bricks Builder plugin RCE matches only */wp-json/bricks/v1/render_element POST — wrong path; would not catch admin-ajax.php?action=wwlc_file_upload_handler
Elastic	None — verified search for WWLC / wwlc_file_upload_handler	PHP File Creation in WordPress Plugin Directory requires file.path like~ "*/wp-content/plugins/*" — misses WWLC drops under wp-content/uploads/ / wwlc-temp-*
Sigma	None — verified search for CVE-2026-27540 / wwlc_file_upload_handler	Windows Webshell Strings is GET access-log recon keywords (=whoami, etc.) — misses unauth multipart upload; may only catch later webshell use

Hunt hint: (1) Inventory sites with WWLC; force ≥2.0.3.2. (2) Web logs: admin-ajax.php + wwlc_file_upload_handler (+ file_settings containing php). (3) FS: find wp-content/uploads -name '*.php' -mtime -90. (4) Block listed IPs; remove unknown WP admins.

Sources: Wordfence, The Hacker News, BleepingComputer, CVE-2026-27540

---

2. Parallels Desktop ParaShells LPE — CVE-2026-90894

TL;DR: JFrog 2026-09-15 (CVE published 2026-09-14): local unprivileged user → root on Mac via Parallels Desktop prl_disp_service. Chain: world-writable Unix socket /var/run/prl_disp_service.socket (mode 0777) → unsigned PrlSrv_LoginLocal → PrlSrv_InstallAppliance quote-break in sVmParentPath injects macOS tar --use-compress-program= → attacker script as uid 0. Verified on 26.4.0 (build 57513) arm64. Upgrade to ≥27.0.0 (JFrog validates 27.0.1 extract argv fix). No public ITW claim.

What’s New:

• Extract template tar -xf "%1" -C "%2" split by Qt QProcess::splitCommand — embedded " in parent path turns leftover text into extra argv
• Lab parent shape: /tmp/sprl_p_505" --use-compress-program=/tmp/u505 " → root runs /tmp/u505; PoC writes marker with UCP_UID=0 and may drop /etc/sudoers.d/prl-rce-*
• Fix shipped 2026-09-01 in Desktop 27.0.0; CVE ID 2026-09-14; blog 2026-09-15; X amplify 2026-09-16 (@JFrogSecurity)

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
Parallels Desktop 26.4.0 (build 57513) and any 26.x without fixed extract — CVE-2026-90894	Vulnerable Mac app	T1068	Jamf/Intune inventory / defaults read "/Applications/Parallels Desktop.app/Contents/Info" CFBundleShortVersionString + CFBundleVersion	Upgrade fleet to ≥27.0.0 (prefer 27.0.1+); restrict local interactive logins until patched
Unix socket /var/run/prl_disp_service.socket mode srwxrwxrwx (0777)	Privileged IPC exposure	T1068 / T1548	macOS host FS / MDM compliance script (ls -l /var/run/prl_disp_service.socket)	Flag exposed hosts; correlate with Desktop version < 27
Process tar as root with argv containing --use-compress-program= parented by prl_disp_service	Exploit execution	T1068 / T1059	EDR process create (macOS) / Unified logs	Alert prl_disp_service → tar + --use-compress-program; capture full argv + script path
Files /tmp/u* compress-program scripts; /etc/sudoers.d/prl-rce-*; marker with UCP_UID=0	Post-exploit persistence	T1548.003 / T1059	FIM / EDR file events	Hunt sudoers.d prl-rce-*; remove; rotate local creds if root confirmed

Detection

Source	Rule	Gap
Splunk ESCU	None — verified search for CVE-2026-90894 / Parallels / prl_disp_service / --use-compress-program	No macOS Parallels / appliance-extract analytic story
Elastic	None — verified search for prl_disp_service / ParaShells / --use-compress-program	Generic macOS privilege-escalation rules (admin group adds) do not match tar argv injection via InstallAppliance
Sigma	None — verified search for Parallels / prl_disp / --use-compress-program on macOS	Compressed File Creation Via Tar.EXE is Windows tar.exe create (-c/-r/-u) — wrong OS and wrong tar mode vs macOS extract + --use-compress-program

Hunt hint: Inventory Macs with Parallels; force ≥27.0.0. Script: check CFBundleShortVersionString + socket mode 0777. EDR: prl_disp_service spawning tar with --use-compress-program. FIM: /etc/sudoers.d/prl-rce-*.

Sources: JFrog ParaShells, JFrog research advisory, CVE-2026-90894, Parallels Desktop 27 notes

---

3. Marimo /terminal/ws RCE → AWS Bastion in 8s — CVE-2026-39987

TL;DR: Sysdig TRT (THN 2026-09-15 amplify): skilled human operator abused pre-auth CVE-2026-39987 on marimo ≤0.20.4 — unauthenticated WebSocket /terminal/ws → PTY shell → harvest AWS keys → secretsmanager:GetSecretValue → write /tmp/bastion_key → SSH bastion in 8 seconds. Fix ≥0.23.0 (already on CISA KEV since 2026-04-23). Source 172.236.12.17; C2 45.79.187.72:4444 (both AS63949 Linode).

What’s New:

• Chain fingerprint: WebSocket open → Redis/env credential → CloudTrail GetSecretValue (multi-region fallback us-east-1→us-west-2→eu-west-1→ap-southeast-1→us-east-2) → SSH with key mode 0600 at /tmp/bastion_key
• Failed EC2 Instance Connect automation: denied DescribeInstances/DescribeKeyPairs then ec2:SendSSHPublicKey against placeholder instance i-0000000000000000
• Drop pattern: echo '<b64>' | base64 -d > /tmp/*.py then nohup python3 /tmp/*.py (chain.py / full_chain.py); reverse shell to 45.79.187.72:4444
• Operator avoided Sysdig prompt-injection bait that caught prior LLM-driven attackers against same CVE

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
marimo < 0.23.0 (≤0.20.4 affected) — CVE-2026-39987	Vulnerable notebook app	T1190	SBOM / container image tag / pip show marimo	Upgrade to ≥0.23.0; do not expose notebooks to the internet; disable terminal or auth-gate /terminal/ws at reverse proxy
WebSocket connect to /terminal/ws (no auth) from 172.236.12.17	Initial access	T1190 / T1059	Reverse proxy / load balancer / app access logs	Alert unauthenticated /terminal/ws; block IP; assume shell as marimo UID
CloudTrail secretsmanager:GetSecretValue (region-fallback burst) then SSH key file /tmp/bastion_key mode 0600	Credential pivot	T1552 / T1078	AWS CloudTrail / container FS / EDR	Alert first-time / unusual GetSecretValue from notebook roles; hunt /tmp/bastion_key, /tmp/chain.py, /tmp/full_chain.py
ec2:SendSSHPublicKey targeting i-0000000000000000 after denied EC2 describe APIs	Operator fingerprint	T1098.004	AWS CloudTrail	High-fidelity alert on SendSSHPublicKey to null/placeholder instance ID
Outbound TCP to 45.79.187.72:4444 (nc/asyncssh listener)	C2 egress	T1571 / T1105	VPC Flow / firewall / container egress	Block IP:port; alert notebook egress to non-approved ports (4444/1337/1234/…)

Detection

Source	Rule	Gap
Splunk ESCU	None — verified search for CVE-2026-39987 / marimo / /terminal/ws / GetSecretValue	No ESCU analytic matching marimo WebSocket terminal or Secrets Manager GetSecretValue chain
Elastic	Partial — First Time Seen AWS Secret Value Accessed in Secrets Manager (event.action: GetSecretValue)	Would catch first-time successful GetSecretValue for a principal — aspect of post-exploit. AWS Secrets Manager Rapid Secrets Retrieval needs ≥20 unique secrets — would miss this operator’s few targeted retrieves. No rule for /terminal/ws or i-0000000000000000
Sigma	None — verified search for marimo / /terminal/ws / bastion_key / SendSSHPublicKey placeholder	No emerging-threat rule for this CVE path

Hunt hint: (1) Patch/remove internet-facing marimo <0.23.0. (2) Proxy logs: /terminal/ws. (3) CloudTrail: notebook IAM → GetSecretValue + region retries; SendSSHPublicKey → i-0000000000000000. (4) Host: /tmp/bastion_key, /tmp/chain.py, base64 -d > /tmp/*.py. (5) Block 172.236.12.17 / 45.79.187.72. Rotate any secrets ever present on exposed notebook hosts.

Sources: Sysdig, The Hacker News, GHSA-2679-6mx9-h9xc, CVE-2026-39987

---

Status Updates

• CVE-2026-76461 (Cisco ESA AsyncOS): CISA KEV due TOMORROW 2026-09-17 — patch 15.5.5-014 / 16.0.4-302 / 16.5.0-780; grep -i "COPY.*TO PROGRAM" on mail_logs; Snort 67109/67110; BOD forensic triage Yes. Sep 15
• CVE-2026-58704 (Pixel Cellular Modem): Google Sep bulletin — limited targeted ITW; escalate to patch level 2026-09-05+ via MDM/Intune for managed Pixels. THN · BC
• CVE-2026-85706 (GitLab) / CVE-2026-84869 (ScreenConnect) / PaperCut CVE-2026-81578/82078: KEV due was 2026-09-14 — confirm remediation. Sep 12 · Sep 14
• MikroTrick CVE-2026-67277/86060: KEV due was 2026-09-13 — confirm RouterOS fixed trains. Sep 6 · Sep 13
• Check Point CVE-2026-85102/85103: Dutch NCSC still imminent — LivePatch Take 24 / Jumbo trains. Sep 11
• CVE-2026-42016/42018 (JFrog): KEV due 2026-09-25 — continue POST /access/api/v1/aws/token/ + token:anonymous hunts. Sep 12
• Chrome CVE-2026-85046 (due Sep 18) / Windows CVE-2026-81963+85880 (due Sep 22) / Chrome CVE-2026-87491 (due Sep 23) + GRIMWEDGE: Keep prior C2/file hunts (cloud.shinewrist.net, ocr.opusaccel.top, 206.166.251.164, %TEMP%\msgbox.exe, task Windows Scheduled System). Sep 11 · Sep 9 · Sep 15
• CVE-2026-51990 / GRAYRABBIT + Storm-3121 Passkey + SGLang CVE-2026-86793: No material change — keep prior hunts. Sep 14 · Sep 13