Cyber Threat Brief — September 18 2026
1. Brevo Supply-Chain ClickFix via Cloudflare Worker — ITW
TL;DR: Brevo (Sendinblue) post-mortem 2026-09-17 + Sansec/BC/SecurityWeek: attackers used a stolen long-lived Cloudflare API key hardcoded in Brevo source to deploy a Cloudflare Worker that rewrote CDN responses for ~5.5h on 2026-09-14 (~15:01–20:30 UTC per Brevo; Sansec ~16:05–20:13 UTC). Injected ClickFix fake-Cloudflare captchas into brevo.com / sibforms.com and customer-embedded SDK/forms/Conversations JS; on WordPress admin visits also attempted silent plugin install from https://cdn10.sendibt1.com/p/wm.zip (“Web Media Optimizer” backdoor). Edge injection only — origins clean; Worker removed; loaders NXDOMAIN since 2026-09-15.
What’s New:
- Confirmed ITW supply-chain via Brevo-owned
sendibt1.comCDN subdomains (cdn/cdn2/cdn3/cdn4/cdn9/cdn10/cdn11) serving/f.js; KongTuke/ClickFix family (Win+R → paste → malware) - WordPress path: admin session → upload/activate plugin; BC recovered
wm.zipas persistent JS loader + admin session forge key; C2 patterns includeglegchner.com/ads.php→corralos.beer - Root cause: full-privilege Cloudflare API key in source; Worker stripped CSP; integrity checks on origin missed edge rewrite
- Scope: Sansec estimates 100k+ sites embedding Brevo widgets/forms; app.brevo.com / API / mail pipeline not modified at source
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
DNS/HTTP to cdn.sendibt1.com / cdn2.sendibt1.com / cdn3.sendibt1.com / cdn4.sendibt1.com / cdn9.sendibt1.com / cdn10.sendibt1.com / cdn11.sendibt1.com path /f.js (or /p/wm.zip) during 2026-09-14 15:00–21:00 UTC | Supply-chain loader / plugin drop | T1195.002 / T1189 | Proxy / DNS / CDN / web access logs | Alert historical hits; do not block apex sendibt1.com (legit Brevo tracking) — only cdn* loader labels; purge caches; re-fetch clean cdn.brevo.com/js/sdk-loader.js |
WordPress POST /wp-admin/update.php?action=upload-plugin then GET /wp-admin/plugins.php?action=activate on 2026-09-14 on sites embedding Brevo/Sibforms | Silent admin plugin install | T1505.003 / T1204.001 | WordPress / WAF / web server access logs | Hunt that day; remove unknown plugins (incl. hidden must-use); rotate WP admin passwords; compare disk plugin dir vs UI list |
ParentImage ends with \\explorer.exe → child powershell.exe/cmd.exe/mshta.exe with ClickFix lure strings (captcha/verify/Cloudflare/not a robot) or RunMRU HTTP one-liner | ClickFix user execution | T1204.001 / T1059 | Sysmon 1 / EDR / RunMRU registry | Hunt explorer→shell after Win+R paste; isolate host; full AV + credential reset if user ran pasted command |
Hosts / URLs: yelahaye.surf, boiseno.club, glegchner.com, corralos.beer, systask3820.com (and sibling two-word+digits .com /b?t= downloaders) | Malware staging / ClickFix C2 | T1105 / T1071 | Proxy / DNS / EDR network | Block/hunt; treat any successful Win+R paste on 2026-09-14 as host compromise |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows PowerShell FakeCAPTCHA Clipboard Execution (hidden -w h + captcha/verify or iwr+iex patterns); Windows RunMRU Command Execution (Run dialog RunMRU writes) — analytic story Fake CAPTCHA Campaigns | Neither names Brevo/sendibt1/wm.zip; pure mshta Win+R without captcha tokens may miss PS rule; RunMRU is anomaly-only (needs HTTP/suspicious value hunt) |
| Elastic | Partial — Potential Fake CAPTCHA Phishing Attack (parent explorer.exe + powershell/cmd/mshta + captcha/Cloudflare verification CLI tokens) | Potential Execution via FileFix Phishing Attack targets Chromium file-picker FileFix args — would not catch classic Win+R ClickFix; no Brevo/sendibt1 domain rule |
| Sigma | Partial — Potential ClickFix Execution Pattern - Registry (RunMRU + http(s) + captcha/LOLBin tokens); Suspicious ClickFix/FileFix Execution Pattern (parent explorer.exe + # + captcha tokens) | No Brevo/sendibt1.com emerging-threat rule; whitespace-padding FileFix variants are adjacent only |
Hunt hint: (1) Proxy/DNS: any cdn*.sendibt1.com to /f.js or /p/wm.zip on 2026-09-14. (2) WP sites with Brevo widgets: plugins installed/activated that day; must-use dir; rotate admins. (3) EDR: explorer→powershell/cmd/mshta with captcha/Cloudflare lure or RunMRU containing http(s). (4) Users who pasted Win+R commands: treat as infected; rotate Brevo + local creds.
Sources: Brevo ClickFix post-mortem, Sansec, BleepingComputer, SecurityWeek, ADAMnetworks KongTuke analysis
2. Check Point Security Management Unauth Root RCE — CVE-2026-91843
TL;DR: Check Point CheckMates/sk1000155 (2026-09-16) + THN/SecurityAffairs (2026-09-17/18): CVE-2026-91843 (CVSS 9.8) — pre-auth stack overflow in login on Security Management / Log / Multi-Domain / standalone servers; unauthenticated attacker who can reach the management login path (via Trusted Clients) can get root RCE. Trigger: oversized username in login request (Censys). No ITW claimed; no public PoC as of Sep 16. Fix: LivePatch per sk1000155 (auto-update customers may already have it — verify with cplp list). Harden: Trusted Clients = known admin IPs only (not Any); do not expose management to the Internet.
What’s New:
- Affected trains (Jumbo Hotfix Take or older): R82.10 ≤ Take 44; R82 ≤ Take 126; R81.20 ≤ Take 166; R81.10 ≤ Take 190 + EOS R81/R80.x; R82.20 also vulnerable (vendor confirmed to THN; every build until Jumbo exists)
- Smart-1 Cloud: NHS England notes hosted service already patched; on-prem must act
- Fifth critical unauth management flaw since Jul 2026; prior CVE-2026-16232 was ITW — treat exposure seriously even without current exploitation claim
- Censys: ~3,836 hosts presenting default SIC management/log-server identity (role presence, not confirmed-vulnerable count)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Check Point Security Management / Log / MDS / standalone on vulnerable Jumbo Takes — CVE-2026-91843 | Vulnerable management plane | T1190 / T1068 | Asset inventory / fw ver / Jumbo Take | Apply sk1000155 LivePatch immediately; confirm with cplp list for fwm:fwm / CVE reference; EOS trains: open Check Point support ticket for out-of-support fix |
| Trusted Clients set to Any / management portal reachable from Internet — CVE-2026-91843 path | Exposure precondition | T1190 | SmartConsole Manage & Settings → Permissions & Administrators → Trusted Clients; external scan | Restrict Trusted Clients to named admin IPs only; require VPN for remote admin; remove Internet exposure of CPM/FWM |
| Oversized / anomalous unauth login username to Check Point management HTTPS/SIC from non-admin nets | Exploit attempt behavior | T1190 | Management audit / reverse proxy / firewall logs to CPM | Hunt pre-auth login anomalies; correlate with post-login root shell / unexpected fwm child processes if EDR on SMS |
| Censys/Internet-facing SIC identity on management role | Attack surface | T1190 | ASM / attack-surface inventory | Prioritize Internet-exposed SMS/Log servers for LivePatch + Trusted Clients lockdown today |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-91843 / Check Point Security Management / fwm login stack overflow / sk1000155 | No Gaia/SMS pre-auth login analytic; generic VPN/firewall rules would not match management-login overflow |
| Elastic | None — verified search for Check Point SMS / CVE-2026-91843 / Trusted Clients | No Quantum Security Management login RCE rule |
| Sigma | None — verified search for CVE-2026-91843 / Check Point management stack overflow | No emerging-threat rule for this login path |
Hunt hint: (1) Inventory all SMS/Log/MDS/standalone; run cplp list and apply sk1000155. (2) Enforce Trusted Clients allowlist; block WAN to management ports. (3) Review management audit for failed/odd pre-auth logins around disclosure. (4) If compromise suspected: rebuild SMS from known-good; rotate SIC/admin credentials; re-push policy from clean manager.
Sources: Check Point sk1000155, The Hacker News, SecurityAffairs, NVD CVE-2026-91843
3. Unbound DNSSEC Validator Heap Overflow RCE — CVE-2026-81642
TL;DR: NLnet Labs (2026-09-16) + THN (2026-09-17): CVE-2026-81642 (Critical) in Unbound ≤ 1.26.0 DNSSEC validator — DNSKEY whose owner is a compression pointer into its own RDATA overflows the digest buffer; attacker who controls a malicious zone and is queried by the resolver can cause DoS and possible RCE. Fixed in Unbound 1.26.1 (same-day release; also patches CVE-2026-82717 CNAME-synthesis heap corruption and seven other flaws). No ITW; CISA exploitation = none. Upgrade or apply official source patches.
What’s New:
- Affects every release through 1.26.0, including prior security releases 1.25.2 and 1.26.0 — May’s CVE-2026-33278 fix does not cover this
- Exploit condition: malicious authoritative zone + client/resolver query path into validator digest of DNSKEY
- Debian tracker (THN): 1.26.1-1 in unstable; bookworm/trixie/forky still listed vulnerable at disclosure — verify distro packages
- Batch also changes default:
val-clean-additionalnow off (ReTrap mitigations)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Unbound version ≤ 1.26.0 — CVE-2026-81642 (and paired CVE-2026-82717) | Vulnerable recursive resolver | T1203 / T1499 | Package inventory (unbound -V) / config management | Upgrade to 1.26.1 everywhere; or patch -p1 with NLnet patch_CVE-2026-81642_with.diff / combined 1.26.1 patch then rebuild |
| Recursive Unbound with DNSSEC validation enabled serving clients / forwarders | High-value resolver exposure | T1203 | DNS architecture inventory | Prioritize Internet-facing and corp recursive resolvers; validate post-upgrade with unbound-checkconf + resolver self-tests |
| Sudden Unbound worker crashes / coredumps while resolving odd DNSKEY owner names | Possible exploit / DoS attempt | T1499 / T1203 | syslog / systemd journal / crash dumps on resolver hosts | Hunt crash spikes after 2026-09-16; capture PCAPs of triggering queries; isolate resolver if repeated |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-81642 / Unbound DNSSEC DNSKEY heap overflow | No Unbound-specific analytic; Windows DNS SIGRed story is wrong product |
| Elastic | None — verified search for Unbound / CVE-2026-81642 | No recursive-resolver DNSKEY overflow rule |
| Sigma | None — verified search for Unbound DNSSEC CVE-2026-81642 | No emerging-threat rule for this validator path |
Hunt hint: (1) unbound -V / package facts across fleet — force ≥1.26.1. (2) Watch resolver hosts for crash loops post-disclosure. (3) If you cannot patch immediately, restrict which clients may use the resolver and monitor authoritative responses with unusual DNSKEY compression. (4) Re-validate DNSSEC-serving containers/K8s sidecars — often forgotten on old 1.25.x images.
Sources: NLnet Labs CVE-2026-81642, Unbound security advisories, The Hacker News, Unbound 1.26.1 download
Status Updates
- CVE-2026-85046 (Chrome V8 type confusion): CISA KEV due TODAY 2026-09-18 — confirm Chrome/Edge/Chromium ≥152.0.7977.82 (Win/Mac .82/.83; Linux .82); keep BlueMoon/GRIMWEDGE hunts (
cloud.shinewrist.net,ocr.opusaccel.top,206.166.251.164,%TEMP%\\msgbox.exe, task Windows Scheduled System). Original brief · Sep 11 · Sep 15 - CVE-2026-76460 (Cisco ISE) / CVE-2026-87886 (Acronis Backup) / CVE-2026-58704 (Pixel): KEV due 2026-09-19 (forensic triage Yes) — finish ISE patches +
dummyuserise-kong hunt; Acronis builds ≥1.9.3.1021 / ≥1.8.11.638; Pixel patch level 2026-09-05+. Sep 17 · Sep 16 - CVE-2026-76461 (Cisco ESA): KEV due was 2026-09-17 — confirm AsyncOS fixed trains + forensic triage complete; keep
COPY.*TO PROGRAMmail_logs + Snort 67109/67110. Sep 15 - CVE-2026-42016/CVE-2026-42018 (JFrog Artifactory): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - Windows CVE-2026-81963 + CVE-2026-85880: KEV due 2026-09-22 — keep ALPC/Update Stack LPE hunts from Sep 9 rewrite. Sep 9
- Chrome CVE-2026-87491: KEV due 2026-09-23 — Chromium ≥153.0.8010.36 class trains. Sep 10
- CVE-2026-27540 (WWLC) / CVE-2026-90894 (Parallels ParaShells) / CVE-2026-39987 (Marimo): No material change — keep prior hunts (
wwlc_file_upload_handler,prl_disp_service→tar --use-compress-program,/terminal/ws+GetSecretValue). Sep 16 - CVE-2026-51990 / GRAYRABBIT + Storm-3121 Passkey + SGLang CVE-2026-86793: No material change — keep prior hunts. Sep 14 · Sep 13
- CVE-2026-85706 (GitLab) / CVE-2026-84869 (ScreenConnect) / PaperCut CVE-2026-81578/CVE-2026-82078 / MikroTrick CVE-2026-67277/CVE-2026-86060: Post-KEV-deadline — confirm remediation. Sep 12 · Sep 14 · Sep 6 · Sep 13
- Check Point VPN CVE-2026-85102/CVE-2026-85103: Dutch NCSC still imminent — distinct from today’s CVE-2026-91843 management LivePatch; keep VPN Jumbo/LivePatch trains. Sep 11