Cyber Threat Brief — September 24 2026
1. WordPress get_page_template LFI → pearcmd RCE — CVE-2026-87902 (ITW)
TL;DR: WordPress GHSA-7hp8-65ch-5whp + Patchstack/Previdian/THN (2026-09-22…24): CVE-2026-87902 (CVSS 9.2) unauth path traversal in get_page_template() (wp-includes/template.php) → LFI of readable local .php; with page-templates/ theme dir + pearcmd.php + register_argc_argv=On → arbitrary PHP write (RCE). Patched 7.1.2 (backports to 4.7.37). ITW since 2026-09-22 11:49 UTC; stage-3 file writes + Nuclei/cve-2026-87902-poc UA in circulation.
What’s New:
- Escalated from Sep 23 X-only mention → confirmed mass probing + pearcmd
+config-createwrites (Patchstack 10× volume; Previdian honeypots) - Preconditions: active theme top-level dir starting
page-(Twenty Twelve/Fourteen, Neve, Hestia, Sydney); PEAR path present; argv On (official PHP Docker + cPanel PHP <8.5) - Distinct from Comment2Shell CVE-2026-93485 (covered Sep 22)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-87902 on WordPress Core 4.7.0–7.1.1 (fix: 7.1.2 / 7.0.6 / 6.9.9 / 6.8.10 … back to 4.7.37) | Vulnerable CMS / ITW | T1190 | WP version / hosting inventory | Upgrade every branch to patched release; confirm auto-update landed; treat pre-patch exposure as hunt window |
HTTP pagename with %252e%252e / %2e%2e or leading templates%2f / templates%252f, paired with page_id= on / or /index.php (GET or POST) | Exploit probe | T1190 | Access / WAF / CDN | Alert+block traversal in pagename; hunt historical OPML/RSS body on normal page URLs (stage-1 success) |
Include targets /usr/local/lib/php/pearcmd.php, /usr/share/php/pearcmd.php, /usr/share/pear/pearcmd.php with query +config-show or +config-create | RCE chain | T1190 / T1059 | Access logs | Treat pearcmd argv abuse as confirmed RCE attempt; disable register_argc_argv as stopgap (does not fix LFI) |
Drops under /tmp / /var/tmp: wp-pear-rce-flag.php, poc87902.php, luci_.php, zeta_.php; UAs cve-2026-87902-poc/1.0, nuclei-cve-2026-87902/1.0; sources incl. 104.194.9.227, 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87, 45.61.184.170, 92.246.130.76; follow-on include raw.githubusercontent.com/MrG3P5/web-shell/refs/heads/main/uploader.php | Post-exploit IoC | T1505.003 / T1105 | FIM / host / access | If any drop present: treat host compromised; rotate WP/DB/SSH secrets; rebuild from trusted backup |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search. Rejected WordPress Bricks Builder plugin RCE (Web.url=*/wp-json/bricks/v1/render_element* POST) — CVE-2024-25600 Bricks path, not pagename LFI | No CVE-2026-87902 / pearcmd analytic |
| Elastic | None — verified search. Rejected PHP File Creation in WordPress Plugin Directory (writes under wp-content/plugins) and Unusual File Creation via Web Server (webroot paths only) — stage-3 drops land in /tmp//var/tmp, outside both path sets | Misses HTTP pagename exploit + /tmp pearcmd writes |
| Sigma | None — verified search. Rejected Path Traversal Exploitation Attempts (requires etc/windows literals) and WordPress Wp2shell Exploitation Tool User-Agent (CVE-2026-63030 UA wp2shell) | No emerging-threat rule for CVE-2026-87902 |
Hunt hint: (1) Patch to ≥7.1.2 (or branch backport). (2) Grep access logs for pagename + %252e%252e / pearcmd / +config-create. (3) FIM /tmp//var/tmp for listed .php. (4) Themes with page-* dirs + register_argc_argv = prioritize.
Sources: WordPress GHSA-7hp8-65ch-5whp, Patchstack ITW update, Patchstack advisory, The Hacker News, SecurityWeek
2. JetBrains TeamCity Agent-Polling RCE — CVE-2026-63077 (CISA ransomware Known)
TL;DR: CISA (2026-09-24 / BC): CVE-2026-63077 (TeamCity On-Prem unauth RCE via agent polling protocol) now flagged knownRansomwareCampaignUse: Known on KEV (added 2026-08-05, due was 2026-08-08, forensic triage Yes). Fixed 2025.11.7 / 2026.1.3 (+ security patch plugin). Shadowserver ~160 still-exposed hosts. JetBrains IoCs: ConversionException / ForbiddenClassException; unauthorized agents named scan*.
What’s New:
- Material KEV field flip to ransomware Known (no named family public); first coverage in this brief series
- Exploit surface: unauth HTTP(S) → agent polling → OS commands as TeamCity service account → creds/builds/CI integrity
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-63077 on TeamCity On-Prem <2025.11.7 / <2026.1.3 (Cloud already mitigated) | Vulnerable CI / KEV ransomware | T1190 / T1059 | TeamCity version inventory | Upgrade to ≥2025.11.7 or ≥2026.1.3; else install JetBrains security patch plugin (2017.1+); restrict internet exposure |
TeamCity server log: com.thoughtworks.xstream.converters.ConversionException (pre-patch) or com.thoughtworks.xstream.security.ForbiddenClassException (post-patch block) | Exploit attempt IoC | T1190 | TeamCity server logs | Investigate matching timestamps; assume possible compromise if ConversionException on unpatched window |
Unauthorized build agents with names beginning scan | Recon/exploit artifact | T1098 / T1078 | TeamCity Agents UI / API | Remove unexpected scan* agents; correlate agent first-seen vs log timestamps (UI date ≠ exploit time) |
Unexpected TeamCity java.exe → cmd.exe/powershell.exe/curl.exe/certutil.exe etc.; java -classpath under C:\Windows\TEMP\~spawn*.tmp.dir with .Payload | Post-exploit | T1059 / T1105 | EDR / Sysmon | Hunt child processes from TeamCity JRE; rotate VCS/cloud/signing secrets; rebuild from trusted state if IoCs hit |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows TeamCity Payload Execution from Temp Directory (-classpath + :\Windows\TEMP\~spawn + .Payload + TeamCity) may catch Metasploit-style post-exploit only. Rejected JetBrains TeamCity RCE Attempt (*/app/rest/users/id:1/tokens/RPC2*) — CVE-2023-42793; rejected … Authentication Bypass CVE-2024-27198 (*?jsp=* / ;jsp) — different auth-bypass class | No agent-polling / XStream analytic for CVE-2026-63077 |
| Elastic | Partial — Suspicious JetBrains TeamCity Child Process (TeamCity java.exe spawning cmd.exe/powershell.exe/curl.exe/…) — post-exploit only | Misses unauth agent-polling HTTP stage + log string IoCs |
| Sigma | None — verified search. Diamond-Sleet / Onyx-Sleet TeamCity ET rules are 2023 APT IoC sets — not CVE-2026-63077 | No emerging-threat rule for this CVE |
Hunt hint: (1) Confirm version ≥ fixed trains or plugin present. (2) Grep logs for both XStream exception strings. (3) Purge unauthorized scan* agents. (4) Rotate CI secrets if ConversionException on vulnerable builds; ransomware flag → prioritize internet-facing On-Prem.
Sources: BleepingComputer, CISA KEV entry CVE-2026-63077, JetBrains exploitation guidance, JetBrains original advisory
3. Ubuntu AF_UNIX GC UAF Container Escape — CVE-2026-80521 (public PoC)
TL;DR: DepthFirst + THN (2026-09-22/23): CVE-2026-80521 (CVSS 7.8) Linux AF_UNIX garbage-collector UAF (unix_del_edge / scc_entry) → container escape to host root via ordinary sockets/SCM_RIGHTS (allowed by default Docker/K8s seccomp). Upstream fixed 2026-08-06 (e.g. 7.1.10 / 7.2; commit 594d905). Ubuntu 26.04 / 24.04 (and many cloud/HWE kernels) still Vulnerable / WIP per tracker (updated 2026-09-24). Public escape PoC for 26.04; related CVE-2026-52910 PoC for 24.04. No confirmed ITW / not on KEV.
What’s New:
- Sep 23 amplify: working public exploit while distro lag continues (tracker still WIP as of Sep 24)
- Reachable from unprivileged container; bypasses namespaces/cgroups/seccomp by hitting shared host kernel
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
CVE-2026-80521 on Ubuntu linux 26.04 (resolute) / 24.04 (noble) Vulnerable; also linux-aws/azure/gcp/gke + linux-hwe-6.8/6.17/7.0 trains per ubuntu.com/security/CVE-2026-80521; 22.04 jammy linux Not affected (check HWE/cloud packages individually) | Vulnerable kernel | T1611 / T1068 | uname -r / package inventory | Inventory multi-tenant/container hosts; watch Canonical for security pocket; apply upstream 594d905 class fix when packaged; prefer microVM (Firecracker/Kata) for untrusted workloads until patched |
Public PoC repo github.com/Markakd/Container_escape (CVE-2026-80521 + CVE-2026-52910 for 24.04) | Exploit kit | T1611 | Threat intel / EDR | Do not run on prod; use only in authorized lab; hunt for unexpected host-ns / privileged procs spawned from container UIDs |
Concurrent sendmsg/SCM_RIGHTS FD-passing storms + sudden container→host capability (new host mounts, host PID visibility) | Exploit behavior | T1611 | auditd / eBPF / runtime security | Baseline AF_UNIX FD-pass rates on shared nodes; alert container breakout signals (nsenter to host, hostPath abuse) as complementary controls — not CVE-specific |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-80521 / AF_UNIX GC / unix_del_edge | No kernel UAF / AF_UNIX escape analytic |
| Elastic | None — verified search. Rejected Potential Container Escape via Modified release_agent File / notify_on_release / nsenter / privileged mount rules — cgroup/nsenter techniques, not AF_UNIX GC UAF | No AF_UNIX SCC UAF rule |
| Sigma | None — verified search | No emerging-threat rule for CVE-2026-80521 |
Hunt hint: (1) Map Ubuntu 24.04/26.04 + cloud kernel packages on shared K8s/Docker nodes. (2) Until Canonical ships: isolate untrusted pods on microVMs or dedicated nodes. (3) Watch for container processes gaining host visibility. (4) No ITW yet — treat as high PoC risk, not mass exploit day.
Sources: The Hacker News, DepthFirst research, Ubuntu CVE tracker, PoC Container_escape
Status Updates
- CVE-2026-7273 (Zyxel GS1900): KEV due TODAY 2026-09-24 (forensic triage Yes) — finish 2.90(*.2)C0 + Kapibala IoC hunt (
172.245.247.21/74.48.66.73/104.225.153.141/*.981666.xyz/ accountskapibala). Sep 22 - CVE-2026-94127 (F5 BIG-IP APM) / CVE-2026-93616 (Check Point Management) / CVE-2026-93952 (Arista VeloCloud) / CVE-2026-85102 (Check Point VPN/Spark): KEV due 2026-09-25, forensic triage Yes — Eng HF / Jumbo Takes / VCO ≥5.2.3.16|≥6.4.2.8 / sk1000117; hunt APM UserInfo triad,
cpm.elggreps,vc-sysmondMD5dc78e206eaeadec59fc5801fe4556bd0. Sep 23 · Sep 11 VPN - CVE-2026-42016/CVE-2026-42018 (JFrog): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - Chrome CVE-2026-87491: KEV due was 2026-09-23 — confirm Chromium ≥153.0.8010.36; keep UTA0565/CLEANGULP BlueMoon hunts. Sep 09 · Sep 11 · Sep 23
- Windows CVE-2026-81963 + CVE-2026-85880: KEV due was 2026-09-22 — confirm Sep 2026 LCU. Sep 09
- CVE-2026-32996 (Veeam) / CVE-2026-93485 (Comment2Shell): No material change — Agent 13.0.3.1220 + WP ≥7.1.1 (note: 87902 needs ≥7.1.2). Sep 22
- ChainScript / Jade Sleet / npm indexed-btree / WaterPlum / Discourse 32882 / Orkes 58138 / Brevo ClickFix / CP SMS 91843: No material change — keep prior hunts. Sep 21 · Sep 20 · Sep 19 · Sep 18