Category: News

Alby, the company behind the Bitcoin Lightning Network and Nostr tooling suite Alby Hub, has disclosed a critical vulnerability affecting older versions of its self-hosted Lightning wallet that could let an attacker take over and drain funds from any instance left reachable from the public internet.

Unauthenticated Access to the Management API

In a disclosure posted September 9, 2026, Alby said it had confirmed a critical flaw in Alby Hub versions 1.7.0 through 1.18.5, released before August 2025, when the Hub is publicly accessible from the internet. According to the company, an attacker who can reach the Hub’s management API over the network can access it without authorization and send funds out of the wallet, effectively draining any exposed node. Alby urged affected users to immediately take internet-exposed instances offline, update to a patched version, and change their unlock password after updating, since the credential itself could have been exposed during the window the Hub was reachable.

Part of a Rough Stretch for Lightning-Adjacent Projects

The disclosure follows a difficult few weeks for Lightning Network-adjacent infrastructure: Boltz, a separate non-custodial bridge that moves bitcoin between the main chain, the Lightning Network and the Liquid Network, took its swap functionality offline on August 3, 2026, after its own security issue, and Bitcoin’s Liquid Network separately suffered a $320 million theft that white-hat hackers later helped partially recover. Security researchers have pointed to the growing use of AI-assisted attack tooling as a factor putting increased pressure on smaller, self-hosted Bitcoin infrastructure projects that lack the security resources of larger custodial platforms.

A critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes (RHACM) could let a low-privileged tenant on a central hub cluster seize administrative control of any Kubernetes cluster it manages, according to Red Hat’s own advisory on the flaw.

An Unvalidated Annotation Opens the Door

Tracked as CVE-2026-72526 and carrying a CVSS score of 9.9, the flaw sits in the multicloud-integrations component that RHACM uses to propagate applications from a central hub cluster to the individual managed, or “spoke,” clusters it oversees. The Application propagation controller processes an ocm-managed-cluster annotation on an Application custom resource without properly validating it, which means a tenant who only has permission to create Applications on the hub can direct that annotation at any managed cluster of their choosing, not just their own. Doing so forces ArgoCD on the targeted spoke cluster to synchronize manifests the attacker controls, resulting in arbitrary code execution or privilege escalation on a cluster the tenant was never authorized to touch.

A Direct Route From Low Privilege to Cluster-Admin

Because the underlying authorization check is missing entirely rather than merely weak, the flaw gives a low-privileged hub tenant a direct path to cluster-admin rights on infrastructure well outside their own environment, a significant multi-tenant isolation failure for organizations running shared RHACM hubs across business units or customers. Red Hat has published fixed component versions in its advisory and accompanying Bugzilla report; organizations running RHACM are advised to apply the update and confirm that the propagation controller correctly enforces tenant-scoped cluster authorization after upgrading, alongside reviewing who currently holds Application-creation permissions on their hub clusters.

Researchers at Sophos and ESET detailed a stealthy Linux rootkit, dubbed PoisonedRefresh, discovered on compromised F5 BIG-IP Access Policy Manager (APM) appliances, Help Net Security reported. The implant hooks Apache’s PHP module loader to inject a web shell directly into memory, never writing to disk, making it difficult to detect with conventional file-based scanning.

The activity is tied to exploitation of CVE-2025-53521, a critical unauthenticated remote-code-execution flaw that F5 originally classified as a denial-of-service issue before reclassifying it. F5 has confirmed exploitation, and Shadowserver was tracking 795 internet-exposed vulnerable BIG-IP APM endpoints as of September 7, 2026. The findings were independently corroborated by BleepingComputer, SecurityAffairs and CybelAngel.

Why it matters: F5 BIG-IP APM is widely deployed by government, financial and critical-infrastructure organizations to manage secure remote access. A memory-resident rootkit that survives file-based detection on this class of device represents a significant, hard-to-spot foothold inside networks that are supposed to be tightly controlled.

Source: Help Net Security, September 9, 2026.

A security researcher known as Nightmare Eclipse released a proof-of-concept exploit dubbed ShieldCrash that bypasses Microsoft’s patch for an earlier Windows Defender privilege-escalation flaw, CVE-2026-69414 (nicknamed ShieldBreak), which had been patched only days earlier on Microsoft’s September 2026 Patch Tuesday, BleepingComputer reported. The bypass was independently corroborated by The Register and SecurityAffairs.

According to the report, the ShieldCrash proof-of-concept allows arbitrary file reads with SYSTEM-level privileges on fully patched Windows 10, 11 and Server installations.

Why it matters: Defender is the default endpoint-security product on most Windows deployments, including systems inside OT and critical-infrastructure environments. A public proof-of-concept that defeats a just-shipped patch for a SYSTEM-level flaw creates pressure for organizations to apply Microsoft’s next round of fixes quickly and to monitor for exploitation in the interim.

Source: BleepingComputer, September 9, 2026.

CISA has added CVE-2026-19490, a CVSS 9.3 authentication-bypass vulnerability in Citrix NetScaler ADC and Gateway appliances configured as a gateway or AAA virtual server, to its Known Exploited Vulnerabilities (KEV) catalog, SecurityWeek reported. Exploitation in the wild has been confirmed since at least September 3, 2026.

Citrix patched the flaw on August 19, 2026. Under Binding Operational Directive 26-04, federal civilian agencies have a three-day remediation window once a KEV entry is added. The exploitation has been independently corroborated by Rapid7, Belgium’s CCB, and security firm RedLegg.

Why it matters: NetScaler ADC and Gateway appliances sit at the network perimeter of a huge number of enterprises and government agencies, frequently providing VPN and remote-access functionality. An authentication-bypass flaw at this layer is a direct path into internal networks — including those of critical-infrastructure operators — for any attacker who has not yet patched.

Source: SecurityWeek, September 2026; CISA KEV catalog.

Two separate ransomware groups have claimed attacks on Interim HealthCare, a home-healthcare provider operating in roughly 40 U.S. states, according to The HIPAA Journal. The Genesis ransomware group listed the company on its leak site on August 10, 2026, claiming 1TB of exfiltrated data including medical records. A second group, Anubis, separately listed the company on August 21, claiming 530GB of franchise and operational data.

An Oklahoma City franchise location filed a formal breach notification with the U.S. Department of Health and Human Services on July 31, 2026.

Why it matters: Two independent ransomware groups claiming the same healthcare organization within weeks of each other raises the possibility of either separate intrusions or data being resold and reused by multiple criminal groups — either scenario underscoring how difficult it has become for healthcare providers, including smaller franchise-model operators, to fully contain a breach once patient data has left their environment.

Source: The HIPAA Journal, September 9, 2026.

Veradigm (formerly Allscripts) disclosed in an SEC filing that an attacker used stolen third-party vendor credentials to access a limited customer-service API and copy patient data, including names and Social Security numbers, BleepingComputer reported. The company said clinical records were not affected.

The ransomware group calling itself “The Gentlemen” claimed to hold 3.5 million patient records from the breach and threatened to leak the data absent a ransom negotiation.

Why it matters: The breach follows a familiar pattern for healthcare-sector incidents: the initial compromise came through third-party vendor credentials rather than a direct attack on Veradigm’s own systems, underscoring why vendor and supply-chain credential hygiene remains one of the hardest problems in healthcare data security even at companies with mature internal security programs.

Source: BleepingComputer, September 9, 2026, citing Veradigm’s SEC filing.