Category: Cyber-Physical Security

Alby, the company behind the Bitcoin Lightning Network and Nostr tooling suite Alby Hub, has disclosed a critical vulnerability affecting older versions of its self-hosted Lightning wallet that could let an attacker take over and drain funds from any instance left reachable from the public internet.

Unauthenticated Access to the Management API

In a disclosure posted September 9, 2026, Alby said it had confirmed a critical flaw in Alby Hub versions 1.7.0 through 1.18.5, released before August 2025, when the Hub is publicly accessible from the internet. According to the company, an attacker who can reach the Hub’s management API over the network can access it without authorization and send funds out of the wallet, effectively draining any exposed node. Alby urged affected users to immediately take internet-exposed instances offline, update to a patched version, and change their unlock password after updating, since the credential itself could have been exposed during the window the Hub was reachable.

Part of a Rough Stretch for Lightning-Adjacent Projects

The disclosure follows a difficult few weeks for Lightning Network-adjacent infrastructure: Boltz, a separate non-custodial bridge that moves bitcoin between the main chain, the Lightning Network and the Liquid Network, took its swap functionality offline on August 3, 2026, after its own security issue, and Bitcoin’s Liquid Network separately suffered a $320 million theft that white-hat hackers later helped partially recover. Security researchers have pointed to the growing use of AI-assisted attack tooling as a factor putting increased pressure on smaller, self-hosted Bitcoin infrastructure projects that lack the security resources of larger custodial platforms.

A critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes (RHACM) could let a low-privileged tenant on a central hub cluster seize administrative control of any Kubernetes cluster it manages, according to Red Hat’s own advisory on the flaw.

An Unvalidated Annotation Opens the Door

Tracked as CVE-2026-72526 and carrying a CVSS score of 9.9, the flaw sits in the multicloud-integrations component that RHACM uses to propagate applications from a central hub cluster to the individual managed, or “spoke,” clusters it oversees. The Application propagation controller processes an ocm-managed-cluster annotation on an Application custom resource without properly validating it, which means a tenant who only has permission to create Applications on the hub can direct that annotation at any managed cluster of their choosing, not just their own. Doing so forces ArgoCD on the targeted spoke cluster to synchronize manifests the attacker controls, resulting in arbitrary code execution or privilege escalation on a cluster the tenant was never authorized to touch.

A Direct Route From Low Privilege to Cluster-Admin

Because the underlying authorization check is missing entirely rather than merely weak, the flaw gives a low-privileged hub tenant a direct path to cluster-admin rights on infrastructure well outside their own environment, a significant multi-tenant isolation failure for organizations running shared RHACM hubs across business units or customers. Red Hat has published fixed component versions in its advisory and accompanying Bugzilla report; organizations running RHACM are advised to apply the update and confirm that the propagation controller correctly enforces tenant-scoped cluster authorization after upgrading, alongside reviewing who currently holds Application-creation permissions on their hub clusters.

Researchers at Sophos and ESET detailed a stealthy Linux rootkit, dubbed PoisonedRefresh, discovered on compromised F5 BIG-IP Access Policy Manager (APM) appliances, Help Net Security reported. The implant hooks Apache’s PHP module loader to inject a web shell directly into memory, never writing to disk, making it difficult to detect with conventional file-based scanning.

The activity is tied to exploitation of CVE-2025-53521, a critical unauthenticated remote-code-execution flaw that F5 originally classified as a denial-of-service issue before reclassifying it. F5 has confirmed exploitation, and Shadowserver was tracking 795 internet-exposed vulnerable BIG-IP APM endpoints as of September 7, 2026. The findings were independently corroborated by BleepingComputer, SecurityAffairs and CybelAngel.

Why it matters: F5 BIG-IP APM is widely deployed by government, financial and critical-infrastructure organizations to manage secure remote access. A memory-resident rootkit that survives file-based detection on this class of device represents a significant, hard-to-spot foothold inside networks that are supposed to be tightly controlled.

Source: Help Net Security, September 9, 2026.

A security researcher known as Nightmare Eclipse released a proof-of-concept exploit dubbed ShieldCrash that bypasses Microsoft’s patch for an earlier Windows Defender privilege-escalation flaw, CVE-2026-69414 (nicknamed ShieldBreak), which had been patched only days earlier on Microsoft’s September 2026 Patch Tuesday, BleepingComputer reported. The bypass was independently corroborated by The Register and SecurityAffairs.

According to the report, the ShieldCrash proof-of-concept allows arbitrary file reads with SYSTEM-level privileges on fully patched Windows 10, 11 and Server installations.

Why it matters: Defender is the default endpoint-security product on most Windows deployments, including systems inside OT and critical-infrastructure environments. A public proof-of-concept that defeats a just-shipped patch for a SYSTEM-level flaw creates pressure for organizations to apply Microsoft’s next round of fixes quickly and to monitor for exploitation in the interim.

Source: BleepingComputer, September 9, 2026.

CISA has added CVE-2026-19490, a CVSS 9.3 authentication-bypass vulnerability in Citrix NetScaler ADC and Gateway appliances configured as a gateway or AAA virtual server, to its Known Exploited Vulnerabilities (KEV) catalog, SecurityWeek reported. Exploitation in the wild has been confirmed since at least September 3, 2026.

Citrix patched the flaw on August 19, 2026. Under Binding Operational Directive 26-04, federal civilian agencies have a three-day remediation window once a KEV entry is added. The exploitation has been independently corroborated by Rapid7, Belgium’s CCB, and security firm RedLegg.

Why it matters: NetScaler ADC and Gateway appliances sit at the network perimeter of a huge number of enterprises and government agencies, frequently providing VPN and remote-access functionality. An authentication-bypass flaw at this layer is a direct path into internal networks — including those of critical-infrastructure operators — for any attacker who has not yet patched.

Source: SecurityWeek, September 2026; CISA KEV catalog.

Two separate ransomware groups have claimed attacks on Interim HealthCare, a home-healthcare provider operating in roughly 40 U.S. states, according to The HIPAA Journal. The Genesis ransomware group listed the company on its leak site on August 10, 2026, claiming 1TB of exfiltrated data including medical records. A second group, Anubis, separately listed the company on August 21, claiming 530GB of franchise and operational data.

An Oklahoma City franchise location filed a formal breach notification with the U.S. Department of Health and Human Services on July 31, 2026.

Why it matters: Two independent ransomware groups claiming the same healthcare organization within weeks of each other raises the possibility of either separate intrusions or data being resold and reused by multiple criminal groups — either scenario underscoring how difficult it has become for healthcare providers, including smaller franchise-model operators, to fully contain a breach once patient data has left their environment.

Source: The HIPAA Journal, September 9, 2026.

Veradigm (formerly Allscripts) disclosed in an SEC filing that an attacker used stolen third-party vendor credentials to access a limited customer-service API and copy patient data, including names and Social Security numbers, BleepingComputer reported. The company said clinical records were not affected.

The ransomware group calling itself “The Gentlemen” claimed to hold 3.5 million patient records from the breach and threatened to leak the data absent a ransom negotiation.

Why it matters: The breach follows a familiar pattern for healthcare-sector incidents: the initial compromise came through third-party vendor credentials rather than a direct attack on Veradigm’s own systems, underscoring why vendor and supply-chain credential hygiene remains one of the hardest problems in healthcare data security even at companies with mature internal security programs.

Source: BleepingComputer, September 9, 2026, citing Veradigm’s SEC filing.

ASUS has released security updates fixing critical vulnerabilities across two of its device-management products, including a maximum-severity flaw that let an unauthenticated attacker gain root access to the server managing an organization’s fleet of PCs and workstations.

A Chained Path to Root on Control Center Enterprise

The more severe issue, CVE-2026-75754, carries a CVSS score of 10.0 and affects ASUS Control Center Enterprise (ACC) version 4.0.0.2 and all earlier releases. It stems from a chain of missing authentication, server-side request forgery and hard-coded credentials: an attacker can send a crafted HTTP request to obtain the system’s encryption key, which causes a local service to open SSH on port 2222, then use hard-coded credentials to obtain a root shell on the ACC server. Successful exploitation gives an attacker full control of the platform, including the ability to read, modify or delete stored data and remotely manage every server, PC and workstation the platform oversees. ASUS published the fix on September 4, 2026.

A Second, Separate Flaw in Control Center Express

ASUS separately patched CVE-2026-19397, a missing-authentication vulnerability in the Control Center Express Agent affecting versions before 1.7.24. The flaw, classified as CWE-306, allows an unauthenticated nearby attacker with a direct connection to the agent to take control of a host that has an active login session, potentially executing code or performing any action available to the logged-in user. ASUS published updates for Control Center Express and its Armoury Crate software, which separately addressed a flaw that could expose a user’s NTLM hash, on September 8, 2026. Neither vulnerability has been reported as actively exploited, but organizations running either platform are advised to update immediately given the scope of access each flaw can grant.

A PostgreSQL vulnerability that has existed undetected for roughly 12 years can let a low-privileged database account escalate to complete, persistent control of the server, researchers have disclosed.

A Decade-Old Gap in a ‘Low-Risk’ Privilege

Tracked as CVE-2026-6471 and nicknamed PostGREShell by the Cyera Research team that found it, the flaw carries a CVSS score of 7.2 and stems from a missing authorization check in PostgreSQL’s logical decoding feature, present since the capability was introduced in version 9.4 in 2014. An account holding only the REPLICATION privilege — typically granted for backup or data-pipeline purposes and long treated as a low-risk, read-only permission — can use a logical decoding output plugin to make the server load an arbitrary shared library file. That library executes as native code inside the PostgreSQL server process, running with the privileges of the operating-system account that runs the database.

Successful exploitation can lead to arbitrary code execution, privilege escalation to permanent superuser status, and installation of a persistent backdoor, effectively handing an attacker full control of the server and any data it holds.

Patched in August, Disclosed in September

The PostgreSQL project shipped a fix for CVE-2026-6471 on August 13, 2026, bundled with 27 other security patches in versions 18.6, 17.11, 16.15, 15.19 and 14.24. Branches earlier than version 14 do not receive a fix. Cyera reported the issue to the PostgreSQL security team on February 21, 2026, with the team confirming it six days later; discovery credit was given to researchers Vladimir Tokarev and Yu Kunpeng. Security researchers are advising organizations to update affected instances immediately, audit which accounts hold the REPLICATION attribute, and remove it from any account that does not strictly require it.

Broadcom has patched two vulnerabilities in VMware Workstation and Fusion that could let an attacker with administrative privileges inside a virtual machine escape the VM and execute code on the underlying host system, a scenario that undermines the isolation virtualization is meant to provide.

Two Distinct Escape Paths

The more severe issue, tracked as CVE-2026-59346 and carrying a CVSS score of 9.3, is an integer-overflow flaw in how the software handles the VMXNET3 virtual network adapter. According to Broadcom’s advisory, a malicious actor with local administrative privileges on a virtual machine configured with a VMXNET3 adapter can exploit the bug to execute code on the host.

The second flaw, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow in the Host-Guest File System (HGFS), the VMware component that lets a guest VM access files and folders on the physical host. Exploiting it allows code execution as the host’s VMX process, though Broadcom notes the exploitation conditions differ from the first bug.

Patches Available, No Known Exploitation Yet

Both vulnerabilities are fixed in VMware Fusion Pro 26H1u1, released September 3, 2026, and the corresponding Workstation update, detailed in advisory VMSA-2026-0007. CVE-2026-59346 was reported by researchers h4urek, cameudis and Stan S working with Trend’s Zero Day Initiative; CVE-2026-59347 was credited to Yeonghyeon Choi and Tianchu Chen of Tencent’s Xuanwu Lab. As of September 4, Belgium’s national cybersecurity center said it had no indication either flaw was being actively exploited, though it urged administrators to patch immediately given the risk of lateral movement, data exfiltration and host compromise if exploitation conditions are met.

The disclosures follow reports last month that threat actors, including a suspected China-nexus group, were already exploiting separate flaws in VMware vCenter, underscoring sustained attacker interest in Broadcom’s virtualization stack.