Hello, stay ahead with CISO Brief 🚀

🔒 A CSRF vulnerability in the Elementor WordPress plugin could let an unauthenticated attacker create administrator accounts by tricking a logged-in admin into opening a crafted link. The flaw affects versions 4.3.0 and 4.3.1, which are active on up to 2 million sites. Patchstack reported the issue to Elementor on September 22 and a fix was issued in version 4.3.2 two days later. Users are advised to update immediately to prevent one-click admin account creation attacks.

🔒 Research from Israeli security firm Gambit shows attackers used open-source AI tools to target 105 online retailers over five days, successfully compromising 27 of them. The campaign used tools named Strix, Cairn, and Hermes to find vulnerabilities, exploit them autonomously, and orchestrate operations. The attacker acquired AI model access via OpenRouter and spent roughly $7,005 over four weeks — about $25 per attack — while harvesting hundreds of thousands of credit card details and installing skimmer scripts.

⚠️ CISA warns that multiple critical and high-severity vulnerabilities in WSO2, Adobe Commerce, Microsoft SharePoint, and Mikrotik RouterOS are being actively exploited. Two critical flaws—CVE-2026-5430 in WSO2 and CVE-2026-71362 in Adobe Commerce—were added to the Known Exploited Vulnerabilities catalog with federal mitigation deadlines. Agencies must patch or mitigate by the specified dates, and organizations are urged to prioritize these fixes.

🛡️ third-party[.]com is being used to deliver a ClickFix lure that targets Windows systems and sidesteps protections, Manifold Security reports. The site impersonates a Cloudflare “are you human?” check, poisons the clipboard and instructs users to paste a command that runs a remote PowerShell payload. Unlike reserved placeholders such as example.com, third-party[.]com was available for registration and was abused to trap unwary developers and enterprise users.

📣 Google Cloud announces the GA release of Storage Intelligence advisor and expanded storage batch operations to help teams detect anomalies and remediate them at scale. Advisor provides out-of-the-box findings and baselines daily activity to surface spikes, errors, cross-region egress, and growth trends without heavy engineering. Batch operations let you execute large-scale changes (transitions, deletes, retention updates) across millions of objects with serverless execution, dry-run validation, and advanced filters.

🔧 This guide explains Google Cloud's managed Reinforcement Learning Fine-Tuning (RLFT) service for adapting Gemini models using a reward signal you define instead of labeled answers. It covers when to choose RLFT versus supervised fine-tuning (SFT), example use cases (NPC dialogue, structured extraction, moderation, code execution, slide generation), and the practical artifacts you must supply: a dataset and a robust reward function. The service manages infrastructure and model internals while you iterate on reward and validation.

🚀 Memorystore for Valkey 9.1 is now generally available on Google Cloud, delivering up to 3x queries per second at microsecond latencies compared to Memorystore for Redis Cluster. Valkey 9.1 introduces a lock-free multi-queue I/O architecture, a two-phase dynamic thread scaling engine, and several new commands (HGETDEL, MSETEX, HSETEX) plus topology-aware CLUSTERSCAN and database-level ACLs for improved security and observability. The release also expands node sizes and provides a managed migration workflow to simplify moving from self-managed Redis/Valkey to Google Cloud Memorystore.

🧭 Anthropic now enables cloud sessions for Claude Code without requiring enrollment in the research preview and is providing promotional credits to eligible subscribers. Cloud sessions run on Anthropic-hosted infrastructure so tasks continue remotely when your device is off, and they can be started from claude.ai/code, the mobile or desktop apps, or the CLI. Eligible Pro users receive $100 in cloud-session credits and Max subscribers receive $250; credits apply automatically and are distinct from normal plan limits. The promotion must be claimed by October 7 and unused balances expire November 4.

📊 The AWS DataSync console now includes a monitoring dashboard that gives visibility into data transfers across your account, showing status, transfer rates, duration, and totals for each task execution. You can filter executions by status, task, mode, execution ID, or start time and see summarized results including counts of successful and failed runs and cumulative data transferred. The dashboard highlights configured tasks, locations, and agents and provides real-time aggregate transfer rates, with the ability to inspect errors for failed executions. This feature is available at no extra cost in all commercial and AWS GovCloud (US) Regions where DataSync is offered.

⚠️ A critical Remote Code Execution vulnerability, CVE-2026-87902, affects WordPress versions 4.7.0 through 7.1.1 and allows arbitrary PHP file inclusion leading to potential code execution. WordPress released patches on September 22 (latest recommended version 7.1.2 or newer), but exploit attempts were observed within hours. Site owners should update immediately and follow recommended hardening measures to complement the patch.

🛡️ A GitLab feature that supplies a project-scoped email address to create issues embeds a long-lived token in the address, which can be used to act as the linked user across projects. Aikido Security found the token (prefixed with glimt-) is identical across project addresses for an account and bypasses IP restrictions, enabling actions like creating issues and merge requests with the account's permissions. GitLab updated wording to acknowledge merge request capabilities; Aikido recommends treating the addresses as credentials and rotating tokens if exposed.

📰 OpenAI may be preparing a new ChatGPT Pro Max subscription reportedly priced around $500 per month, with some listings showing $600 including local taxes. The unannounced plan has appeared in the ChatGPT subscription interface alongside Plus and existing Pro tiers and advertises "Fastest Work and Codex," access to frontier models, maximum memory, and 100GB file storage. Details on rollout timing and usage limits remain unclear, and OpenAI has not confirmed the offering.

🔒 Two GitHub Actions that were compromised in May 2026 and disabled by GitHub were re-enabled on September 16, 2026, restoring access to repositories containing unremediated malicious release tags. Socket researcher Karlo Zanki warned that workflows referencing the affected tags resumed downloading and executing the May 18 payload, which harvests CI/CD secrets and exfiltrates them. Developers are urged to pin to pre‑compromise SHAs, rotate secrets, audit workflow history, and remove or replace the affected actions.

🔎 A CAASM inventory that merely lists assets is insufficient; top tools attach criticality and connection data from day one so teams see what truly matters. Accurate resolution, deduplication, and frequent refreshes ensure the inventory reflects reality across devices, identities, cloud resources, SaaS, and misconfigurations. Connecting that inventory to external attack surface management, validation, and threat intelligence enables prioritization and remediation rather than endless reporting.

🛡️ Turnstile Spin is an agent-mediated, end-to-end implementation of Cloudflare's Turnstile that automates widget creation and backend validation. It guides AI coding agents to embed the Turnstile widget, wire Siteverify into server logic, fix misconfigurations, and migrate from other CAPTCHA providers without sending application code to Cloudflare. Spin can be started from the Cloudflare dashboard, Wrangler, or an agent skill and has already seen widespread adoption since its July release.

🖥️ Microsoft announced it will deprecate the Windows Deployment Services (WDS) server role starting with the next Windows Server release. WDS, a successor to RIS, enabled network-based OS installs at scale but has seen partial deprecation steps since 2021, including removed features and reduced support for desktop OS deployment. Microsoft recommends migrating to alternatives such as Configuration Manager and notes current supported Server releases remain unaffected until removal.

🛡️ The US Cybersecurity and Infrastructure Security Agency (CISA) released an Election Infrastructure Security Plan on September 24, 2026, to guide federal, state, and local bodies in mitigating cyber and physical threats ahead of the November 3 midterm elections. The plan outlines risks to physical assets and ICT systems—including voter registration databases and voting machines—and recommends measures such as harmonized patch management, paper ballots, MFA, continuous monitoring, and insider-risk mitigations. CISA also detailed no-cost services like tabletop exercises, penetration testing, vulnerability scanning, and regional coordination to help election stakeholders strengthen defenses.

🔒 Rydox administrator Ardit Kutleshi pleaded guilty to operating a major illicit marketplace that sold stolen identities, login credentials, credit card data, and cybercrime tools. Arrested in a 2024 international operation that seized the site's domain and servers, Kutleshi was extradited to the U.S. in 2025 and charged with identity theft, money laundering, and related offenses. He faces sentencing in February 2027 and substantial prison time.