Exploited F5 BIG‑IP Zero‑Day; Cloud Platforms Add Controls and Scale
Coverage: 23 Sept 2026 (UTC)
< view all daily briefs >Urgent security updates and active exploit activity dominated the day. A critical zero-day in F5 BIG‑IP APM used as an OAuth authorization server is under exploitation, while multiple vendors issued guidance and fixes for management-plane and gateway exposures. At the same time, major cloud platforms rolled out capabilities aimed at improving elasticity, observability, and security operations at scale.
Critical Zero‑Day at the Edge: BIG‑IP APM OAuth RCE
F5 disclosed and hotfixed F5 zero-day CVE‑2026‑94127, a heap‑based buffer overflow in BIG‑IP Access Policy Manager (APM) rated CVSS 9.8 that enables unauthenticated remote code execution when APM is configured as an OAuth authorization server on the same virtual server handling OAuth traffic. F5 advised that management interface restrictions and Appliance mode do not mitigate risk because exploit traffic targets the data‑plane virtual server. CISA added the flaw to KEV on September 22 and directed federal agencies to deploy mitigations by September 25, recommending use of an F5‑provided iRule for initial triage followed by installation of the engineering hotfixes available for 21.1, 17.5 and 17.1 branches. Systems using APM only as an OAuth client or resource server are not affected. Operators are urged to preserve forensic data, apply the hotfix, and review indicators of compromise including bursts of OAuth authentication failures, suspicious audit‑log commands, and TMM SIGABRT/core activity before initiating incident response if warranted.
Cloud Platforms Add Native Controls, Elasticity, and SOC Integration
Microsoft introduced the Integrated Security Operations Center (ISOC) in Microsoft ISOC, a Defender architecture that unifies SIEM‑class telemetry, protection, and orchestration so human analysts and autonomous agents can perceive, reason, and act as one system. In preview, ISOC aims to reduce tooling friction, disrupt attacks in progress, and adapt defenses in near real time, building on Microsoft’s end‑to‑end stack and Project Perception.
Google Cloud announced native Prometheus metrics support in GKE, enabling HPA to query PromQL directly from Cloud Monitoring and Google Managed Service for Prometheus without external adapters. The preview extends the AutoscalingMetric API and polls every 15 seconds for low‑latency scaling, supports complex queries and both pod‑level and aggregate metrics, and minimizes node overhead via a control‑plane controller. Details are outlined in GKE PromQL. Complementing this, GKE 1.37 adds native scale‑to‑zero for event‑driven and sporadic workloads using HPA with the new AutoscalingMetric CRD and capacity buffers that keep warm compute to reduce cold starts. Google describes configuration and roadmap considerations in GKE scale‑to‑zero.
AWS made CloudWatch Omni generally available as an AI‑first, team‑centric observability experience that combines OpenTelemetry interoperability with CloudWatch scale. Omni discovers services, maps dependencies, highlights golden metrics, and supports natural‑language queries and chat, plus agent‑focused workflows for evaluation‑driven development across common AI frameworks. Availability, setup, and tooling are detailed in CloudWatch Omni. Separately, DynamoDB global tables with multi‑Region strong consistency expanded to five additional Regions, enabling three‑Region (or two plus witness) configurations across 15 Regions with RPO=0 for strongly consistent reads near users and resilience during Regional impairments; more in DynamoDB MRSC.
Management Planes and Gateways Under Attack
Arista Networks patched an actively exploited maximum‑severity zero‑day (CVE‑2026‑93952) impacting VeloCloud Orchestrator On‑Prem where certificate‑based Edge authentication is used, enabling network‑adjacent attackers to access privileged internal host functionality without tenant/operator credentials. Hosted instances have been patched and on‑prem updates are rolling out; CISA added the flaw to KEV and set a near‑term remediation deadline. Arista’s guidance includes access restrictions, log review for suspicious requests, monitoring for unexpected outbound activity, and preserving evidence before remediation, as reported in Arista VCO.
Check Point confirmed active exploitation of two pre‑auth flaws: CVE‑2026‑85102 enabling remote code execution in Security Gateway VPN certificate handling, and CVE‑2026‑93616, a pre‑auth path traversal allowing script execution and Java class loading in the Management web service. The company recommends installing LivePatch Take 26 or specified Jumbo Hotfixes (and Spark updates), verifying LivePatch status, and tightening VPN rules when immediate updates are not feasible. CISA added both issues to KEV. Full mitigation and hunting steps are outlined in Check Point flaws.
CERT Polska detailed “MikroTrick,” an attack chain that combines RouterOS SSH bugs to seize MikroTik routers without passwords or SSH keys. By abusing CVE‑2026‑67279 (SSH state‑machine) and CVE‑2026‑86060 (argument injection in the login program), attackers can force acceptance of chosen usernames at full privilege and plant accounts such as “ops.” Evidence points to exploitation beginning September 2, ahead of MikroTik patches in 6.49.21, 7.23.4, and 7.24.2; CISA added CVE‑2026‑86060 to KEV. Detection and recovery steps—including isolating devices, checking for “-2” login attempts, unknown users, scripts, scheduler entries, tunnels, proxies, unexpected .rif files, and then factory reset and credential rotation—are summarized in MikroTik chain.
Web and Desktop Targeting, and Infrastructure Risk Trends
Researchers observed rapid, unauthenticated exploitation of a critical WordPress path traversal (CVE‑2026‑87902) that can lead to RCE when specific theme directory conditions are met. Attackers began probing within hours of the WordPress 7.1.2 release, escalating to disk‑writes of PHP payloads (for example, wp‑pear‑rce‑flag.php) in /tmp and /var/tmp and using double‑encoded traversal in pagename with a valid page_id for reconnaissance and exploitation. Administrators should update to 7.1.2 (or backports to 4.7+), audit logs and temp directories, and apply host‑appropriate mitigations, according to WordPress RCE.
Volexity reported a Chinese threat actor, UTA0565, chaining two Chrome bugs (CVE‑2026‑85046, CVE‑2026‑87491) with a Windows ALPC flaw (CVE‑2026‑85880) to escape the browser sandbox and deploy CLEANGULP malware. Lures included spoofed sites and phishing tied to topical themes, loading a BlueMoon exploit kit via hidden iframes and dropping a “chrome_cleanup.exe” payload with shell, process, and file operations and BOF execution, beaconing to a disguised C2. Multiple actors appear to be reusing and customizing the kit, per UTA0565 campaign.
Eclypsium’s InfraTrust Pulse highlighted intensified targeting of network management systems and administrative consoles, tracking 1,699 vulnerabilities across 158 advisories from 17 vendors over a three‑week window, including 42 criticals (eight at CVSS 10.0) and 71 remotely exploitable pre‑auth weaknesses. Notable exposures included chained or bypass flaws in Cisco FMC and ISE, critical RCE in SonicWall SMA 1000 and Check Point management products, and high‑severity switch issues. The report underscores that attackers aim at the systems holding credentials and change‑control pathways, and it flags supply‑chain pressure from widely resurfacing bugs such as a Linux kernel privilege‑escalation seen across 19 vendor advisories. Recommended focus areas include accelerated patching, hardening, restricted access to management interfaces, and continuous monitoring, as outlined in the InfraTrust report.
For developers, Vercel addressed a critical Next.js ImageResponse vulnerability (CVE‑2026‑94545) allowing RCE when untrusted input is embedded into SVGs generated on the Node.js runtime. Next.js 16.3.6 and Satori 0.33.5 remediate improper escaping in SVG output; Next.js 15 and the Edge runtime are unaffected. No public exploits were noted as of September 23, but applications should upgrade and ensure attacker‑controlled values are not passed into SVG content, per Next.js fix.