Today’s theme: the “boring” assets are loudly on fire. Edge switches, workflow orchestrators, and third-party app keys are quietly becoming the fastest path to your crown jewels.

Today's Top 5

1. 996 Zyxel switches popped: CISA added CVE-2026-7273 to KEV with a three-day deadline, after exploitation tied to data theft from nearly a thousand GS1900 devices across dozens of countries. The part most teams miss is what attackers can steal after they get in.
2. Oil tankers, cyber boarding teams: The Coast Guard and FBI boarded US-bound tankers after indications of network compromise by foreign cyber actors. Public details are thin, which is exactly why OT teams should read between the lines.
3. Orkes Conductor pre-auth RCE: CVE-2026-58138 is being exploited, and the vulnerable service is often sitting with juicy internal credentials and automation access. If your workflows can run scripts, attackers just found a shortcut.
4. Linux kernel KEV exploitation: CISA says attackers are exploiting three Linux kernel vulnerabilities. The immediate risk is not just root, it is the forensics requirement when you patch late.
5. BigCommerce app keys abused: A compromise of third-party Ribon app credentials led to malicious script injection and data access on a small set of merchant stores. This is the “SaaS marketplace” threat model arriving on your doorstep.

Why today matters: The common pattern is attacker ROI: hit the thinly monitored layer that has implicit trust. Switch management planes, orchestration APIs, and app keys are all “security adjacent” but rarely owned by a single control owner. If your org runs fast DevOps and buys lots of SaaS add-ons, you should be nervous.

Ok, let’s get specific.

Data Breaches

1. BigCommerce merchants hit via compromised Ribon app credentials: BigCommerce says its own platform was not breached, but attackers used compromised credentials for third-party Ribon apps to inject malicious scripts into a small number of storefronts and access existing customer records. BigCommerce revoked access by uninstalling the app from affected stores and provided logs to support investigation. Source: BleepingComputer
2. Zyxel GS1900 exploitation linked to data theft: CISA added CVE-2026-7273 to KEV due to active exploitation. Reporting cites activity that included exfiltration of sensitive information from exposed switches, which is exactly how a “small” network device turns into an enterprise-wide credential spill. Source: The Hacker News
3. Spokane Public Schools takes systems offline after security incident: The district told families it is investigating a network security incident that occurred late Sept. 20 and took several systems offline as a precaution, warning of service disruptions. Early containment moves like this are usually the difference between “incident” and “breach disclosure.” Source: KHQ
4. Law firm named on extortion leak site (unverified): A ransomware group listing claims a law firm victim and stolen internal data. Treat as unverified until corroborated, but it is a useful reminder that legal matter files are premium extortion fuel. Source: GalaxyWarden

Security Research

1. CISA KEV: Zyxel GS1900 stack-based buffer overflow exploited: CISA added CVE-2026-7273 to KEV with a due date of 2026-09-24, signalling active exploitation and forcing a fast patch cycle. If you run these switches in branch sites, assume “low criticality” is a lie. Source: CIRCL KEV mirror
2. Orkes Conductor pre-auth RCE exploitation details: SecurityWeek reports CVE-2026-58138 exploitation, including how inline workflow definitions and an unsandboxed GraalVM context can lead to OS command execution, often as root. Conductor being used to orchestrate microservices and AI agents makes the blast radius nasty. Source: SecurityWeek
3. Linux kernel vulnerabilities exploited, CISA says: CISA warns active exploitation of three Linux kernel flaws and flags “forensic triage” requirements. Translation for CISOs: patching is not enough, you may need incident response on every affected box. Source: BleepingComputer
4. WordPress Click2Shell exploit chain with public PoC: A newly detailed WordPress Core issue (fixed in 7.1.1) enables a pre-auth chain that can lead to server-side code execution if a logged-in admin clicks a crafted link. This is phishing plus web app mechanics, and it will scale. Source: BleepingComputer
5. npm malware hides at runtime to bypass install-script defenses: Checkmarx analysis shows malicious npm packages evading newer install-script controls by triggering at runtime inside common library methods, then using Slack, Telegram, and even an Ethereum smart contract for C2. Supply chain risk keeps evolving toward “looks clean until production.” Source: BleepingComputer
6. Tankers: what cyber boarding implies for maritime OT: SecurityWeek summarizes the Coast Guard confirming evidence of malicious cyber activity on one vessel and highlights the broader OT risk in maritime operations. If your org touches energy logistics, this is not “someone else’s problem.” Source: SecurityWeek

Top CVEs

1. CVE-2026-7273: Stack-based buffer overflow in Zyxel GS1900 series switch firmware that can lead to arbitrary OS command execution. Now in KEV due to active exploitation, with a short remediation window and real-world data theft reporting. Source
2. CVE-2026-58138: Orkes Conductor unauthenticated RCE via crafted inline workflow definitions. Exploitation in the wild is confirmed, and exposed Conductor workflow APIs are the nightmare scenario because orchestration servers often hold service credentials. Source
3. CVE-2025-39682: One of three Linux kernel vulnerabilities CISA says are being exploited. Public exploit availability is noted in vendor bulletins, and CISA requires forensic triage for affected assets. Source
4. CVE-2026-53266: Linux kernel vulnerability flagged by CISA as exploited, with analysis pointing to potential privilege escalation paths. Even without a polished public exploit, KEV status should drive emergency patching and validation. Source
5. CVE-2026-82187: Unauthenticated arbitrary file upload leading to RCE in the WordPress “Web to Print Online Designer” plugin (fixed in 2.15.0) with public exploit code. It is plugin RCE season again, so assume opportunistic scanning. Source

Podcasts & Talks

1. Between Two Nerds (Risky Business): Real-time cyber defence: Tom Uren and The Grugq debate whether “real-time” defence exists and what agentic AI changes about speed, detection, and response loops. Useful listening before someone in your org proposes autonomous response in production. Listen: Risky Business Media

Final Words

The uncomfortable pattern today is control-plane compromise. Attackers are not breaking your main app first. They are breaking the thing that configures the thing that runs the app. Switches that leak configs, workflow engines that run scripts, and third-party app keys that see customer data are all control planes in disguise.

This week, do three things:

• Find and patch every Zyxel GS1900 in your environment for CVE-2026-7273, then rotate any credentials that ever lived in switch configs.
• Audit for exposed Orkes or Netflix Conductor endpoints and upgrade to 3.30.2+, then block public access to workflow APIs and alert on suspicious workflow submissions tied to CVE-2026-58138.
• For Linux fleets, treat the KEV-listed kernel vulns as an IR trigger, not a patch ticket, and run post-patch compromise checks on systems that were internet-facing or multi-tenant.

Your turn: If an attacker stole your branch switch configs tomorrow, do you know which downstream credentials and network paths become reachable in the first 15 minutes? Hit reply with your honest answer, or drop a comment on the web version. I read every reply.

Know someone who still thinks “it’s just a switch”? Forward them today’s Zyxel KEV story. It takes 30 seconds, and the alternative is explaining lateral movement from a closet rack. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!