Cybersecurity Specialist: 2026-09-22
26 minutes in total
GreyNoise, 2026-09-21. Read, 20 min.
GreyNoise reports that a single suspected Chinese-speaking actor, which it assesses is the same as or related to Red Heron, exploited Zyxel GS1900 switches through CVE-2026-7273 on or about 17 August 2026, taking configurations and hashed root credentials from 996 switches in 48 countries, 564 of them still on factory default credentials. It says the same actor’s WordPress intrusions through the wp2shell chain reached at least 49 organizations in 29 countries, including a western government that lost more than 18,000 records.
Why it matters for this role: As the person who covers a bit of everything, you often own the small network gear no one else watches, so a live campaign taking data from GS1900 switches on default credentials is your cue to inventory and re-credential them now.
BigCommerce alerts merchants of data breach linked to Ribon apps
BleepingComputer, 2026-09-21. Read, 3 min.
BigCommerce told BleepingComputer that on September 17, 2026 it confirmed that credentials for the third-party Ribon and Ribon 1.5 apps, run by Be A Part Of, a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts, and that it removed the apps and notified those merchants. Master of Malt, one notified merchant, says the attacker reached shopper names, emails, phone numbers, and shipping addresses between September 13 and 17, while BigCommerce says its own platform was not breached and card data was not exposed.
Why it matters for this role: Third-party apps bolted onto your platforms are part of the everything you secure, and this breach shows a stolen app credential, not a platform hack, was enough to reach customer records.
Meta Muse AI app flaw lets local malware redirect dictation traffic
The Register, 2026-09-21. Read, 3 min.
Security researcher Patrick Wardle published a proof of concept, not-a-mused, for what he describes as a local zero-day in Meta’s Muse macOS app: an unprivileged local process can change an undocumented setting, endo_voyager_dictation_endpoint, to redirect Muse’s dictation traffic to an attacker-controlled endpoint, potentially exposing dictated prompts and enabling prompt injection and theft of authentication material. Wardle says the flaw is not a remote issue and requires the ability to run local code, and Meta did not immediately respond to The Register’s request for comment.
Why it matters for this role: AI assistants land on the machines you look after with broad local access, and this flaw is a reminder that an app’s granted access can become local malware’s access when a setting is left unprotected.
The quiz for this edition has closed.