Security Analyst: 2026-09-19

1. CISA Adds One Known Exploited Vulnerability to Catalog

   CISA (Cybersecurity and Infrastructure Security Agency), 2026-09-18. Read, 1 min.

   CISA added CVE-2025-39682, described as a Linux kernel improper check for unusual or exceptional conditions, to the Known Exploited Vulnerabilities catalog on 2026-09-18 based on evidence of active exploitation. The alert points federal civilian agencies to BOD 26-04, which requires them to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, while deferring action on lower-risk vulnerabilities. CISA encourages all organizations, not only federal agencies, to adopt risk-based vulnerability management and prioritize KEV remediation.

   Why it matters for this role: Check whether the Linux hosts you monitor carry the affected kernel and hand the list to patching with the KEV listing attached. Since exploitation is active, also review recent alerts and logs on those hosts for signs the flaw was used before the fix arrives.

   Corrected 2026-09-21: An earlier version said BOD 26-04 directs agencies to prioritize rapid remediation of KEV-listed CVEs in general. The alert limits that to KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, with action on lower-risk vulnerabilities deferred. The key sentence and the question now carry that limit.

2. RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts

   Zimperium zLabs, 2026-09-16. Read, 16 min.

   Zimperium zLabs describes RatHat, a novel Android malware strain distributed through deceptive phishing sites promoted by malvertising, smishing campaigns and third-party forums that lure victims into manually downloading APKs, and links it to threat actors that, in Zimperium's words, appear to be operating in China, on the basis of Chinese-language AI prompts found in the code. Once granted Accessibility, it unlocks Developer Options by tapping Build Number, enables Wireless Debugging, reads the pairing code and port from the UI, and authenticates to the local ADB daemon for shell-level access, while a Go daemon running outside the package lifecycle reinstalls the APK after uninstall. It collects credentials through accessibility keylogging, browser URL harvesting, an SMS receiver and notification listener that intercept 2FA and OTP codes, and raw /dev/input capture mapped to embedded keypad geometry to recover PINs and unlock patterns, and it serializes the live Accessibility tree to XML for an unnamed widely used generative AI assistant to resolve navigation.

   Why it matters for this role: On any Android device in your visibility, treat Developer Options or Wireless Debugging turning on as something to chase, because that is where the chain goes once accessibility is granted. When a user says they uninstalled the app, do not close the case: a separate daemon reinstalls it.

Security Analyst