# Weekly Situation Report — 9/28/26 2026-10-01 · Threat Brief Canonical: https://www.osec.com/resources/threat-briefs/weekly-situation-report-9-28-26 --- - A WordPress Click2Shell vulnerability allows attackers to execute arbitrary PHP code on vulnerable servers. - Nightmare Eclipse has disclosed a new BigDiskBuster zero-day that can interfere with Windows Defender updates and security protections. - A proof-of-concept exploit for a SharePoint vulnerability has been publicly disclosed, with exploitation already observed in the wild. - Attackers are actively exploiting a newly disclosed F5 zero-day vulnerability in targeted attacks. - The new ClosedQuorum Windows malware uses AI-driven decision-making to dynamically determine attack behavior. ## 1. WordPress Click2Shell flaw lets hackers execute PHP on the server **Summary** A newly discovered WordPress vulnerability named Click2Shell allows attackers to execute arbitrary PHP code via a CSRF attack by tricking an administrator into visiting a crafted URL. The issue has been fixed in WordPress version 7.1.1. **Category:** Critical Vulnerabilities **Industry:** Multiple **Analyst comments** Click2Shell is a CSRF vulnerability in WordPress Core that allows remote code execution by triggering theme installation from the official catalog without authentication. Successful exploitation requires an administrator to interact with a crafted URL. Discovered by researchers and reported on August 22, the flaw enables attackers to run arbitrary PHP files via a Customizer preview, even if themes are inactive, potentially leading to file manipulation, data access, and creation of rogue admin accounts. A PoC for the full RCE chain is publicly available. We are not aware of in-the-wild exploitation; however, this is highly likely to be abused within days of disclosure if not already. We attempted to identify sites set up for attacking purposes but found no instances, likely because obfuscation is a common tactic for most operators when building live phishing infrastructure. The primary attack vector will likely be phishing and watering hole tactics on WordPress-related sites and communities where posting and commenting is possible, maximizing exposure and scale. **Actionable guidance** WordPress addressed the issue in version 7.1.1 with fixes for theme slug escaping and restricted jQuery selectors. Until updates are applied, unpatched sites can reduce risk by enabling `DISALLOW_FILE_MODS`. ## 2. New zero-day BigDiskBuster disclosed by Nightmare Eclipse, prevents Windows Defender updates **Summary** Security researcher Nightmare Eclipse, known for disclosing Microsoft zero-days, released a new tool called BigDiskBuster designed to prevent Windows Defender from updating by filling up disk space. **Category:** Critical Vulnerabilities **Industry:** Multiple **Analyst comments** Nightmare Eclipse released a new proof-of-concept tool named BigDiskBuster that prevents Windows Defender Antivirus from updating itself by filling disk space with hidden temporary files until updates fail. This tool does not disable Defender but ensures it remains on outdated security intelligence versions, potentially reducing its efficacy in detecting new malware. The compatibility of the tool across all supported Windows versions has not been independently verified, and Microsoft's response to such disclosures continues to be contentious due to a public disagreement over vulnerability disclosure processes. We tested the PoC in our lab environments; however, we were not able to get it to work fully on older Windows 11 deployments. The PoC was confirmed working on recent versions. This suggests that some Windows 11 and Defender configurations are less at risk, as the tool likely requires more recent patches to function effectively. By the researcher's own admission, the PoC as released is unstable and contains bugs. We modified minor aspects of the code to get it to compile. Once compiled, we ran it with both an administrator account and a standard user account. Both instances ran as described and aligned with results reported by other researchers, confirming that no elevated privileges are required. The PoC must run persistently in the background for blocking to continue. In a live attack scenario, this would likely involve the tool being renamed as a lookalike of a common Windows process such as svchost.exe. This technique is more likely to be used during longer-term intrusion campaigns by espionage-motivated attackers rather than financially motivated groups. **Actionable guidance** There is currently no patch available for this issue; however, recent Microsoft signature updates include detections for this code. Other indicators that this PoC is in use include the following: - Rogue processes are likely named generically such as svchost.exe executed from userspace folders. - Failures to update signature definitions for Microsoft Defender. - Operational event items in Operational logs (codes 2001 or 2003) with error codes indicating the disk is full (80070070). ## 3. SharePoint vulnerability PoC disclosed, exploitation seen in the wild **Summary** Microsoft initially classified CVE-2026-65660 as a moderate spoofing vulnerability. However, technical research and public PoC code indicate that the vulnerability can enable authenticated remote code execution in SharePoint Server 2016, 2019, and Subscription Edition due to improperly escaped input in the SafeControls list checker. Public data also indicates that exploitation attempts have been observed in the wild. **Category:** Critical Vulnerabilities **Industry:** Multiple **Analyst comments** CVE-2026-65660 is a critical vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition that allows authenticated attackers to execute remote code. Microsoft initially classified the flaw as a moderate spoofing issue before updating its advisory after researchers disclosed the remote code execution path. The exploit takes advantage of unescaped quotes within the SafeControls list checker, enabling attackers to inject directives and load arbitrary .NET classes for code execution. Patches addressing the flaw have been available since mid-August, but researchers warn that it can still be chained with other bypasses to achieve pre-authentication access on unpatched or misconfigured servers. A security researcher has published details on exploitation techniques, including methods for embedding an in-memory webshell in affected instances. Examination of public honeypots has revealed likely exploitation attempts consistent with the disclosed details. SharePoint is a high-value target for multiple threat actor groups due to the organizational knowledge bases and credentials it may contain. Successful compromise can have significant downstream effects on connected systems and processes. **Actionable guidance** Applying the August patch and any subsequent updates for SharePoint is recommended to remediate this issue. Subscription and Cloud versions will likely be patched automatically. If compromise is suspected, organizations should look for requests matching the endpoint pattern below. ``` # typical endpoint request POST /_layouts/15/AddGallery.aspx?DisplayMode=Edit&a=/ToolPane.aspx ``` If indicators of compromise are found, organizations should proceed with incident response procedures to assess impact. This may include: - Audit for potential credential leakage through shared knowledge sources, and expand the investigation to all affected assets. - Look for unknown IPs, domains, and locations connecting to the targeted SharePoint instances, and cross-check any positive malicious indicators against the broader environment. - Review for unknown user behavior and rogue services on the affected SharePoint instance and any assets that may have been compromised. ## 4. F5 zero-day exploited in the wild **Summary** F5 has disclosed a critical zero-day vulnerability in BIG-IP APM, tracked as CVE-2026-94127. The vulnerability affects specific OAuth configurations and allows unauthenticated remote code execution. Active exploitation has been observed, and emergency updates are available. **Category:** Known Exploited Vulnerabilities **Industry:** Multiple **Analyst comments** F5 has disclosed a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager (APM) that allows remote code execution, with attackers already exploiting it. The vulnerability affects systems where APM is configured as an OAuth authorization server and impacts versions 17.1.0 through 17.5.1 and 21.1.0. F5 has released emergency updates for these versions. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, instructing federal agencies to address it urgently. CVE-2026-94127 is a heap overflow triggered via the Authorization header of the web interface on F5 BIG-IP appliances running as OAuth authorization servers. According to CISA, exploitation has already occurred in the wild. We have not observed direct exploit attempts via public honeypots or our in-house deployments. However, we observed an increase in probing for F5 devices beginning September 24th via public honeypots. **Actionable guidance** Organizations should install the available hotfixes promptly. If immediate patching is not possible, apply temporary mitigations such as iRules (available via an F5 support ticket). Monitor logs for signs of exploitation, including repeated OAuth failures followed by suspicious commands and TMM SIGABRT events. Additional monitoring efforts should look for the following: - A large bearer token payload observed in requests from unusual source IPs or domains. - Rogue user accounts or unknown files present on the appliance. The following BIG-IP APM product versions are vulnerable: ``` BIG-IP APM 21.1.0 BIG-IP APM 17.5.0-17.5.1 BIG-IP APM 17.1.0-17.1.3 ``` ## 5. New ClosedQuorum Windows malware uses AI for attack decisions **Summary** ClosedQuorum is a novel Windows malware written in Go that uses multiple AI models to make decisions and automate post-compromise activity. This reduces the need for direct human interaction during an attack, although its effectiveness may be limited by factors such as AI API availability. **Category:** Stealers **Industry:** Multiple **Analyst comments** ClosedQuorum is a new Windows malware using AI models including Google Gemini, DeepSeek, Qwen, and Mistral to autonomously decide actions post-compromise, including credential theft, persistence, and injection techniques through process hollowing or Early Bird APC injection. The AI models vote on next steps, with DeepSeek taking priority in ties; all decisions fall within a predefined set that includes lateral movement, though this capability is currently non-functional. Once data is stolen, it is sent to operators via Discord webhook, enabling full automation from malware delivery onward. Researchers note this represents an architectural shift toward attack-chain automation but may face challenges with API rate limits or unavailability. While its use in malware is novel, quorum multi-model voting techniques have been publicly available on GitHub since 2025. The malware samples were likely identified via malicious prompts or submissions to public malware analysis services. There is no indication this malware has been used in the wild or targeted any organization. This is further evidenced by placeholder text for API keys and Discord C2 callback locations within the samples themselves, as noted by external researchers. This malware is unlikely to result in a major impact against organizations with mature security enforcement and policy, with much of the impact likely to be faced by individual users without access to enterprise security controls. Nor is the malware likely to succeed or run without error during its operational runs. Similar malware using AI/LLMs within their attack chains such as JADEPUFFER have not seen great success and did not operate as intended in most circumstances, resulting in no impact to target entities. To date, no threat group controlled agentic malware has been linked to a successful attack or attributed to a major breach. This showcases that threat actors are continuing to experiment with LLMs/AI within their malware execution playbooks. However, a majority of malware developers are using the technology primarily in the development process. **Actionable guidance** This malware can be detected through the following: - Network calls to four AI/LLM vendor APIs (Google Gemini, DeepSeek, Qwen, Mistral) in rapid or parallel succession. - Persistence artifacts in Windows Run keys (`...\NT\CurrentVersion\Run`, `RunOnce`), rogue scheduled tasks, WMI event subscriptions, and PowerShell scripting in `C:\Windows\Temp\`. - Outbound Discord webhook callouts at regular 5–15 minute intervals, consistent with recurrent malware execution. Defang and block any Discord webhook URLs observed in network traffic. Proactive defenses include restricting PowerShell execution and preventing users outside IT from modifying scheduled tasks, registry autostart keys, or WMI subscriptions. Organizations should also consider blocking outbound access to AI provider APIs including Google Gemini, DeepSeek, Qwen, Mistral, as well as communications platforms such as Discord and Telegram when they are not required for business operations. Additionally, monitor for unrecognized login source locations using session tokens or credentials.