North Korea Stole $351M From Bitget. Cloudflare Let Customers Read Each Other’s Data. Shai-Hulud Is Back in GitHub Actions. A Zero-Permission App Just Rooted a OnePlus 15.

Cryptocurrency exchange Bitget disclosed that suspected North Korean threat actors compromised its backend systems and drained $351.6 million from hot and warm wallets on September 24. Security systems detected the intrusion at 18:31 UTC. The funds were already moving. This is the largest single cryptocurrency exchange theft attributed to North Korean actors since the 2022 Ronin Network breach, and it continues the documented pattern of DPRK-linked operators treating cryptocurrency infrastructure as state revenue generation.

Hot and warm wallets are operationally active cryptocurrency storage used to process customer withdrawals. Cold storage was not affected because it is offline and unreachable through a network-connected backend. Exchanges cannot avoid maintaining hot wallets: they are required to process transactions. That operational necessity is the attack surface. The Bitget attackers targeted the connected infrastructure precisely because that is where spendable funds live at any given moment.

Executing a $351.6 million theft without triggering fraud controls requires precise knowledge of the target’s withdrawal processing, thresholds, and monitoring architecture. This is an operation that was planned and researched before execution, consistent with DPRK crypto theft teams’ documented pattern of extended reconnaissance before major heists. Exchanges should review backend access controls, multisignature requirements for large movements, and whether hot wallet balances are minimized to operational requirements rather than held at unnecessarily large balances.

A cross-tenant data exposure vulnerability in Cloudflare Containers was disclosed and patched this week. Disk storage that was not properly wiped between customer container sessions left residual data accessible to the next customer whose container ran on the same physical server. One paying customer could read what another paying customer’s container left on disk during its operation.

The multi-tenant isolation model is the foundational security assumption of shared cloud infrastructure. Customers processing sensitive data through a cloud platform trust that their data will not be accessible to other tenants on the same hardware. When that isolation fails at the disk layer, the model that justifies shared infrastructure breaks down in a way that is difficult to detect and potentially impossible to retroactively audit. Affected customers cannot know exactly what was left accessible or who accessed it.

Cloudflare disclosed the flaw alongside the researchers who found it and has corrected the disk management behavior. Customers who processed sensitive data through Cloudflare Containers before the patch should assess whether the nature of that data warrants breach notification review under applicable regulatory frameworks, because the window of potential cross-tenant access cannot be precisely bounded.

CISA added SharePoint Server and MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, confirming active in-the-wild exploitation of both. This is approximately the sixth SharePoint vulnerability under active exploitation documented in this publication since July. The characterization is no longer exceptional. SharePoint is under sustained, continuous exploitation pressure from multiple threat actor groups operating simultaneously. MikroTik’s repeated appearance across advisories and now the KEV catalog reflects the same pattern in the router infrastructure space.

KEV designation carries a specific meaning that is worth restating: the vulnerability is confirmed to be exploited in real attacks against real targets right now. Organizations that are still treating KEV-listed vulnerabilities as items in a standard patch queue are misreading the signal. The window for remediation before the first exploitation is closed. The remaining question is whether your specific deployment has been targeted, and whether forensic review of logs since the vulnerability’s disclosure would surface evidence of compromise.

Sixth SharePoint KEV in three months. This is a campaign, not a series of coincidences. Treat it accordingly.

Two GitHub Actions repositories from the actions-cool organization that were compromised during the May 2026 Mini Shai-Hulud campaign became accessible again last week, months after being disabled following the original discovery. While accessible, they resumed executing Mini Shai-Hulud malware in any CI/CD pipeline that still referenced them. GitHub disabled them a second time after the resumed activity was discovered.

The structural lesson is about dependency architecture. CI/CD pipelines that reference external GitHub Actions by mutable version tags, rather than pinned commit hashes, remain permanently dependent on the security of those external repositories. A repository that is safe today can be compromised tomorrow. A repository that was disabled and believed contained can come back. Pinning to specific commit hashes is the only architectural choice that eliminates this ongoing dependency risk.

Kiteworks, the managed file transfer and secure content collaboration platform formerly known as Accellion, issued an emergency advisory instructing customers to take their systems offline for nine hours after the company received credible threat intelligence about an imminent cyberattack targeting its infrastructure or customer deployments. Kiteworks did not confirm a breach in the advisory. The nine-hour shutdown window was presented as a precautionary measure.

Kiteworks carries specific historical weight in this threat category. Its predecessor, Accellion, was at the center of one of the most significant managed file transfer compromise campaigns in recent years, in which threat actors exploited vulnerabilities in the legacy FTA product to steal sensitive files from dozens of organizations across law firms, financial institutions, healthcare providers, and government agencies. That history makes Kiteworks infrastructure a demonstrated high-value target, and it makes received threat intelligence about imminent attacks against that infrastructure credible in a way that a similar advisory from a less-targeted platform would not be.

Organizations do not issue nine-hour shutdown instructions based on weak intelligence. The disruption cost of taking managed file transfer infrastructure offline for nine hours is significant. Issuing that instruction reflects a threat picture serious enough to justify accepting that disruption as the preferable outcome compared to the alternative.

Canada’s Centre for Cyber Security warned this week that CVE-2026-48842, a pre-authentication SQL injection flaw in Roundcube Webmail with a CVSS score of 8.1, is being actively exploited in the wild. Roundcube is widely deployed in government, education, and organizational environments that self-host email outside the Microsoft and Google ecosystems. A pre-auth SQL injection means an unauthenticated attacker can manipulate the database layer without any credentials, potentially extracting email content, contact data, calendar entries, and in some configurations, authentication credential hashes from the underlying database.

Active exploitation confirmed by a national cyber security center means this is not a hypothetical exposure. Real Roundcube deployments are being targeted right now by actors using this specific vulnerability. The patch is available. Organizations running unpatched Roundcube installations should treat this as an emergency remediation item and audit server logs for exploitation attempts reaching the vulnerable endpoint from unauthenticated sessions.

Google warned this week of renewed mass exploitation of a known Oracle PeopleSoft vulnerability across multiple global sectors, with activity linked to ShinyHunters. The campaign involves bypassing web application firewalls to reach the vulnerable endpoint and deploying persistent web shells. PeopleSoft is enterprise HR, financial management, and supply chain software. A web shell on a PeopleSoft server sits adjacent to payroll data, employee personal information, financial records, and in university deployments, student records and research data.

The WAF bypass is the operationally significant detail. Many organizations deploy web application firewalls as compensating controls for unpatched vulnerabilities, treating WAF rules as equivalent protection to the underlying patch. They are not. ShinyHunters bypassed the WAF rules in this campaign, reaching the vulnerable endpoint despite the presence of WAF infrastructure that was believed to be blocking it. Organizations relying on WAF coverage for PeopleSoft instead of applying the underlying patch need to revise that risk assessment immediately.

Researcher Rasmus Moorats chained two vulnerabilities in OnePlus’s own OxygenOS software to achieve root access on a fully updated OnePlus 15. The attack is executed by a malicious application that the user installs, an application that requests no permissions during installation. Zero. Not a suspicious list of permissions the user might question. Nothing. The app installs without any visible warning, chains the two OxygenOS flaws, and achieves root.

The zero-permission signature is specifically designed to defeat the permission review habit that security awareness programs teach Android users. The trained defensive behavior is: review the permissions, be cautious about apps requesting excessive access. ChainScript does not request access. There is no permission prompt to scrutinize. The attack exploits the absence of the signal users have been taught to look for.

Zero permissions requested. Full root achieved. The permission model is the primary user-visible security gate Android provides. This attack specifically routes around it.

OnePlus has not issued a patch at time of publication. OnePlus 15 users should be cautious about installing applications from outside the Play Store or from unknown developers while the flaw is unpatched. The installation event itself is the only moment where user behavior can interrupt the attack chain, because everything after installation executes without any further user interaction.

A high-severity cross-site request forgery vulnerability in the Elementor Website Builder plugin allows an unauthenticated attacker to create rogue administrator accounts on a WordPress site, requiring only that a logged-in administrator clicks a single crafted malicious link. No authentication needed. No prior access. No knowledge of the administrator’s credentials. One link, one click from a logged-in admin, and the attacker holds a new administrator account on the site.

Elementor is installed on tens of millions of WordPress sites globally. A CSRF vulnerability at that deployment scale, with this attack consequence, delivered through any medium that can get a link in front of a WordPress administrator, is one of the broadest single-click attack surfaces in the WordPress ecosystem. Email, direct messages, comments on the administrator’s own site, social media, and even search results manipulated through poisoning are all viable delivery mechanisms for the crafted link.

The patch is available. WordPress administrators running Elementor should update immediately and audit their WordPress user management for any administrator accounts created in the period before patching that they do not recognize as legitimate.

Jamf Threat Labs documented a new PamStealer version implementing server-side payload decryption. The main malware payload can only be recovered through a live decryption chain requiring active C2 contact. Security researchers analyzing the sample in an air-gapped sandbox or without internet access retrieve encrypted data with no locally available key. The decryption only completes during a live infection session with the C2 infrastructure.

PamStealer was first documented in July for its PAM-level authentication interception on macOS. The server-side decryption addition is a targeted response to that public documentation. When a new malware family is publicly analyzed, security vendors build detection signatures from the analyzed artifacts. PamStealer’s operators have made those artifacts significantly less useful by ensuring the actual payload never exists in decryptable form outside of live infection sessions.

Multi-layer persistence additions mean that removing one persistence mechanism does not clear the infection. Suspected PamStealer infections require full forensic review to identify every persistence location rather than surface-level cleanup, because the multi-layer architecture is explicitly designed to survive incomplete remediation.

CISA added both WSO2 API Manager and Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalog this week, confirming active exploitation of both. Both platforms have been covered in recent editions of this publication. Their KEV addition is the formal confirmation of what incident responders had already been observing. Organizations running either without current patches are operating confirmed-exploited infrastructure.

The SOC economics shift is worth naming directly: AI has made failed cyberattacks cheap enough to retry indefinitely. The traditional constraint that limited attack volume was the human cost of operating a campaign. That constraint is gone for AI-assisted attack operations. A failed attack attempt is a data point incorporated into the next iteration, which arrives faster and with variations that previous attempts inform. Security operations centers calibrated for human-paced attack campaigns are receiving a fundamentally different signal from AI-assisted campaigns and need detection logic updated for that reality.

The alert that did not resolve because the first attempt failed is now followed by a second attempt faster than the SOC team processes the first alert. That compression is not a future concern. It is the current operating environment for enterprise security teams, visible in the alert queues of organizations that have been tracking AI-assisted attack patterns since early 2026.