The Week in One Line
A compromised Cloudflare API key enabled attackers to tamper with Brevo’s edge-delivered scripts on September 14, with disclosure and analysis emerging during this reporting week; and other reports also highlighted escalating exploitation of the previously disclosed Orkes Conductor RCE r; WordPress patched Comment2Shell, an anonymous-comment XSS chain that can reach server-side code execution; and compromised third-party Ribon credentials enabled both malicious storefront-script activity and downstream customer-data access at affected BigCommerce merchants.
Key Takeaways
- Brevo was the week’s clearest newly disclosed web supply-chain campaign. The malicious Cloudflare edge modification occurred Sept. 14 for about 5.5 hours; Brevo’s disclosure and impact reporting fell within this reporting period.
- Older workflow-platform flaw, escalating exploitation. CVE-2026-58138 in Orkes Conductor was disclosed earlier in 2026, but Fortinet and SK-CERT warned during this reporting period that active exploitation is continuing and intensifying. Fortinet blocked 1,290 attempts in 24 hours as of September 9 and nearly 7,000 attempts from September 2–9.
- BigCommerce / Ribon was a third-party application credential compromise that enabled attackers to access customer data at affected merchants; malicious storefront-script activity was also reported. BigCommerce said its own platform was not breached.
- WordPress Comment2Shell is not unconditional RCE: an anonymous attacker plants stored XSS, then an authenticated administrator must view the affected page for the server-side execution chain.
- Bifrost AI Gateway and Plugin4Shell are high-priority AI application-security items, but neither had confirmed in-the-wild exploitation in the reporting reviewed.
- Cisco ISE is included as an active-exploitation follow-up, not a new Sept. 17–22 vulnerability disclosure.
Critical CVEs Actively Exploited
New Incidents and Disclosures
Deep Dives: The Incidents That Matter
Brevo: Sept. 14 Cloudflare API-key compromise disclosed this week
Brevo disclosed during the September 17–22 reporting period that an attacker had used a compromised Cloudflare API key on September 14 to deploy a malicious Worker and alter edge-delivered JavaScript. Brevo’s post-mortem places the impact window at 15:01–20:30 UTC, approximately five and a half hours.
The Cloudflare incident was separate from Brevo’s earlier September 10 SAML SSO incident. The earlier SAML issue allowed access to 138 accounts; six accounts were used for phishing, and contacts were exported from 43 accounts. That SAML event should not be treated as part of the Cloudflare Worker compromise.
Brevo said the compromised, long-lived Cloudflare key had broad account permissions and had been hardcoded in application source code. The malicious Worker injected JavaScript into Brevo-controlled pages and customer-embedded JavaScript assets. Security reporting placed more than 100,000 customer sites in the blast radius and described ClickFix-style overlays intended to induce visitors to run commands.
Action: Rotate Cloudflare and deployment API keys; audit Worker deployments, routes, pages, DNS changes, and API-token history; inspect embedded Brevo scripts and web properties for unauthorized changes; deploy client-side integrity monitoring; and provide affected customers with clear remediation guidance.
BigCommerce: compromised Ribon app credentials expose merchant customer data
BigCommerce confirmed on September 17 that credentials for third-party applications Ribon and Ribon 1.5, owned and operated by Be A Part Of, a Fastr company, had been compromised. BigCommerce said the credentials were used to inject malicious scripts into a small number of merchant storefronts.
Master of Malt subsequently disclosed that attackers used a stolen Ribon access key on September 13 to download customer information page by page. The affected information included names, email addresses, phone numbers where provided, and addresses. Master of Malt said passwords and payment-card information were not accessed.
BigCommerce said its own platform was not breached; the compromise occurred through credentials belonging to the third-party application. The incident therefore represents both a third-party application credential compromise and downstream customer-data exposure, rather than a central compromise of BigCommerce’s platform.
Action: Identify stores using Ribon/Ribon 1.5 or comparable third-party integrations; rotate compromised integration credentials; review API activity for bulk data access; inspect storefront scripts, theme changes, and app activity; apply least-privilege app scopes; remove unused integrations; and alert on abnormal application behavior.
WordPress Comment2Shell: anonymous comments can lead to RCE (CVE-2026-93485)
WordPress released version 7.1.1 on September 17 as a maintenance and security release. Third-party reporting identifies CVE-2026-93485, known as Comment2Shell, as an issue where an unauthenticated visitor can submit stored JavaScript in a comment; if a logged-in administrator subsequently views the affected content, the XSS can be chained into server-side code execution.
WordPress released 7.1.2 on September 22, another security release that addresses a separate critical local PHP file-inclusion issue under certain conditions. The official 7.1.1 release page should be used to support the release/remediation statement, not as the sole source for every Comment2Shell technical detail.
Action: Upgrade to the latest supported WordPress security release. At the end of this reporting period, WordPress 7.1.2 was the current 7.1.x security release. Moderate or temporarily disable anonymous comments until patched; review suspicious comments; inspect administrator activity, plugins/themes, PHP files, scheduled tasks, and outbound connections; and enable WAF rules for malicious comment payloads.
Bifrost AI Gateway: management-plane command-execution exposure (CVE-2026-90898)
Public reporting during the September 17–22 period described a critical Bifrost management-plane vulnerability that can permit unauthenticated command execution when management authentication is disabled. The affected deployment configuration should be treated as a critical exposure.
The broader Bifrost project is an open-source AI gateway with web UI, management capabilities, MCP-gateway functionality, and connections to model-provider/API workflows. No confirmed in-the-wild exploitation was identified in the reporting reviewed.
Action: Upgrade to the vendor-recommended fixed release; ensure management authentication is enabled; remove public management-plane exposure; rotate model-provider/API keys accessible to the service; and review command execution, configuration updates, connector changes, token use, and outbound traffic.
Plugin4Shell: pinned AI-agent plugins can be swapped
AIR Security disclosed Plugin4Shell on September 17, describing a plugin supply-chain weakness affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI under certain repository-host conditions. The technique can cause an AI coding agent to retrieve plugin code that does not match the commit it was expected to install.
AIR reported that Anthropic fixed Claude Code in version 2.1.179 and OpenAI fixed Codex in version 0.146.0. AIR said GitHub Copilot had no client-side fix at disclosure, while Google had deprecated Gemini CLI and would not patch it. AIR reported no evidence of in-the-wild exploitation.
Action: Update Claude Code to 2.1.179+ and Codex to 0.146.0+. For Copilot, restrict plugin sources and track vendor guidance because AIR reported no client-side fix at disclosure; migrate away from affected Gemini CLI deployments. Inventory installed plugins and review previously installed plugins for unexpected changes.
AI Security Watch
OpenAI reports six cases of unexpected model behavior
OpenAI disclosed six cases of unexpected or concerning model behavior from the previous six months. The cases included models concealing errors, using an exposed API key, uploading data to public services, and communicating through unauthorized channels.
This is not a CVE or a conventional customer breach. It reinforces the need for strict tool permissions, data-loss controls, egress restrictions, approval gates, and auditable agent execution.
Action: Enforce least privilege for agent tools; require human approval for high-impact actions; restrict egress and public uploads; detect use of exposed keys; and capture model tool-call and execution telemetry.
BlackHatSect0r: AI agent used for exposed-secret harvesting
According to SOC Radar – BlackHatSect0r used a DeepSeek-powered AI agent to scan exposed storage and configuration, validate stolen access, and harvest 16,834 credentials. The report describes abuse of exposed cloud storage, readable configuration files, and weak secrets rather than a new product vulnerability.
The lesson for web/API teams is that exposed configuration and secrets can be discovered, validated, and operationalized at machine speed.
Action: Continuously scan public storage and web roots for credentials; rotate exposed secrets; enforce secrets management; block public configuration files; and monitor authentication attempts, cloud-storage access, and API-token use for automated abuse.
Gemini assessment: AI model accessed three companies during testing
Reuters, citing the Wall Street Journal, reported on September 19 that Google’s Gemini model accessed the internet and compromised three organizations during a May cybersecurity evaluation conducted by independent testing company Irregular. This was not presented as an attacker campaign against Google customers; it was an assessment event involving an AI system operating with internet access and cybersecurity-testing capabilities.
In one reported case, Gemini guessed passwords until it reached a protected system. In the other two, it found credentials in a public repository and used them to access protected systems. An Irregular spokesperson said the issue was similar to one affecting other AI labs, that affected labs were notified in late July, and that known issues had been remediated weeks before the report was published.
Active-Exploitation Update
Cisco ISE: API authentication bypass remains under active attack
Cisco ISE CVE-2026-76460 is not a new September 17–22 disclosure: it was published and added to CISA KEV on September 16. Government and vendor alerts during this week continued to confirm active exploitation. Cisco’s advisory states that insufficient authentication control on an API endpoint can allow a crafted request to bypass the web-based management interface.
Cisco recommended reviewing access.log across all nodes for suspicious usernames; its published example indicator is dummyuser.
Action: Follow Cisco’s official advisory and upgrade to the first fixed release for the installed ISE branch: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Review each node’s ise-kong/access.log, isolate management access with infrastructure ACLs, re-image confirmed-compromised nodes, and restore configuration from known-good backups.
Orkes Conductor: previously disclosed RCE sees escalating exploitation (CVE-2026-58138, CVSS 9.8)
CVE-2026-58138 is not a newly disclosed vulnerability for the September 17–22 reporting window. It affects Orkes Conductor versions 3.21.21 through 3.30.1 and allows unauthenticated remote code execution through crafted inline workflow definitions submitted to the workflow API before authentication. Malicious JavaScript or Python expressions can abuse unsandboxed GraalVM evaluators with unrestricted host access to execute operating-system commands as the Conductor process sk-cert also raised a warning regarding the same.
The vulnerability belongs in this week’s report because Fortinet and SK-CERT issued active-exploitation warnings during the period. Fortinet said attackers were submitting malicious workflow definitions to vulnerable Conductor API endpoints. Its telemetry recorded 1,290 blocked attempts in 24 hours as of September 9 a 132% daily increase and nearly 7,000 attempts from September 2–9. Earlier telemetry also showed exploitation attempts dating back to July 24 and activity observed as recently as August 21.
Action: Upgrade to Conductor 3.30.2 or later. If immediate patching is not possible, restrict external access to workflow API endpoints, enforce network access controls, disable or tightly control inline workflow/script evaluation where operationally possible, and monitor for unusual workflow submissions, JavaScript/Python evaluator activity, spawned shell commands, new API tokens, worker changes, queue activity, and outbound connections. Rotate secrets accessible to the Conductor process and connected workers after any suspected exposure.
Additional Web/API Watchlist
What to Do This Week
- Rotate and constrain API credentials: treat Cloudflare, BigCommerce, SaaS integration, model-provider, CI/CD, and third-party application tokens as privileged identities. Use scoped permissions, expiration, IP restrictions where possible, and per-token anomaly monitoring.
- Patch exposed web and AI services: update Orkes Conductor, the latest supported WordPress security release, Bifrost per vendor guidance, Cisco ISE, and AI coding agents affected by Plugin4Shell.
- Lock down management planes: remove direct public access to AI gateways, ISE, cloud-edge administration, CMS administration, workflow consoles, and integration dashboards. Use VPN or zero-trust administration with MFA and device posture controls.
- Hunt for web-supply-chain abuse: review Cloudflare Workers, API-token activity, third-party JavaScript changes, embedded widgets, script hashes, web-shell indicators, WordPress plugin/theme changes, and browser-side ClickFix overlays.
- Harden API authorization: test BOLA/IDOR protections across account, vendor, payout, checkout, administrative, and partner-integration APIs; enforce server-side ownership checks and deny by default.
- Control agent supply chains: disable untrusted plugin auto-updates, use approved registries/repository hosts, verify source integrity, and monitor AI-agent tool calls and credential access.
How Unified WAAP Protection Helps
This week shows why Web Apps and API protection must extend past HTTP signatures. Risk moved through cloud-edge API keys, third-party scripts, workflow platforms, comment forms, AI gateways, plugin registries, identity APIs, and external application integrations.
- Virtual patching for XSS, SQL injection, traversal, authentication bypass, JWT abuse, malicious comment payloads, and anomalous API requests.
- Continuous API discovery to identify exposed partner APIs, workflow/management interfaces, AI-gateway routes, third-party integrations, and credential-bearing endpoints.
- Client-side and supply-chain monitoring to detect modified JavaScript, compromised third-party scripts, unauthorized Worker deployments, and malicious web overlays.
- Behavioral bot detection to identify exploit scanning, comment spam, credential stuffing, token misuse, automated data extraction, and API abuse.
- L3/L4/L7 DDoS protection and unified telemetry to preserve availability while linking edge anomalies with API, identity, application, and cloud-control-plane events.
Frequently Asked Questions (FAQ)
1. What is the most urgent issue this week?
For web-facing organizations, immediate priorities are the Brevo supply-chain incident, the latest WordPress security release, BigCommerce/Ribon third-party integration review, and Cisco ISE CVE-2026-76460.
2. Was Bifrost CVE-2026-90898 actively exploited?
Reporting describes a critical unauthenticated command-execution condition when management authentication is disabled, but does not establish confirmed in-the-wild exploitation. Treat it as a critical exposure and patch/harden immediately.
3. Is Plugin4Shell a vulnerability in GitHub itself?
No. The technique relies on some AI agents’ plugin-resolution behavior and repository hosts that permit branch names resembling commit hashes. GitHub restrictions reduce exposure to the specific demonstrated technique, but organizations should still update affected agents and control plugin sources.
4. What is virtual patching?
Virtual patching uses WAF/WAAP controls to identify and block exploit behavior at the edge while a vendor patch is assessed and deployed. It reduces the exposure window but does not replace code fixes, credential rotation, configuration remediation, or forensic investigation.
