Daily briefing · September 19, 2026
Calm Vulnerability Day Masks Serious Flaws in Routers, WordPress, and Suricata
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
September 19, 2026 registers as a calm day by the numbers — zero actively exploited CVEs, no weaponized code confirmed in circulation — but the 10 highlighted vulnerabilities carry substantial real-world risk, with multiple CVSS 9.4–10.0 flaws already accompanied by public proof-of-concept exploits. Defenders should not mistake a quiet threat-intelligence day for a safe one: critical flaws in Totolink routers, WordPress plugins, Perl's DBI library, and the Suricata IDS all demand prompt attention. Meanwhile, ransomware activity targeting Brazilian organizations continues at an elevated pace, dominated by groups such as akira, thegentlemen, and emperador.
Today’s brief
- Two Totolink A3002MU flaws (CVSS 10.0 and 9.4) with public PoC exploits enable remote buffer overflow and command injection — patch or isolate immediately.
- Botiga Pro WordPress plugin (CVSS 9.8) exposes unauthenticated REST routes, allowing full site takeover and stored XSS — update before 1.6.5.
- Two Suricata critical flaws (CVSS 9.4) — a use-after-free and a type confusion — can crash or destabilize IDS/IPS infrastructure running versions before 8.0.7.
- Brazil faces a surge of ransomware claims: at least seven Brazilian victims identified recently, spanning government, technology, retail, and hospitality sectors.
Critical highlights
1
A CVSS 10.0 buffer overflow in the Totolink A3002MU's formWlWds handler is remotely exploitable and already has a public proof-of-concept, making it an urgent patching priority for any network exposing this device to the internet.
2
The Botiga Pro WordPress plugin before 1.6.5 exposes an unauthenticated REST route that allows arbitrary WordPress option updates — enabling privilege escalation, full site takeover, and persistent stored XSS — with no authentication required whatsoever.
3
Perl's DBI library before 1.653 allows arbitrary module loading through unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM, meaning a crafted connection string can cause Perl to execute attacker-controlled code on the server.
4
A second Totolink A3002MU vulnerability (CVSS 9.4) enables remote OS command injection via the formWsc handler's localPin argument, with a public exploit already available — attackers can gain shell-level control of affected routers.
5
A use-after-free in Suricata before 8.0.7 is triggered when HTTP/2 response headers are inspected by rules using the http.response_header keyword with and without transforms, potentially crashing the detection engine and creating a blind spot for defenders.
6
A type confusion bug in Suricata's DoH2 handling before 8.0.7 can cause an invalid memory free when an HTTP1-to-HTTP2 upgrade occurs in a DoH2 session — the flaw is enabled by default in 8.x and could be used to crash or destabilize IDS deployments.
7
The D-Link R95 router is vulnerable to remote OS command injection through the NTPServer argument in the DHMAPI component, with a public exploit released — any internet-facing unit running BE9500_1.00.16 should be treated as compromised until patched or isolated.
8
OpenPanel's JavaScript webhook template validator fails to block computed member access to constructor chains, allowing any user with project write access to escape the sandbox and execute arbitrary code in the worker process — a significant supply-chain-style risk in multi-tenant environments.
9
The Welcomizer WordPress plugin through 2.8.1 combines a missing authorization check with an eval() call on user-supplied code, enabling any authenticated user to achieve Remote Code Execution on the hosting server — sites running this plugin should disable or remove it immediately.
10
The Ultimate Member WordPress plugin before 2.13.1 allows unauthenticated users to store JavaScript in profile names that bypasses sanitization via HTML entity decoding, executing in the context of any visitor — including administrators — who views the profile.
Ransomware today
Several ransomware groups have claimed Brazilian victims in recent days, with akira hitting both Vetta (Technology) and Javep Chevrolet (Retail), while emperor claimed the Cassias MG Government and thegentlemen targeted Multipla Contabilidade Empresarial. Other groups active against Brazilian targets include arcusmedia (AKAZZO), Panzer (K3G Solutions Brazil), N0n (Konnatus), and settra (fchhotels.com). Over the past 30 days, thegentlemen leads in Brazil-focused activity with 9 claimed victims, underscoring a sustained and deliberate targeting of Brazilian organizations across multiple sectors.
AKAZZO BRarcusmedia
Cassias MG Government BRemperador · Government & Defense
K3G Solutions Brazil BRPanzer · Other
Konnatus (usucapião legal services) BRN0n · Professional Services
Vetta BRakira · Technology
Javep Chevrolet BRakira · Retail & E-Commerce
fchhotels.com BRsettra · Hospitality
thegentlemen 9krybit 3emperador 2Vexy Ransomware 2akira 2settra 2
Active groups & APTs
Several threat actor groups are currently tracked as active or updated in threat-intelligence feeds: mosesstaff (Iran-linked), siegedsec (Russia-linked), sinobi, spacebears, thegentlemen, and funksec. While no specific new victims are attributed to these actors in today's data window, their continued operational status signals ongoing reconnaissance and targeting campaigns that defenders should monitor closely.
Brazil focus
Brazil is clearly a high-priority target for ransomware operators right now, with at least eight Brazilian organizations claimed as victims in recent days spanning government (Cassias MG Government), professional services (Konnatus, Multipla Contabilidade Empresarial), technology (Vetta), retail (Javep Chevrolet), hospitality (fchhotels.com), and other sectors. The breadth of targeted industries — from municipal government to legal services to hotel chains — indicates opportunistic mass targeting rather than sector-specific campaigns, meaning no vertical is low-risk. Organizations in Brazil should treat ransomware exposure as an active and immediate threat.
Cassias MG Governmentemperador · Government & Defense
AKAZZOarcusmedia
Vettaakira · Technology
Konnatus (usucapião legal services)N0n · Professional Services
K3G Solutions BrazilPanzer · Other
Javep Chevroletakira · Retail & E-Commerce
fchhotels.comsettra · Hospitality
Multipla Contabilidade Empresarialthegentlemen · Professional Services
Today’s recommendation: Prioritize patching the two Totolink A3002MU CVEs and the Botiga Pro and Welcomizer WordPress plugin flaws, all of which carry public proof-of-concept exploits and require no authentication to trigger; simultaneously upgrade Suricata to 8.0.7 or later to prevent detection-engine disruption that could blind your network monitoring during an active incident.
With critical flaws spanning routers, IDS engines, and popular CMS plugins — many already carrying public exploits — now is the right moment to validate your own attack surface and confirm which of these assets are actually reachable and unpatched in your environment.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →