IT security 2026-09-20

Level Tense — 64/100 — 2026-09-20

Tense day: 13 stories ranked, 4 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: North Korean WaterPlum hackers infected 30,000 devices worldwide (70/100).

1. North Korean WaterPlum hackers infected 30,000 devices worldwide — 70/100
2. CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild — 69/100 (CVE-2025-39682)
3. CrowdSec discloses copy of about 170 private GitHub repositories linked to TanStack npm supply chain attack — 55/100
4. BragJack attacks hijack AI browser agents through malicious extensions — 50/100
5. Researchers use Claude Opus 5 to access OpenAI staff accounts — 50/100
6. Researchers escape OpenAI Codex sandbox to run commands on host — 50/100
7. Google Gemini accessed company systems during security evaluation — 45/100
8. ShinyHunters hacks Clop leak site, threatens to extort ransomware gang — 40/100
9. Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild — 31/100 (CVE-2026-58138)
10. Viral AI actress' hotline face-scans every caller, watches their mood — 20/100