Security Risk Advisors

OpenSourceMalware published research on September 17, 2026 on WeaselBiscuit, a newly identified Node.js infostealer distributed through malicious npm packages, with packages first seen between September 12 and September 16, 2026. The name is researcher assigned and is not an established family name. The researchers tentatively link it to DPRK based on overlap with Contagious ...

Air Security published research on September 17, 2026 describing Plugin4Shell, a high severity remote code execution vulnerability affecting the plugin systems of Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The vulnerability is a SHA pinning bypass: each agent checks out the pinned commit for a marketplace plugin but never verifies the checkout landed there, so...

Huntress investigated two incidents involving Settra, a newer ransomware variant first observed in June 2026. The incidents occurred in July and September across consumer services and retail and manufacturing environments. Huntress could not confirm the initial access method in either case, although separate public reporting has associated Settra activity with compromised VPN...

Zscaler ThreatLabz identified Operation RapidRust, a new campaign attributed to the Pakistan-nexus threat actor APT36 targeting government and defense organizations in India and Afghanistan. Observed activity includes several newly identified tools: RUSTYSHADE, a Rust-based Windows backdoor; RUSTYMOVE, a removable-media propagation tool; and PSNATCH and BASHNATCH, file-steali...

CISA released new guidance on using cyber decoys to improve detection and response, particularly after an attacker has already gained an internal foothold. The guidance positions decoys as a complementary control within Zero Trust architectures, where organizations assume compromise is possible and continuously verify activity. CISA distinguishes among decoys such as tripwire...