Sunday, September 20, 2026|Issue 2|6 min read|Join the discussion
The orchestrator is now the attack surface
Active exploitation hits workflow automation, SolarWinds patches an identity-management RCE, and the week closes with fresh lessons in developer trust, AI containment, and vulnerability overload.
The short version
- Orkes Conductor CVE-2026-58138 is under active exploitation; vulnerable workflow servers before 3.30.2 can be hit with unauthenticated OS-command execution.
- SolarWinds fixed CVE-2026-28326 in Access Rights Manager 2026.2.1, an unauthenticated RCE caused by a hard-coded static key; the vendor has not reported exploitation.
- CISA's three newly KEV-listed Linux kernel flaws remain on a September 21 federal remediation clock.
- AI-assisted vulnerability discovery is accelerating the volume problem: defenders increasingly need exploitation, exposure and asset authority to prioritize what gets fixed first.
Issue at a glance
1 critical2 high1 notable
- criticalVulnerabilityOrkes Conductor pre-auth RCE is being actively exploited
- highIdentitySolarWinds patches unauthenticated RCE in Access Rights Manager
- highIdentityGyazo breach exposes authentication data and massive image metadata set
- notableRansomwareShinyHunters turns extortion tactics against Clop
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2025-39682 | Linux Kernel | kTLS receive-path flaw associated with memory disclosure or denial of service; CISA lists active exploitation. | critical |
| CVE-2026-53266 | Linux Kernel | ebtables SNAT out-of-bounds write with privilege-escalation impact; CISA lists active exploitation. | high |
| CVE-2025-39964 | Linux Kernel | AF_ALG race condition affecting availability and cryptographic integrity; CISA lists active exploitation. | high |
Also on the vulnerability desk
- CVE-2026-58138 in Orkes Conductor is being exploited, but Fortinet's September 18 outbreak alert says it is not currently in CISA KEV. Upgrade to 3.30.2 or later and restrict workflow API exposure.
- SolarWinds ARM 2026.2.1 fixes CVE-2026-28326, an unauthenticated RCE stemming from a hard-coded static key. SolarWinds does not report in-the-wild exploitation in its release notes.
CISA KEV reporting and current federal remediation guidance|Fortinet FortiRecon|SolarWinds ARM 2026.2.1 Release Notes
Breaking
vulnerability / workflow / automation / active exploitation
Orkes Conductor pre-auth RCE is being actively exploited
Fortinet says attackers are actively targeting CVE-2026-58138 in Orkes Conductor. Vulnerable versions from 3.21.21 before 3.30.2 can accept malicious inline workflow definitions before authentication; unrestricted GraalVM host access can turn JavaScript or Python expressions into operating-system command execution. Fortinet reported 1,290 blocked attempts in one 24-hour period and nearly 7,000 between September 2 and 9.
Why it matters. Workflow orchestrators routinely connect to internal APIs, microservices, databases and automation credentials. The danger is not only the Conductor host itself; it is the authority and reach that an orchestration server may possess downstream.
What to do. Upgrade to Conductor 3.30.2 or later. Remove direct internet exposure from workflow API endpoints, inspect recent workflow submissions and hunt for unexpected child processes or outbound connections from the Conductor service. Treat a previously exposed vulnerable instance as an incident candidate, not just a patch ticket.
CVE-2026-58138
SolarWinds / IAM / identity security / patch
SolarWinds patches unauthenticated RCE in Access Rights Manager
SolarWinds ARM 2026.2.1 fixes CVE-2026-28326, rated CVSS 8.8. The company says the unauthenticated remote-code-execution issue stems from a hard-coded static key. ARM 2026.2.1 was released September 17; public reporting notes no vendor statement of active exploitation.
Why it matters. Access Rights Manager sits close to Active Directory and enterprise authorization workflows. Identity-management infrastructure deserves higher criticality because compromise can expose the systems that decide who has access to what.
What to do. Upgrade ARM to 2026.2.1, restrict management-plane reachability and review the deployment for unusual access. Do not label this KEV or actively exploited unless new evidence emerges.
CVE-2026-28326
SolarWinds ARM 2026.2.1 Release Notes|Canadian Centre for Cyber Security
data breach / privacy / identity
Gyazo breach exposes authentication data and massive image metadata set
Gyazo operator Helpfeel says unauthorized access exposed data relating to approximately 23.62 million users and metadata for roughly 490 million images, plus about 2.4 million additional metadata records under narrower conditions. Exposed user fields can include email addresses, password hashes, device and login-session IDs and, for some users, integration information. The company says payment-card information was not exposed.
Why it matters. Image metadata can be surprisingly sensitive: source IPs, EXIF location, OCR text and identifiers used to construct image URLs can create privacy and secondary-access risks well beyond a conventional account database leak.
What to do. Gyazo users should change their password and any reused or similar passwords, distrust unsolicited breach-themed messages, and review old sensitive Gyazo links. Security teams should treat exposed session and integration data as an identity-risk problem, not merely a privacy notification.
ransomware / cybercrime / threat intelligence
ShinyHunters turns extortion tactics against Clop
ShinyHunters has defaced Clop's Tor leak site, an unusual case of one major extortion ecosystem actor attacking another. Independent reporting has confirmed the defacement; broader ShinyHunters claims that it stole server data and onion-service private keys remain unverified.
Why it matters. Criminal infrastructure is itself vulnerable infrastructure. If the broader claims prove true, exposed logs or operational data could reveal victim communications, infrastructure or relationships inside the ransomware ecosystem.
What to do. Threat-intelligence teams should separate confirmed facts from actor claims and watch for infrastructure changes, leaked operational data and downstream effects on Clop victim communications. Do not treat the claimed data theft or private-key theft as confirmed yet.
Trends
AI is turning vulnerability volume into a prioritization problem
The number of disclosed vulnerabilities is rising sharply as AI-assisted research lowers the cost of finding software flaws. The operational bottleneck is shifting from discovery to remediation: humans still have to determine exposure, test fixes, schedule downtime and investigate compromise. The practical answer is not 'patch everything faster' but exploitation-aware prioritization: KEV status, internet exposure, privilege gained, asset authority and business impact should decide the queue.
AI infrastructure is pulling networking back to center stage
The AI buildout is increasing demand for fiber, optics and high-capacity data-center interconnects. The useful infrastructure lesson is simple: accelerator performance is constrained by how efficiently data can move between systems. Cloud and network engineers should expect AI capacity planning to include fabric design, optical connectivity, latency and power alongside GPU counts.
Frontier AI competition keeps colliding with safety pressure
Reuters reports Anthropic is considering another model release as competitive pressure intensifies around frontier systems. For enterprise buyers, rapid model turnover reinforces the need for model-agnostic governance: data-retention requirements, evaluation gates, scoped agent permissions and rollback plans should survive whichever model leads the benchmark table this month.
Clearance corner
DPRK 'Contagious Interview' remains a hiring-security problem
The FBI's September 18 alert says the North Korean WaterPlum group, commonly tracked as Contagious Interview, targets IT professionals in the United States, Japan, Europe and elsewhere through fraudulent employment activity, harvesting sensitive information and stealing cryptocurrency. For cleared contractors and defense-adjacent technology teams, recruiting workflows are part of the attack surface: validate candidate identity, isolate coding assessments and treat unexpected repositories, packages and take-home projects as untrusted content.
What we are watching next
September 21 Linux KEV deadline
Confirm remediation of the three actively exploited Linux kernel CVEs and verify that patched hosts actually rebooted into fixed kernels where required.
Orkes Conductor KEV status
Fortinet currently says CVE-2026-58138 is not in CISA KEV. Watch for a catalog addition or new post-exploitation evidence as active scanning continues.
SolarWinds ARM exploitation evidence
CVE-2026-28326 is serious but should remain labeled patched/no confirmed exploitation unless vendor, CISA or credible incident-response evidence changes that status.
Clop infrastructure fallout
Watch for independent confirmation of ShinyHunters' claims about stolen server data or Tor private keys, and for any resulting changes to Clop infrastructure.
AI vulnerability-discovery pressure
Track whether vendors and CISA accelerate exploitation-aware triage as AI-assisted discovery continues increasing the number of vulnerabilities defenders must process.
Sources
Join the discussion
Loading comments…