Threat Intelligence Brief - Friday, September 18, 2026

Threat Radar

• Active exploitation confirmed: CVE-2026-58138, an unauthenticated RCE in Orkes Conductor, is being weaponized in the wild via inline workflow definitions — environments running this orchestration platform face immediate risk of full system compromise.

• Supply chain pressure intensifies: A single compromised Brevo API key enabled attackers to inject malicious scripts into 100,000 websites via a Cloudflare worker. SaaS credential exposure translates directly into mass downstream impact.

• npm ecosystem under coordinated attack: Two distinct JavaScript infostealers — WeaselBiscuit (13 packages, targeting Chrome extension storage) and PhantomRaven (LLM-assisted development) — are actively circulating in npm, threatening developer environments and enterprise credentials.

• Check Point management systems need patching now: A critical root-level RCE flaw in Check Point management infrastructure has been patched; exploitation status is unconfirmed. Given the target’s role in perimeter control, treat this as high urgency.

• 23 million Gyazo records exposed: Helpfeel confirmed attackers exploited a vulnerability in the image upload server to exfiltrate user data at scale. Public-facing file handling services remain a reliable attacker entry point.

• LLM-assisted malware development is operational: PhantomRaven’s development is assessed with high confidence to have used an LLM, signaling a material drop in the barrier to producing functional infostealers.

Immediate Action Required

• Orkes Conductor — CVE-2026-58138 (Active Exploitation): If your environment runs Orkes Conductor, treat this as a P1. Exploitation is confirmed and the attack vector is unauthenticated. Isolate exposed instances, apply vendor patches immediately, and review workflow definitions for signs of tampering. T1190, T1059

• Brevo API Key Compromise — SaaS Credential Audit: Any organization integrating Brevo should immediately audit API key issuance, rotate credentials, and verify whether Cloudflare worker configurations have been modified. Extend this review to all high-privilege SaaS API keys with write or deployment access. T1199, T1566

• npm Dependency Audit — WeaselBiscuit & PhantomRaven: Engineering and AppSec teams should audit npm dependencies for the 13 WeaselBiscuit packages and any PhantomRaven-linked packages. Developer workstations and CI/CD pipelines that installed affected packages should be treated as potentially compromised. T1005, T1113

• Check Point Management Systems — Apply Patches This Week: Patch Check Point management systems against the newly disclosed root RCE vulnerability. Exploitation is unconfirmed but severity and target profile warrant no delay. T1548, T1059

High-Impact Developments

Orkes Conductor Unauthenticated RCE Actively Exploited (CVE-2026-58138)

• What happened: Attackers are actively exploiting CVE-2026-58138, an unauthenticated remote code execution vulnerability in Orkes Conductor, a workflow orchestration platform. The attack vector is inline workflow definitions, requiring no authentication to trigger.

• Why it matters: Unauthenticated RCE in orchestration infrastructure is a worst-case scenario. Successful exploitation can pivot laterally to any system the orchestrator touches — connected data pipelines, APIs, and backend services are all at risk.

• Who should care: Security operations, application security, and IT operations teams running Orkes Conductor in any environment, including cloud-hosted instances.

• Recommended action: Patch immediately. Isolate Conductor instances from broader network access where possible. Review recent workflow execution logs for anomalous inline definitions. Confirm no unauthorized code execution has occurred.

• Confidence: High — active exploitation confirmed by SecurityWeek reporting.

• Search metadata: CVE-2026-58138, T1190, T1059, Orkes Conductor, Orkes

Intelligence Context

• Critical Orkes Conductor Vulnerability Exploited in Attacks — SecurityWeek
  • Context: Confirms active exploitation of CVE-2026-58138 via inline workflow definitions, with the vulnerability enabling unauthenticated code execution on affected Orkes Conductor deployments.

Brevo Supply Chain Attack Compromises 100,000 Websites via Single API Key

• What happened: Attackers obtained a compromised Brevo API key and used it to deploy a malicious Cloudflare worker that injected scripts into approximately 100,000 websites integrated with the Brevo platform.

• Why it matters: One stolen credential, combined with legitimate cloud infrastructure, produced mass website compromise affecting potentially millions of end users. No vulnerability in Brevo or Cloudflare was required — only a stolen key. This is third-party SaaS risk at scale.

• Who should care: Security leadership, cloud security teams, and any organization using Brevo for email marketing or customer communications. The broader lesson applies to all organizations with high-privilege SaaS API integrations.

• Recommended action: Rotate all Brevo API keys. Audit Cloudflare worker deployments for unauthorized modifications. Implement API key scoping and monitoring across SaaS integrations. Determine whether your organization’s websites were among those affected.

• Confidence: High — confirmed active attack reported by SecurityWeek.

• Search metadata: T1199, T1566, Brevo, Cloudflare

Intelligence Context

• Brevo Supply Chain Attack Injects Malware Into 100,000 Websites — SecurityWeek
  • Context: Reports that a compromised Brevo API key was used to deploy a Cloudflare worker injecting malicious scripts across 100,000 websites, confirming the attack is active and at scale.

Dual npm Infostealer Campaign: WeaselBiscuit and PhantomRaven

• What happened: Two separate JavaScript infostealers were distributed through the npm package registry. WeaselBiscuit was embedded across 13 packages and specifically targets Chrome extension storage to harvest credentials. PhantomRaven was distributed by a financially motivated actor assessed with high confidence to have used an LLM to write the malware, posing as a bug bounty hunter.

• Why it matters: WeaselBiscuit’s focus on Chrome extension storage is notable — extensions routinely hold session tokens, crypto wallet keys, and authentication credentials. PhantomRaven’s LLM-assisted development signals a declining cost and skill barrier for producing functional malware, which will likely increase campaign volume.

• Who should care: Software development teams, security operations, IAM teams, and any organization with Node.js-based development pipelines or CI/CD systems pulling from npm.

• Recommended action: Audit npm dependencies immediately for the identified malicious packages. Treat any developer workstation or pipeline that installed affected packages as potentially compromised and review for credential exposure. Enforce package integrity checks and consider private registry mirroring for critical dependencies.

• Confidence: High — both malware families confirmed active by The Hacker News reporting.

• Search metadata: T1005, T1113, WeaselBiscuit, PhantomRaven, npm, JavaScript, infostealer

Intelligence Context

• WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage — The Hacker News
  • Context: Details the discovery of WeaselBiscuit across 13 npm packages, with the malware specifically designed to harvest Chrome extension storage and showing functional overlaps with previously known strains.
• Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer — The Hacker News
  • Context: Reports that PhantomRaven was distributed via npm by a financially motivated actor who likely used an LLM to develop the infostealer, representing an emerging trend in lowered malware development barriers.

Check Point Critical Root RCE — Patches Available, Exploitation Status Unconfirmed

• What happened: Check Point released security updates addressing a critical vulnerability that allows attackers to execute code with root privileges on Check Point management systems. Exploitation in the wild has not been confirmed at time of reporting.

• Why it matters: Check Point management systems sit at the heart of network perimeter controls. Root-level code execution on these systems could allow an attacker to modify firewall rules, intercept traffic, or pivot into protected network segments. Severity and target profile make this a high-priority patch regardless of confirmed exploitation.

• Who should care: Security operations, network security, and IT operations teams responsible for Check Point infrastructure.

• Recommended action: Apply Check Point’s security updates this week. Prioritize internet-exposed or externally reachable management interfaces. Monitor for anomalous administrative activity on management systems while patching is in progress.

• Confidence: High — patch confirmed released by Check Point; exploitation status unknown.

• Search metadata: T1548, T1059, Check Point, privilege escalation, remote code execution

Intelligence Context

• New Check Point flaw lets hackers execute code with root privileges — Bleeping Computer
  • Context: Confirms Check Point has released patches for a critical root RCE vulnerability affecting management systems, with exploitation status unconfirmed at time of publication.

Monitor Only

• Gyazo (Helpfeel) disclosed a breach exposing 23 million user records after attackers exploited a vulnerability in the image upload server; if Gyazo is used in your organization or by employees, assess credential reuse risk and monitor for downstream phishing using exposed data. Source: 23 Million User Records Compromised in Gyazo Data Breach — SecurityWeek

Analyst Observation

Three of five stories in this brief involve attackers successfully weaponizing trusted ecosystems — npm, a SaaS email platform, and a workflow orchestration tool — to achieve broad impact with minimal friction. The Brevo incident is the clearest illustration: no zero-day, no sophisticated intrusion, just a stolen API key and legitimate cloud infrastructure turned against 100,000 websites. The PhantomRaven story warrants operational attention beyond the immediate campaign — LLM-assisted malware development is being assessed with high confidence in active attacks, not theoretical scenarios. That signals higher volume and broader variety of commodity malware targeting developer toolchains going forward. The Orkes Conductor exploitation remains the most urgent item in this brief. Unauthenticated RCE in orchestration infrastructure with confirmed active exploitation is a P1 — not a watch-and-wait situation.

Source Links

• Critical Orkes Conductor Vulnerability Exploited in Attacks — SecurityWeek

• Brevo Supply Chain Attack Injects Malware Into 100,000 Websites — SecurityWeek

• WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage — The Hacker News

• Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer — The Hacker News

• New Check Point flaw lets hackers execute code with root privileges — Bleeping Computer

• 23 Million User Records Compromised in Gyazo Data Breach — SecurityWeek

Generated by DevSecOpsDadAttack cyber threat intelligence.