F5 BIG-IP Zero-Day Exploited, Plus Critical cPanel, Ubuntu, Chrome, and Next.js Flaws

F5 BIG-IP APM Zero-Day Is Being Exploited Now

F5's latest security update addresses a BIG-IP Access Policy Manager zero-day, and below we walk through which OAuth configurations are exposed, what signs of compromise to look for, and how to patch or mitigate.

What You Need to Know

F5 has released security updates for CVE-2026-94127, a critical remote code execution vulnerability in BIG-IP Access Policy Manager (APM), and has confirmed it has been exploited in attacks. CISA added the flaw to its KEV Catalog on September 22 and gave federal civilian executive branch agencies until September 25 to remediate. Any organization running APM as an OAuth Authorization Server should treat this as an emergency patch.

What’s Vulnerable

The vulnerability affects BIG-IP APM deployments configured as an OAuth Authorization Server, where both an APM access policy and an OAuth profile are associated with a virtual server. Organizations that use APM strictly as an OAuth Client or Resource Server, without OAuth Authorization Server profiles, are not affected.F5 has advised administrators to look for a specific pattern that may indicate compromise: multiple OAuth authentication failures and suspicious commands, followed by a Traffic Management Microkernel (TMM) SIGABRT event. Prioritize this sequence for review in appliance logs, centralized logging platforms, and incident-response telemetry.Shadowserver has observed more than 14,700 internet-exposed IP addresses with BIG-IP APM fingerprints. That number does not tell us how many systems are vulnerable, patched, or actually research infrastructure and honeypots. Still, it does show how much of this technology sits on the open internet.

Why This Matters

BIG-IP APM is commonly placed at the edge of enterprise environments to broker secure access to networks, applications, cloud resources, and APIs. That position makes it a high-value foothold. An attacker who compromises it may bypass normal access controls or use it as a launch point for internal discovery and lateral movement. CISA’s accelerated three-day deadline reflects the risk of exposed authentication and application-delivery infrastructure. F5 products also have a long history of targeting by both cybercriminal and state-sponsored actors, so public disclosure and KEV inclusion should be expected to drive broader scanning and exploitation.

What to Do

Start by identifying every BIG-IP APM virtual server configured with OAuth Authorization Server functionality, and confirm whether it has both an APM access policy and an OAuth profile. Apply F5’s security update to affected devices as the primary fix. If you cannot patch immediately, F5 has provided an iRule mitigation through its support channels that you can apply to affected virtual servers. Treat that mitigation as temporary, validate that it was deployed correctly, and schedule full patching as soon as operationally possible.Beyond patching, review authentication failures, administrative activity, command execution telemetry, configuration changes, and outbound traffic from BIG-IP management and data-plane interfaces, with the OAuth failure and TMM SIGABRT sequence at the top of the list. Edge devices that handle authentication are exactly where attackers want to start, so closing this gap quickly matters more than usual.

cPanel Flaws Could Turn One Hosting Account Into Root

cPanel has patched three vulnerabilities across its CalDAV, CardDAV, and WP Toolkit components, and here we break down each flaw, the affected versions, and the separate updates needed to fix them.

What You Need to Know

cPanel has fixed three vulnerabilities in its hosting management platform, including a critical privilege escalation flaw that could let any authenticated cPanel account holder execute code as root and take full control of the server. In shared hosting, that means one low-privileged customer account could become a path to compromising the underlying server and every tenant on it. No exploitation has been reported yet, but that is not a reason to wait.

What’s Vulnerable

The most serious issue sits in cPanel’s CalDAV and CardDAV service, which manages account calendar and contact data. A second flaw in that same service allows a local server user to read calendar events and contacts belonging to other accounts. That creates a cross-tenant data exposure risk, though it does not provide write access or root-level control.The third vulnerability is in WP Toolkit, cPanel’s WordPress deployment and management component, and could allow a logged-in user to modify databases associated with other accounts. The advisory does not clarify the full scope of possible database changes, whether cross-account data access is possible, or whether the attacker needs specific WP Toolkit access.The CalDAV and CardDAV vulnerabilities affect cPanel version 120 and later. Fixes are available in supported builds for the 134, 136, and 138 release tiers, as well as WP Squared. WP Toolkit is installed separately as the wp-toolkit-cpanel package and needs its own update, so a standard platform update will not remediate all three issues.

Why This Matters

Hosting control panels concentrate a lot of power in one place: domain administration, database provisioning, file management, credential management, and web application deployment. When privilege boundaries fail, a single account compromise can become a full infrastructure incident. The vulnerabilities were not in CISA’s KEV Catalog as of September 23, and there is no public PoC. Still, the lack of a PoC or confirmed exploitation should not lower remediation priority given what is at stake.

What to Do

Identify affected cPanel versions across your environment and update both the cPanel and WHM installation and the WP Toolkit package independently. After updating, review account activity for unexpected administrative actions, command execution, new scheduled tasks, unauthorized database changes, and modifications to hosted web content. Hosting providers should also validate tenant isolation controls and closely monitor newly created or recently accessed accounts, especially where credentials may have been exposed through phishing, password reuse, or compromised WordPress sites. In shared environments, every customer account is a potential entry point, so patching the boundary between them is a priority for everyone on the server.

Public Exploit Lands for Unpatched Ubuntu Container Escape

A Linux kernel flaw affecting Ubuntu container hosts now has public exploit code, so we're covering how the escape works, which kernels and cloud images are affected, and what to do while patches are pending.

What You Need to Know

Public exploit code is now available for CVE-2026-80521, a Linux kernel use-after-free vulnerability that can let an attacker inside a container gain root on the underlying host. The flaw was fixed upstream on August 6, but as of September 23, Ubuntu had not released patches for Ubuntu 26.04, 24.04, or 22.04 LTS. Default Docker and Kubernetes seccomp profiles do not block it, so container hosts running untrusted workloads are exposed right now.

What’s Vulnerable

The flaw lives in the AF_UNIX socket subsystem, specifically in garbage collection of file descriptors transferred with SCM_RIGHTS messages. An attacker who can run code in a vulnerable container can exploit a race condition to corrupt kernel memory, escape container isolation, and take control of the host operating system.The vulnerable code was introduced in Linux kernel 6.10 and later backported to the stable 6.1 and 6.6 branches. The upstream fix is available in mainline Linux kernel 7.2 and stable kernel 7.1.10. Ubuntu’s security tracker lists the Linux package for 26.04 as vulnerable with work in progress, and newer kernel packages deployed on AWS, Azure, and Google Cloud Platform workloads are also affected. The vulnerability is not in CISA’s KEV Catalog, and no confirmed reports of in-the-wild abuse exist.

Why This Matters

The vulnerability is reachable through ordinary system calls that default Docker and Kubernetes seccomp profiles allow. That means the controls most teams rely on for container isolation, namespaces, cgroups, and default seccomp filtering do not reliably stop exploitation once a malicious or compromised workload has execution inside a container. With a functional exploit now public, opportunistic testing against exposed container environments becomes much more likely. The risk is highest for environments that run untrusted code, support multiple tenants, run CI/CD workloads, or let customers and developers deploy arbitrary containers.

What to Do

Inventory container hosts running Ubuntu and identify systems on vulnerable kernel builds, including cloud-specific kernel packages. Where operationally feasible, apply the upstream kernel fix or move to a vendor-supported kernel version that includes it. Track Ubuntu’s advisory status closely and plan prompt reboot cycles once patched kernels are available, since a running host stays vulnerable until it loads the updated kernel.Until vendor patches arrive, reduce exposure by restricting container creation privileges, removing unnecessary host mounts and Linux capabilities, separating sensitive workloads from untrusted ones, and monitoring container hosts for abnormal process execution or privilege escalation attempts. For workloads that need a stronger isolation boundary, microVM-based platforms such as Firecracker or Kata Containers can limit the impact of a shared-kernel compromise by giving each workload its own kernel. Containers share a kernel, and this flaw reminds us that the kernel is the real security boundary.

China-Nexus Actor Chains Chrome and Windows Zero-Days Against Asian Governments

Volexity has detailed a new UTA0565 phishing campaign, and we're looking at the lure, the Chrome-to-Windows exploit chain behind it, and what defenders can hunt for.

What You Need to Know

UTA0565, a China-nexus threat actor, has been observed using a chained Chrome and Windows zero-day exploit to compromise targets through convincing impersonation websites. The activity, identified in early September, targeted Asian government organizations. The chain turns a single visit to a malicious site into full endpoint compromise, making patching and phishing defenses equally important.

What Happened

The campaign used phishing emails written in Chinese and English that encouraged recipients to support Hong Kong activist Chow Hang-tung. The messages posed as the Center for American Progress and directed victims to fraudulent websites built to resemble legitimate media and policy organizations.

The Exploit Chain

The attack combined two Google Chrome vulnerabilities, CVE-2026-85046 and CVE-2026-87491, with CVE-2026-85880, a flaw in Windows Advanced Local Procedure Call. The BlueMoon exploit kit used these vulnerabilities to escape Chrome’s sandbox and execute code on the underlying Windows system. The final-stage shellcode downloaded an executable named chrome_cleanup.exe, which delivered CLEANGULP, a malware family compiled with Microsoft Visual C++.CLEANGULP communicates with a hard-coded command-and-control domain over HTTP, using a lookalike name meant to resemble a legitimate academic media outlet. Volexity assessed that the BlueMoon exploit kit has appeared in activity attributed to multiple Chinese threat actors, which may point to a shared exploit-development capability or a broader ecosystem where operators customize and deploy common tooling.

Why This Matters

A browser compromise on its own often has limited reach. A sandbox escape paired with operating system-level execution changes that, turning a phishing click into an endpoint foothold. The cloned websites, impersonated organizations, and lookalike C2 domains all show how much of this campaign rests on social engineering. And if BlueMoon is shared across multiple Chinese actors, these same exploits may surface in other campaigns beyond this one.

What to Do

Prioritize Chrome and Windows security updates that address CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Hunt for access to the identified phishing infrastructure, downloads of chrome_cleanup.exe, unexpected browser child processes, and outbound HTTP connections to newly registered or lookalike domains. Tune email controls to flag messages that invoke political advocacy or current events while linking to domains that imitate established organizations. For high-risk users, especially government, policy, and regional affairs personnel, browser hardening, application allowlisting, endpoint detection coverage, and phishing-resistant MFA can reduce the chance that a malicious web visit becomes a persistent intrusion. Patching closes the exploit, but the lure will come back in a new form, so the people most likely to be targeted deserve the strongest defenses.

A 9.5 CVSS Flaw in Next.js ImageResponse Enables Server Code Execution

Vercel has shipped a fix for a critical flaw in Next.js ImageResponse, and we explain how the vulnerability works, which versions and runtimes are in scope, and the upgrade paths for each branch.

What You Need to Know

Vercel has released Next.js 16.3.6 to fix CVE-2026-94545, a critical vulnerability in the framework’s ImageResponse feature that could allow server-side code execution. It carries a CVSS score of 9.5 and affects Next.js versions 16.2.0 through 16.3.5 when ImageResponse runs in the default Node.js runtime. No public exploitation or PoC was reported as of September 23, but Next.js is widely deployed and affected teams should upgrade now.

What’s Vulnerable

ImageResponse is commonly used to generate Open Graph images and other social-media preview graphics on the fly. It relies on Satori to turn layout content into SVG before producing the final PNG. The flaw is triggered when an application passes attacker-controlled data, including values taken from request URLs, into SVG content, attributes, or styles without effective output escaping. A crafted value can then be processed as SVG markup instead of plain text, potentially reaching vulnerable downstream functionality and letting an attacker execute code on the server.Next.js 15 is not affected, and the Edge implementation of ImageResponse is outside the vulnerability’s scope.

Why This Matters

The highest-risk targets are exposed image-generation routes that build dynamic images from URL parameters, user-generated content, document titles, profile data, or other externally controlled values. Some image routes are generated only at build time, but any route that renders on incoming requests becomes an internet-facing attack surface when its inputs are not tightly controlled. Because the core problem is unsafe interpretation during SVG generation, input validation alone may not be enough to stop it.

What to Do

Find every use of ImageResponse from next/og in your applications, including route handlers and opengraph-image files. Upgrade any affected release to Next.js 16.3.6 immediately. No fix exists in the 16.2 branch, so applications on 16.2 must move to 16.3.6. Teams on Next.js 15 should consider updating to 15.5.26, which includes additional next/og hardening even though the primary vulnerability does not affect version 15. Developers using Satori directly should update to version 0.33.5.If you cannot upgrade right away, keep user-controlled data out of SVG elements, attributes, and CSS styles rendered by the Node.js ImageResponse implementation. Use fixed templates, strictly encode dynamic values, and remove request-derived values that image routes do not need. Finally, validate versions across production applications, review exposed Open Graph image endpoints, and check web and application logs for anomalous requests containing SVG markup, XML-like payloads, encoded tags, or repeated requests to image-generation routes. Convenience features like auto-generated preview images can quietly become an attack surface, and this one is worth checking today.