WSO2

Screen Connect is being used against the MSPs it was built to protect.

WSO2 identity servers are handing attackers full admin, and the FBI just boarded an oil tanker off the Texas coast after a cyber attack cut off its communications for 30 hours.

We've got 12 stories on today's show.

This is the Cyber Hub Podcast.

All of that really does matter.

All right, so let's move to our third story this morning.

And our third deep dive attackers are actively exploiting the vulnerability in WSO2 products, specifically the WSO2 identity server and API manager.

They're doing that to gain full administrative access to enterprise middleware environments.

Cisco discloses a critical zero day in secure email gateway already exploited in the wild with root level command execution.

Microsoft issues emergency patches after September's 900 and 74 CVE, or Common Vulnerabilities and Exposures, Update broke remote desktop services and Hyper-V. WSO2 API manager JWT bypass vulnerability now under active exploitation with forged admin tokens targeting enterprise APIs.

Here's the full breakdown of today's top security stories.

Cyber threat brief, September 16, 2026.

CIS a KEV due date is September 17.

CyberScope.

WSO2 a PI, manager JWT bypass under active exploitation, CVE2026-5430.

Watch tower observed active exploitation of CVE2026-5430.

If you run WSO2's API Gateway, today's the day to get that 5-month-old patch off the risk register and onto the system.

Happy Hump Day! This is the Daily DevSec Brief for Wednesday, September 16th, 2026.

1.

Anyone who can reach a WSO2 API Gateway can sign a token with an algorithm the product doesn't support and the Gateway validates it and hands back Administrator.

Watchtower caught forged admin tokens arriving at its honeypots over the weekend, and the fix has been on WSO2's website since the first week of May.

Apply the update level for your version, then rotate every consumer key and secret on the gateway.

Two, somebody on an adjacent network with basic privileges on a Pixel phone can escalate through a logic error in the cellular modem with no user interaction and Google says there are indications it's under limited targeted exploitation.

Alert on that certificate and on port 7443 with a self-signed cert.