Welcome to Threat Thursday, Galactic's weekly threat intelligence roundup.

Every Thursday, we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.

This week's stories span the full range of what attackers are up to: a glimpse of where malware is heading, a WordPress flaw that was being exploited within five hours of its patch, and three confirmed attacks against the network infrastructure organizations depend on. Two of those carry federal remediation deadlines that hit this week.

This Week's Cycle

1. New Windows Malware Lets AI Models Decide What to Steal Next: CLOSEDQUORUM

Cisco Talos disclosed a new Windows malware on September 22 that takes orders from artificial intelligence models rather than from a human attacker. CLOSEDQUORUM presents a task to up to four AI models simultaneously, including Google Gemini, DeepSeek, Qwen, and Mistral, and uses a majority vote to decide what to do next: steal Windows login credentials, saved browser passwords, or cryptocurrency wallet data. The malware hasn't been deployed in a successful real-world attack yet, and the current code has gaps. But the developer is linked to criminal fraud forums, and Cisco Talos describes it as the first publicly documented Windows malware to hand its decision-making to AI models. Talos also released a free open-source tool called CAIRN the same day to help security teams detect malware that uses AI services.

Potential impact: Malware that reasons through its actions without a human directing it in real time is harder to anticipate and disrupt. This is early-stage, but the direction is clear.

What to do: No patch or specific remediation applies right now. Make sure endpoint detection is current, and watch for unusual outbound connections to AI model APIs. CAIRN is available on GitHub for teams that want to start scanning.

Source: The Hacker News

2. Attackers Are Actively Stealing Data From Zyxel Network Switches: Federal Deadline Is Today: CVE-2026-7273

Zyxel GS1900 series switches are the hardware many businesses use to direct traffic between devices on their internal network. GreyNoise documented active exploitation of a vulnerability in these switches beginning September 17, and CISA added it to its Known Exploited Vulnerabilities catalog with a September 24 federal remediation deadline. The confirmed attack outcome is data theft from affected devices.

Potential impact: Network switches sit at the center of internal traffic. A compromised switch can expose the data moving through it and give attackers a foothold in the network that's difficult to spot because these devices are rarely monitored as closely as servers or endpoints.

What to do: Apply Zyxel's firmware update for the GS1900 series immediately. Check the Zyxel support portal and CISA's advisory for the specific fixed version. If the device can't be updated right away, restrict management access to trusted IP addresses only and audit the device for any signs of unauthorized configuration changes.

Source: BleepingComputer

3. WordPress Patched a Critical Flaw on September 22. Attackers Were Inside Within Five Hours.

WordPress released security updates to fix a critical vulnerability in the core software itself rather than a plugin. CVE-2026-87902 is an unauthenticated file-inclusion flaw that chains to remote code execution under certain server conditions. Within five hours of the release, Patchstack observed the first malicious requests targeting it, and attack traffic has since increased tenfold. Attackers are using it to drop files on vulnerable servers that run their commands when accessed. The flaw affects WordPress 4.7.0 through 7.1.1.

Potential impact: WordPress runs roughly 40% of all websites. A flaw in the core means every unpatched site is exposed, regardless of which plugins or themes it uses.

What to do: Update to the fixed release for your branch. Safe versions are 7.1.2, 7.0.6, 6.9.9, 6.8.10, and 4.7.37, so you don't need to jump to the latest major version if you're on an older supported branch. If automatic updates are on, verify the update actually applied — active exploitation is already underway.

Source: BleepingComputer

4. F5 BIG-IP Has an Actively Exploited Flaw That Lets Attackers In Without Credentials: CVE-2026-94127

F5 BIG-IP systems are used to control how users securely reach an organization's applications and networks. A flaw disclosed and patched September 22 affects BIG-IP systems where a specific authentication module is configured as an OAuth authorization server. In that setup, an attacker can send specially crafted traffic and execute code on the system without logging in. F5 released emergency hotfixes. Active exploitation is confirmed.

Potential impact: BIG-IP sits in front of an organization's applications. A compromise at this layer gives attackers a privileged vantage point over everything downstream.

What to do: Apply F5's engineering hotfixes immediately. The flaw only affects the specific OAuth configuration described, so check whether your deployment matches before assuming you're safe.

Source: The Hacker News

5. Arista VeloCloud's Network Management Server Has a Maximum-Severity Flaw Under Active Exploitation: CVE-2026-93952

Arista VeloCloud is software used to manage SD-WAN networks, the systems that connect offices, remote workers, and cloud services. A flaw rated 10.0 out of 10, the highest possible severity, allows an attacker to reach the management server from the internet without credentials and access privileged internal functions, but only where the orchestrator is configured to authenticate Edge devices using certificates. That's a specific setup, not every internet-facing deployment. CISA confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog on September 22, with a federal remediation deadline of September 25. Fixes are available for the 5.2 and 6.4 branches. The 6.1 and 7.0 branches don't yet have patches. Arista has already patched its cloud-hosted and dedicated versions.

Potential impact: The management server controls the routing rules for an entire network. Access to it gives an attacker a map of how an organization's traffic moves and the ability to redirect it.

What to do: Confirm whether your deployment uses certificate-based authentication between the VeloCloud Edge and Orchestrator. If it does, apply the fix for your branch immediately if one is available. If you're on 6.1 or 7.0, restrict access to the management server from untrusted networks until a patch ships. Cloud and dedicated deployments are already covered.

Source: SecurityWeek

The Big Picture

The time between a fix shipping and an attack landing keeps getting shorter, which quietly changes what patching is. It stops being a scheduled task and becomes something closer to a race you're either set up to run or you aren't.

The harder case showed up this week too: what to do when the patch for your particular branch doesn't exist yet. There's no patching your way out of that one. You need to know which of your systems are reachable from the internet, and you need to be willing to cut access to one while you wait.

Both problems come back to the same inventory. Knowing what you run, knowing what's exposed, and knowing what you could take offline on short notice is what buys you the time to respond either way.