Week of September 21, 2026: Zyxel switches and WordPress under attack, and the MSC names a CISO

What else mattered to security leaders in the week of September 21, 2026? Exploitation of a Zyxel GS1900 switch flaw that exposed data from 996 devices and a critical WordPress core bug both landed on CISA's Known Exploited Vulnerabilities list, while the FBI and CISA told critical infrastructure operators how to manage their ICS integrators. The Check Point, F5, Astrana Health, EvilTokens and Anduril stories from the same days are in the September 27 edition.

Zyxel GS1900 switches exploited in 48 countries

GreyNoise reported on Monday, September 21, that a Chinese-speaking actor had exploited CVE-2026-7273, a stack-based buffer overflow in unpatched Zyxel GS1900 smart managed switches, and taken configuration data, network details and hashed root credentials from 996 devices in 48 countries. Zyxel had shipped fixed firmware in June 2026, and 564 of the victims still used factory default credentials. CISA added the flaw to its KEV catalog the same day. Small-office switches are easy to miss in asset inventories, so this is one to check against yours. (Help Net Security, CISA)

WordPress 7.1.2 fixes a critical core flaw that CISA then marked exploited

WordPress released version 7.1.2 to fix CVE-2026-87902, a path traversal bug in the get_page_template() function that lets an unauthenticated attacker make a site load a PHP file of their choosing and, on some server and theme configurations, run code. Every release from 4.7.0 through 7.1.1 is affected, and the project scored it 9.2 on CVSS version 4. On September 25 CISA added it to the KEV catalog as a WordPress Core remote file inclusion vulnerability. (Help Net Security, CISA)

WSO2 and Adobe Commerce flaws join the exploited list

On Thursday, September 24, CISA added a path traversal vulnerability affecting multiple WSO2 products (CVE-2026-5430) and an incorrect authorization flaw in Adobe Commerce and Magento (CVE-2026-71362) to the KEV catalog, citing evidence of active exploitation. Commerce platforms hold payment flows and customer data, so the Adobe entry belongs with whoever owns the online store, not only central IT. (CISA)

FBI and CISA publish guidance on working with ICS integrators

A joint FBI and CISA fact sheet dated September 23 sets out what critical infrastructure operators should consider to reduce risk when they hire third-party industrial control system integrators, the firms that build and maintain SCADA systems, programmable logic controllers and related equipment. For CISOs with operational technology in scope, it is a ready-made checklist for integrator contracts and remote access. (CISA and FBI)

Munich Security Conference creates a combined IT director and CISO post

The Munich Security Conference announced that Jochen Stechert took up a newly created position as Director of Information Technology and Chief Information Security Officer on September 15, leading a new standalone IT unit. He joins from Dehner, a European garden-center retail chain, where he was CISO for five years. The organization said the new directorate is a significant expansion of its IT and cybersecurity structures. The record is on CISO Tribune. (Munich Security Conference)

Gartner: 41% of CISOs saw a deepfake on an audio call

In a Gartner survey of 297 senior security leaders run between March and May 2026, 41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the previous 12 months, and 36% reported one on a video call. Phishing, spear-phishing or business email compromise was reported by 79%, and vishing or smishing by 58%. Gartner's advice is to make verification the default for any risky request, whatever the channel. (Help Net Security)

UK announces a National Centre for Information Defence

Speaking at the UN General Assembly on September 22, UK Prime Minister Andy Burnham said he was tasking security chiefs to begin work on a National Centre for Information Defence to detect, attribute and disrupt hostile state information attacks. He said Russian agencies had forged the branding of 28 British organisations, including universities and the BBC. Brand impersonation is a security problem as well as a communications one. (Help Net Security)