Weekly Cybersecurity News | September 13-19, 2026 Roundup

This edition of weekly cybersecurity news covers critical vulnerabilities spanning web applications, network edge management, and enterprise operating systems. Security researchers uncovered severe unauthenticated remote code execution chains targeting popular content management plugins alongside actively exploited gateway appliances.

Simultaneously, administrators encountered notable patching headaches as monthly cumulative operating system updates triggered unexpected backup failures across enterprise endpoints. Consequently, engineering and SecOps teams must maintain a tight balance between rapid mitigation deployment and change validation.

Top Cybersecurity Stories This Week

The Events Calendar WordPress Plugin Exposes 600,000+ Sites to RCE

On September 17, 2026, security researchers disclosed two critical vulnerabilities affecting The Events Calendar, an active WordPress plugin powering over 600,000 websites. Tracked as CVE-2026-78006 and CVE-2026-78159, both flaws carry a maximum CVSS rating of 9.8. Unauthenticated attackers could exploit the single-event template parsing routines by submitting crafted comments to execute arbitrary operating system commands or reset administrative accounts.

• Identified CVEs: CVE-2026-78006 (CVSS 9.8) and CVE-2026-78159 (CVSS 9.8)
• Attack Vector: Injection of malicious wp:legacy-widget blocks into public comment forms, bypassing standard parameter validation to reach insecure PHP execution sinks.
• Source & Verification: SC Media: Flaws in The Events Calendar WordPress Plugin Enable Unauthenticated RCE

Active Exploitation of Cisco Secure Firewall Management Center

Threat intelligence teams reported widespread in-the-wild exploitation targeting Cisco Secure Firewall Management Center (FMC) software throughout mid-September 2026. The vulnerability allows unauthenticated remote adversaries to bypass normal authentication checks entirely. Once past the perimeter, threat actors have deployed web shells, custom Java command executors, and persistent implants directly within core management planes.

• Identified CVEs: CVE-2026-20079 (CVSS 10.0, Critical)
• Attack Vector: Flawed boot-time process initialization creating an alternate authentication path for crafted HTTP requests directed at the FMC web interface.
• Source & Verification: Cisco Talos Intelligence Group: Active Exploitation of Cisco Secure Firewall Management Center

WAVLINK Router Flaw Grants Unauthenticated Root File Overwrite

On September 11, 2026, security bulletins warned of an arbitrary file write flaw impacting WAVLINK WN535M1 and WN535M3 mesh routers. The vulnerability, cataloged under CVE-2026-89009, stems from inadequate input handling inside the router’s internal synchronization daemon listening on TCP port 13136. Attackers sending unauthenticated network payloads can overwrite critical operating system files with root permissions, enabling persistent remote compromise.

• Identified CVEs: CVE-2026-89009 (CVSS 9.8, Critical)
• Attack Vector: Transmission of crafted network requests to the unauthenticated sync_server daemon, triggering arbitrary system file modification.
• Source & Verification: National Vulnerability Database: CVE-2026-89009 Detail

Microsoft Acknowledges Windows Security Updates Disrupt File History Backups

Following the rollout of its mandatory September security patches, Microsoft updated its known-issues dashboard on September 19, 2026, confirming a widespread backup regression. Systems running current builds of Windows 11 and Windows 10 experienced silent failures within the native File History engine. Affected machines threw persistent “Reconnect your drive” errors while crashing background FileHistory.exe tasks, leaving users vulnerable to data loss during system recoveries.

• Identified CVEs: Non-CVE functional regression linked to security update packages KB5124008, KB5124012, and KB5122880.
• Attack Vector: Secondary operational impact; unhandled application crashes in KERNELBASE.dll degrade disaster recovery readiness without warning administrators.
• Source & Verification: BleepingComputer: Microsoft Confirms September Updates Break File History Backup Feature

Weekly Mitigation & Patch Checklist

• [ ] Update The Events Calendar: Upgrade all WordPress installations utilizing The Events Calendar to version 6.17.4 or higher immediately to close comment-based execution sinks (CVE-2026-78006, CVE-2026-78159).
• [ ] Disable WordPress Comments on Events: If immediate plugin patching is not possible, disable comments globally on all tribe_events post types as a temporary stopgap.
• [ ] Patch Cisco FMC Instances: Deploy the official vendor hotfix for Cisco Secure Firewall Management Center software across all on-premises clusters (CVE-2026-20079).
• [ ] Isolate Firewall Management Interfaces: Ensure Cisco FMC web consoles are strictly bound to dedicated, non-routable management VLANs and blocked from public ingress.
• [ ] Upgrade WAVLINK Router Firmware: Apply firmware release M35M1_V250922 or later on WN535M1/M3 hardware, and close public access to TCP port 13136.
• [ ] Verify Endpoint Backup Integrity: Audit Windows endpoints receiving the September cumulative patches; ensure secondary, air-gapped backup processes are running until Microsoft’s preview fix deploys.

Conclusion & Emerging Trends

This week demonstrates how attackers frequently bypass edge perimeters and application layers using unconventional vectors, such as CMS comment parsers and daemon socket flaws. Furthermore, ongoing update regressions remind teams that continuous backup verification is just as critical as prompt patch application.

Has your organization experienced patching side effects from this month’s cumulative updates, or has your team prioritized edge appliance isolation?