📋 Top Headlines at a Glance

1. Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
2. Arista Urges Immediate Patching of Exploited VCO Zero-Day
3. Ryuk ransomware member sentenced to 24 months in prison
4. CVE-2026-87902: how close is your WordPress to remote code execution?
5. Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

Executive Summary: Today’s intelligence highlights a critical convergence of cyber threats, ranging from the successful disruption of a large-scale phishing-as-a-service operation to the urgent patching requirements for actively exploited zero-day vulnerabilities and severe remote code execution flaws in widely used platforms. This landscape underscores the persistent efforts of threat actors to compromise organizations at scale, alongside the critical importance of rapid vulnerability management and collaborative defense strategies.

🌍 Technical Intelligence Breakdown

🎣 Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

A significant disruption has occurred against the EvilTokens phishing service, which had compromised over 12,000 inboxes across more than 10,000 organizations. This operation was a collaborative effort led by Microsoft, involving law enforcement and private-sector partners including Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs.

Key points:

• Service Disrupted: The EvilTokens phishing service.
• Scale of Compromise: Over 12,000 inboxes impacted across 10,000+ organizations.
• Disruption Actions: Seizure of 50 websites and disabling of more than 150 domains associated with the service, authorized by the US District Court for the Eastern District of Virginia.
• Collaborative Effort: Highlights the effectiveness of public-private partnerships in combating large-scale cybercrime infrastructure.

🚨 Arista Urges Immediate Patching of Exploited VCO Zero-Day

Arista has issued an urgent advisory for immediate patching of an actively exploited zero-day vulnerability affecting its VCO product. This critical-severity flaw could be leveraged by remote attackers.

Key points:

• Vulnerability Type: Zero-day, critical-severity.
• Affected Product: Arista VCO.
• Attack Vector: Remote attackers.
• Impact: Access to privileged internal functionality.
• Action Required: Immediate patching is strongly urged to mitigate active exploitation risks.

⚖️ Ryuk ransomware member sentenced to 24 months in prison

An individual involved in Ryuk ransomware attacks has been sentenced to 24 months in prison, followed by 3 years of supervised release. The sentencing pertains to an Armenian man convicted of hacking U.S. companies and encrypting their systems.

Key points:

• Threat Actor Affiliation: Member of the Ryuk ransomware operation.
• Crime: Hacking U.S. companies and encrypting systems.
• Consequence: 24-month prison sentence and 3 years of supervised release.
• Significance: Reinforces the legal repercussions for participation in ransomware activities. Dataset provides limited detail on specific attack timelines or victims.

🌐 CVE-2026-87902: how close is your WordPress to remote code execution?

A critical unauthenticated local file inclusion vulnerability, tracked as CVE-2026-87902 with a CVSS score of 9.2, has been identified and patched in WordPress. This flaw, active since version 4.7, allows for a real path to remote code execution (RCE).

Key points:

• Vulnerability ID: CVE-2026-87902.
• Severity: CVSS 9.2 (Critical).
• Affected Product: WordPress versions from 4.7 up to 7.1.1.
• Vulnerability Type: Unauthenticated local file inclusion, stemming from how the CMS resolves page templates.
• Attack Path: Unauthenticated File Inclusion → Remote Code Execution.
• Mitigation: Patched in WordPress 7.1.2, released on September 22. Immediate upgrade is essential.

🖼️ Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

A new critical security vulnerability has been discovered in Next.js, specifically within its ImageResponse feature, which is responsible for generating Open Graph and social preview images. This flaw could enable attackers to achieve server code execution.

Key points:

• Affected Product: Next.js.
• Vulnerable Feature: ImageResponse.
• Attack Vector: Crafted SVG input, particularly when an application incorporates attacker-controlled values (e.g., from a request URL) into the image generation process.
• Impact: Server Code Execution.
• Mitigation: Vercel, the developer of Next.js, released a fix on September 22. Users should update to the patched version (specific version number not provided in dataset).

📉 Threat Landscape & Trends

• Persistent Phishing-as-a-Service: The disruption of EvilTokens highlights the continued prevalence and scale of phishing operations as a primary initial access vector, often impacting thousands of organizations.
• Zero-Day Exploitation: The Arista VCO vulnerability underscores the immediate and severe risk posed by zero-day exploits, demanding rapid response and patching from affected organizations.
• Critical Web Application Flaws: High-impact vulnerabilities in widely used platforms like WordPress and Next.js demonstrate that even mature software can harbor severe RCE flaws, making them prime targets for exploitation.
• Legal Consequences for Cybercrime: The sentencing of a Ryuk ransomware affiliate reinforces the increasing efforts by law enforcement to pursue and prosecute cybercriminals, adding a deterrent factor to the threat landscape.

📌 Strategic Takeaway

Organizations must prioritize a multi-faceted defense strategy encompassing proactive threat intelligence for emerging zero-days, rigorous patch management for critical vulnerabilities in web applications and infrastructure, and robust user education to defend against sophisticated phishing campaigns.

🔗 References

1. Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
2. Arista Urges Immediate Patching of Exploited VCO Zero-Day
3. Ryuk ransomware member sentenced to 24 months in prison
4. CVE-2026-87902: how close is your WordPress to remote code execution?
5. Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input