Polski
This Week in Cybersecurity: A Leaky Access Guardian and Iranian Spies on Messaging Apps
This week shows that threats lurk both in the tools we trust most and in everyday conversations on WhatsApp. We'll take a look at a critical vulnerability in a popular access management system, as well as an espionage campaign that preys on trust in familiar contacts. Two different worlds, one shared lesson: vigilance never goes out of style.
01 · Vulnerabilities
SolarWinds Access Rights Manager: an access guardian with a backdoor for everyone
Let's start with a slip-up that stings twice over, since it involves a tool built specifically to protect access to systems. In SolarWinds Access Rights Manager, versions 2026.2 and earlier, researchers found vulnerability CVE-2026-28326, rated 8.8 on the CVSS scale [1]. The cause is remarkably mundane — the application code had a cryptographic key hard-coded into it. The result? An unauthenticated attacker, without providing any login or password, could remotely execute arbitrary commands on the server.
The vendor responded and released a fix in version 2026.2.1 [1]. So far there's no confirmed evidence of the vulnerability being actively exploited in real-world attacks, but history teaches us that the window between a CVE's publication and the first exploitation attempts can be very short. For security teams, it's a reminder that even IAM-class tools — the ones meant to keep watch over who has access to what — themselves require regular updates and audits. Trusting a vendor doesn't excuse you from patching.
02 · Cyberespionage
CHOSEN BRICK: Iranian espionage campaign impersonates friends and contacts
From a coding error, we move to a far more human attack vector — trust in people we know. The United Kingdom, the United States, and the Netherlands jointly warned of an Iranian espionage campaign targeting dissidents, activists, and journalists [2]. The attackers aren't breaking any technical safeguards — they impersonate trusted contacts on WhatsApp and Telegram, drawing victims into seemingly ordinary conversations.
The goal is to convince the victim to download malware disguised as well-known applications, such as Norton Antivirus or the KeePass password manager [2]. Once installed, the malware can steal messages, take screenshots, and record audio from the device's microphone. It's a textbook example of how state-linked groups exploit not software flaws but social engineering and popular messaging apps to surveil critics of the regime around the world. Unlike the SolarWinds incident, no patch will help here — the only defense remains caution toward unexpected requests to install software, even if they appear to come from someone familiar.
Summary
Summary
A login-free vulnerability in an access management tool, and a fake antivirus spread through trusted contacts — these are just two examples from a week in which the line between technical error and human manipulation keeps blurring further. We'll discuss how to build resilient organizations — both at the code level and the human level — in more depth at the CYBER SECURITY Expo Poland 2026 International Cybersecurity Trade Fair. Stay tuned for more roundups, and be sure to save the date!
Invitation
From leaky IAM systems to social engineering on messaging apps — this week shows that a strong defense requires both solid patches and vigilant people. Visit the CYBER SECURITY Expo Poland 2026 International Cybersecurity Trade Fair, where experts will demonstrate how to protect critical infrastructure against both categories of threats. See the latest IAM solutions and anti-phishing systems live, talk to the creators of defensive tools, and plan your security strategy for the year ahead.
CYBER SECURITY Expo Poland 2026Footnotes
[1] The Hacker News — https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html[2] BleepingComputer — https://www.bleepingcomputer.com/news/security/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/