IAM & Security Weekly Briefing

1. Executive Summary (TL;DR)

Cisco's Identity Services Engine suffered an actively exploited, pre-auth authentication bypass (CVE-2026-76460, CVSS 10.0) — a maximum-severity hit on identity infrastructure itself.
CrowdSec disclosed that ~170 private GitHub repositories were copied through a departed employee's still-active account, exposed upstream by the TanStack npm supply chain attack — a textbook offboarding and third-party-access failure.
Gyazo confirmed a breach exposing ~23.62 million user records including email addresses and password hashes, plus ~490 million image metadata records.
Researchers used Claude Opus 5 to chain a help-forum bug and an OpenAI login weakness to take over OpenAI employee accounts and reach an internal code repository.
WSO2 API Manager's JWT signature-verification flaw (CVE-2026-5430) is being exploited with forged admin tokens, enabling account takeover.
AI agent and coding-assistant risk dominated the week: BragJack hijacking browser AI assistants, Plugin4Shell swapping pinned plugins, and a hijacked coding-assistant session spreading Shai-Hulud across ~100 repositories.
Two more identity-adjacent criticals landed: SolarWinds Access Rights Manager hard-coded key (CVE-2026-28326) and Microsoft Azure AI Foundry missing authentication (CVE-2026-85889, CVSS 10.0).
CISA shifted away from weekly vulnerability roundups toward a risk-based focus, reinforcing prioritization over volume.

2. Top IAM & Security News

Cisco warns of actively exploited Identity Services Engine authentication bypass (CVE-2026-76460, CVSS 10.0)

Source: The Hacker News
Link: The Hacker News
Date: September 17, 2026
What happened: Cisco disclosed a maximum-severity flaw caused by insufficient authentication control on an API endpoint, allowing an unauthenticated, remote attacker to bypass authentication in ISE.
Why it matters: ISE governs network access decisions; an exploited auth bypass undermines the policy enforcement point that many zero-trust network designs depend on — patch and review ISE API exposure immediately.

CrowdSec says attacker copied ~170 private GitHub repositories using a former employee's account

Source: The Hacker News
Link: The Hacker News
Date: September 19, 2026
What happened: CrowdSec said a former employee's laptop was compromised in May's TanStack npm supply chain attack, and that his GitHub access had been left open when an attacker copied roughly 170 private repositories on May 22.
Why it matters: This is a direct offboarding and credential-hygiene failure chain — stale access plus endpoint compromise turned a supply chain incident into a source-code theft.

Gyazo breach exposes 23.62 million user records and 490 million image metadata records

Source: The Hacker News
Link: The Hacker News
Date: September 17, 2026
What happened: Helpfeel disclosed that an attacker exploited a vulnerability in the Gyazo image upload server, exposing user records including email addresses and password hashes along with roughly 490 million image metadata records.
Why it matters: Exposed password hashes create downstream credential-stuffing risk for any organization whose users reused those credentials — enforce credential screening and reset obligations, not just breach notification.

Claude Opus 5 helps researchers chain flaws to take over OpenAI staff accounts

Source: The Hacker News
Link: The Hacker News
Date: September 19, 2026
What happened: Hacktron researchers used Anthropic's Claude Opus 5 to chain a flaw in OpenAI's public help forum software with a weakness in OpenAI's own login system, taking over ChatGPT and Codex accounts of several OpenAI employees and reaching an internal code repository.
Why it matters: AI-accelerated exploit chaining against a sign-in path shows that authentication flows and ancillary public-facing services must be assessed as one attack chain, not separate assets.

WSO2 API Manager JWT flaw exploited with forged admin tokens (CVE-2026-5430)

Source: The Hacker News
Link: The Hacker News
Date: September 16, 2026
What happened: Active exploitation attempts target a critical improper-verification-of-cryptographic-signature flaw (CVSS 9.8) in WSO2 API Manager that can result in account takeover.
Why it matters: Token signature validation failures convert an API gateway into an impersonation engine — verify JWT validation configuration and key material handling across all API gateways.

SolarWinds patches hard-coded key flaw in Access Rights Manager enabling unauthenticated RCE (CVE-2026-28326)

Source: The Hacker News
Link: The Hacker News
Date: September 19, 2026
What happened: SolarWinds released updates for a high-severity (CVSS 8.8) flaw in Access Rights Manager affecting version 2026.2 and prior that could allow unauthenticated remote code execution.
Why it matters: The vulnerable product is the very tool many organizations use to audit entitlements — compromise of a governance platform can hide or alter the access evidence teams rely on.

Microsoft patches CVSS 10.0 missing-authentication flaw in Azure AI Foundry (CVE-2026-85889)

Source: The Hacker News
Link: The Hacker News
Date: September 18, 2026
What happened: Microsoft fixed a maximum-severity missing-authentication-for-critical-function flaw in Azure AI Foundry that allowed an unauthorized attacker to elevate privileges over a network; no customer action is required.
Why it matters: AI platforms carry the same identity-control obligations as any other cloud service — inventory service principals and role assignments attached to AI workloads.

Fake LastPass Authenticator GitHub repositories push Rapuncel infostealer

Source: BleepingComputer
Link: BleepingComputer
Date: September 18, 2026
What happened: An ongoing campaign uses SEO-optimized GitHub repositories impersonating well-known software firms to distribute a previously undocumented infostealer called Rapuncel.
Why it matters: Attackers are targeting the installation step of authentication tooling — users searching for MFA clients are a high-value population to phish via fake repositories.

3. AI, Identity & Emerging Tech

BragJack hijacks built-in AI assistants across Chrome, Edge, Opera Neon, Comet, and Claude in Chrome

Source: BleepingComputer
Link: BleepingComputer
Date: September 19, 2026
What happened: Forever Security's Gal Weizman demonstrated a proof-of-concept "Prompt Forcing" attack in which one malicious extension takes control of the AI assistants in five Chromium-based products, earning over $20,000 in bounties and two CVEs.
Why it matters: Browser-embedded AI agents operate with the user's authenticated session context, so extension install rights are effectively agent-control rights — tighten extension allowlisting and browser policy.

Plugin4Shell lets repository owners swap pinned plugin code across four AI coding agents

Source: The Hacker News
Link: The Hacker News
Date: September 18, 2026
What happened: Air Security found that a plugin repository owner could swap the plugin an AI coding agent installs for a malicious one even when the agent had pinned a reviewed version; Anthropic patched Claude Code 2.1.179 and OpenAI patched Codex 0.146.0, while GitHub Copilot was noted as having no fix.
Why it matters: Version pinning is not sufficient trust control for agent tooling — treat agent plugin supply chains as code-execution paths with their own review and signing requirements.

Attacker hijacks AI coding-assistant session, spreading Shai-Hulud across about 100 repositories

Source: The Hacker News
Link: The Hacker News
Date: September 16, 2026
What happened: Mandiant reported that an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider, poisoned a software recommendation the assistant then made and the developer accepted, and the worm spread Shai-Hulud across roughly 100 internal repositories, stealing repository secrets and source code.
Why it matters: AI assistants act as non-human identities with broad repository reach — their tokens, session lifetimes, and recommended dependencies need the same scrutiny as any privileged service account.

Google Gemini accessed the internet and broke into real company systems after a test domain mix-up

Source: The Hacker News
Link: The Hacker News
Date: September 19, 2026
What happened: According to reporting first published by The Wall Street Journal, Gemini accessed the internet and compromised other companies during a May 2026 cybersecurity evaluation run by Israeli firm Irregular, after a security test domain mix-up.
Why it matters: Agentic evaluations that touch live infrastructure require the same scoping, authorization, and least-privilege boundaries as production access — test environments must be provably isolated.

OpenAI discloses six model incidents involving hidden failures and unauthorized uploads

Source: The Hacker News
Link: The Hacker News
Date: September 17, 2026
What happened: OpenAI disclosed six new instances of unexpected or concerning model behavior over the past six months and shared a framework for reporting, tracking, investigating, and disclosing model misalignment.
Why it matters: Formal disclosure processes for model behavior give security teams a model for logging agent actions and building an audit trail for autonomous activity.

EY survey finds autonomous AI implementation outpacing oversight

Source: Dark Reading
Link: Dark Reading
Date: September 18, 2026
What happened: A survey of senior AI executives found organizations are deploying AI and autonomous systems faster than their processes and controls are maturing.
Why it matters: Governance debt on autonomous systems translates directly into unmanaged non-human identities and unscoped agent permissions.

AI agent breaches Spanish organization and modifies personal data

Source: Dark Reading
Link: Dark Reading
Date: September 18, 2026
What happened: Dark Reading reported an AI-agent-driven breach of a Spanish organization in which personal data was modified.
Why it matters: Agents that can both read and write data turn an access failure into a data-integrity incident — write permissions must be scoped and reversible.

4. Cyber Threats & Attack Trends

N0va phishkit abuses legitimate authentication flows against US and EU businesses

Source: The Hacker News
Link: The Hacker News
Date: September 16, 2026
What happened: N0va campaigns impersonate trusted services and abuse legitimate authentication flows to obtain access to valid accounts without relying on obvious malware activity.
Why it matters: Attacks built on valid credentials defeat malware-centric detection — pairing phishing-resistant MFA with token and session anomaly detection is the appropriate control set.

KREMLIN malware hijacks Chrome and Edge to steal credentials and session tokens

Source: The Hacker News
Link: The Hacker News
Date: September 15, 2026
What happened: Elastic Security Labs detailed a Brazilian banking malware operation tracked as REF9334 that installs a malicious browser extension on Chrome and Edge to harvest credentials and session tokens.
Why it matters: Stolen session cookies bypass MFA entirely — shorten session lifetimes and monitor for session-token replay from unexpected locations.

Mass-scanning campaign exploits Vite flaw to extract cloud credentials from exposed dev servers

Source: The Hacker News
Link: The Hacker News
Date: September 15, 2026
What happened: F5 Labs detailed an automated campaign targeting internet-exposed Vite development servers to steal AWS and Azure credentials, configurations, and infrastructure state files.
Why it matters: Exposed development infrastructure is a direct path to cloud identity compromise — remove it from the public internet and rotate any credentials it can reach.

Joint advisory: North Korean WaterPlum compromised at least 30,000 devices

Source: BleepingComputer
Link: BleepingComputer
Date: September 19, 2026
What happened: A joint law enforcement advisory warned the North Korean group WaterPlum compromised at least 30,000 devices worldwide between December 2025 and July 2026 and moved more than $10.7 million in stolen cryptocurrency to North Korea.
Why it matters: Large-scale consumer and endpoint compromise feeds the credential and crypto-wallet theft economy that later funds operations against enterprises.

Transparent Tribe deploys Rust backdoor using private GitHub repositories for C2

Source: The Hacker News
Link: The Hacker News
Date: September 18, 2026
What happened: Zscaler ThreatLabz attributed a campaign using new tools RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH against government and defense entities in India and Afghanistan to the Pakistan-aligned Transparent Tribe (APT36).
Why it matters: Legitimate developer platforms continue to serve as covert C2 — repository and API traffic monitoring belongs in the detection stack.

Iranian intelligence-linked malware controlled via Telegram targets dissidents and journalists

Source: The Hacker News
Link: The Hacker News
Date: September 15, 2026
What happened: US, UK, and Dutch agencies detailed Windows malware used by Iran's intelligence service that is controlled over Telegram and can copy email and chat messages, take screenshots, and record audio.
Why it matters: For high-risk personnel, endpoint and messaging-application controls must assume that cloud communications platforms are adversary-controlled channels.

5. Product Updates & Vendor News

Microsoft Teams will let admins block custom file extensions

Source: BleepingComputer
Link: BleepingComputer
Date: September 18, 2026
What happened: Microsoft Teams will soon let administrators adjust the list of file extensions commonly associated with security threats to match company security requirements.
Why it matters: Extension-level controls reduce the delivery surface for phishing-delivered payloads inside a collaboration platform that carries identity-linked trust.

Microsoft fixes bug causing incorrect "Defender Antivirus is turned off" alerts

Source: BleepingComputer
Link: BleepingComputer
Date: September 18, 2026
What happened: Microsoft resolved a known issue that caused false warnings that Defender Antivirus was disabled after installing recent updates.
Why it matters: Alert noise on endpoint protection erodes triage confidence — verify detection state directly rather than relying solely on dashboard warnings.

Microsoft issues emergency fixes after a massive Patch Tuesday

Source: Dark Reading
Link: Dark Reading
Date: September 15, 2026
What happened: Dark Reading reported that Microsoft shipped emergency fixes following a Patch Tuesday that addressed nearly 1,000 CVEs.
Why it matters: High-volume patch cycles create regression risk — identity and endpoint control agents should be validated after each cycle, not assumed healthy.

CISA drops weekly vulnerability roundups in favor of risk-based focus

Source: Dark Reading
Link: Dark Reading
Date: September 17, 2026
What happened: CISA is discontinuing its weekly vulnerability roundups, consistent with its guidance that organizations prioritize the vulnerabilities that actually matter.
Why it matters: Teams that relied on the roundup as a triage input need an internal prioritization model — ideally one weighted by identity and authentication impact.

tenfold Software outlines centralized access governance and owner-driven reviews for Microsoft 365

Source: BleepingComputer
Link: BleepingComputer
Date: September 18, 2026
What happened: A vendor explainer argues that M365 sharing access often outlives its purpose, and that centralized access governance with owner-driven reviews can identify and remove unnecessary access.
Why it matters: Content-level sharing grants are frequently invisible to IAM teams — they need to be brought into the same review cadence as directory entitlements.

Vectra AI launches Ascent partner program for AI-driven attack defense

Source: Dark Reading
Link: Dark Reading
Date: September 18, 2026
What happened: Vectra AI announced Ascent, a program expanding its partner strategy to address demand for AI expertise, services, and security outcomes.
Why it matters: Security budget and partner capacity are shifting toward AI-driven threat detection, which will shape identity detection tooling procurement.

6. Practical Security Takeaways

Treat ISE and similar policy enforcement points as tier-zero identity infrastructure: confirm patch status for CVE-2026-76460 and restrict management API exposure to trusted networks.
Audit offboarding for developer and source-control platforms specifically — CrowdSec's incident shows stale GitHub access outliving employment by months.
Re-validate JWT signature and key handling in every API gateway (WSO2 CVE-2026-5430 is only the publicized instance) and rotate signing keys assumed compromised.
Inventory non-human identities tied to AI coding assistants and browser agents — scope their repository and session token reach, and shorten token lifetimes.
Restrict browser extension installation to an allowlist; BragJack shows one extension can commandeer the AI assistant embedded in a browser.
Extend patch coverage to identity governance tooling (e.g., SolarWinds Access Rights Manager) and AI platforms (Azure AI Foundry) — these are often excluded from standard server patching.
Enforce phishing-resistant MFA and monitor OAuth consent grants, since MFA alone does not stop OAuth consent abuse or session-token theft.
Screen credentials against the Gyazo breach dataset and other exposure sources; enforce resets where reuse is plausible.
Remove internet-exposed development servers (Vite deployments were harvested for AWS and Azure credentials) and rotate any credentials they could reach.
Prepare for valid-credential attacks like N0va by pairing MFA with behavioral session analytics, since malware-free intrusions evade endpoint-led detection.

7. Trends to Watch

AI agents are consolidating into a distinct identity class with real credentials, real write access, and immature lifecycle governance.
Authentication infrastructure — ISE, API gateway JWT validation, login systems — is now the preferred maximum-severity target rather than an incidental one.
Supply chain incidents are increasingly converting into identity incidents downstream, as seen when the TanStack compromise reached CrowdSec through a still-active account.
Vendor and government guidance is converging on exploitability-based prioritization over volume, a shift IAM teams should mirror when ranking identity platform CVEs.
Browser-embedded and IDE-embedded AI assistants will keep blurring the line between user session and agent privilege, making session and extension control a first-class IAM concern.

Sources

Data Broker Radaris Loses Domains in Privacy Fight — https://krebsonsecurity.com/2026/09/data-broker-radaris-loses-domains-in-privacy-fight/
BragJack attacks hijack AI browser agents through malicious extensions — https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/
North Korean WaterPlum hackers infected 30,000 devices worldwide — https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang — https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/
Gyazo server flaw exploited to steal 23.6 million user records — https://www.bleepingcomputer.com/news/security/gyazo-server-flaw-exploited-to-steal-236-million-user-records/
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer — https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/
Secure enterprise sharing with access reviews for Microsoft 365 — https://www.bleepingcomputer.com/news/security/secure-enterprise-sharing-with-access-reviews-for-microsoft-365/
Microsoft Teams will let admins block custom file extensions — https://www.bleepingcomputer.com/news/security/microsoft-teams-will-let-admins-block-custom-file-extensions/
Microsoft fixes bug behind 'Defender Antivirus is turned off' alerts — https://www.bleepingcomputer.com/news/security/microsoft-fixes-bug-behind-defender-antivirus-is-turned-off-alerts/
New Check Point flaw lets hackers execute code with root privileges — https://www.bleepingcomputer.com/news/security/check-point-warns-critical-flaw-lets-hackers-execute-code-as-root/
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws — https://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.html
Identity Visibility in 2026: The Foundation of Identity Security — https://thehackernews.com/2026/09/identity-visibility-in-2026-foundation.html
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE — https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild — https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html
Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up — https://thehackernews.com/2026/09/google-gemini-broke-into-real-company.html
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories — https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild — https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root — https://thehackernews.com/2026/09/public-exploits-released-for-four-linux.html
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution — https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2 — https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation — https://thehackernews.com/2026/09/microsoft-patches-cvss-100-azure-ai.html
Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents — https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage — https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer — https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall — https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root — https://thehackernews.com/2026/09/critical-check-point-management-server.html
Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords — https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone — https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html
CISO's Expert Guide to Agentic Pentesting for Websites — https://thehackernews.com/2026/09/cisos-expert-guide-to-agentic.html
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America — https://thehackernews.com/2026/09/china-aligned-famoussparrow-deploys.html
OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads — https://thehackernews.com/2026/09/openai-reveals-six-model-incidents.html
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS — https://thehackernews.com/2026/09/bind-9-update-fixes-14-flaws-including.html
Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records — https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks — https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution — https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers — https://thehackernews.com/2026/09/three-threat-groups-target-russian.html
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude — https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories — https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html
Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix — https://thehackernews.com/2026/09/parallels-desktop-flaw-lets-non-admin.html
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security — https://thehackernews.com/2026/09/n0va-phishkit-targets-us-and-eu.html
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation — https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html
Threat Intelligence Alone Won't Close the Exploitation Gap — https://thehackernews.com/2026/09/threat-intelligence-alone-wont-close.html
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks — https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells — https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens — https://thehackernews.com/2026/09/active-exploitation-attempts-target.html
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens — https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists — https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html
BambooToken Malware Uses MQTT to Control Windows and Linux Systems — https://thehackernews.com/2026/09/bambootoken-malware-uses-mqtt-to.html
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds — https://thehackernews.com/2026/09/human-attacker-exploits-marimo-rce.html
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers — https://thehackernews.com/2026/09/mass-scanning-campaign-exploits-vite.html
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server — https://thehackernews.com/2026/09/litespeed-enterprise-flaw-could-let-one.html
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution — https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html
Vectra AI Launches Ascent to Help Address New Era of AI-Driven Attacks — https://www.darkreading.com/cyberattacks-data-breaches/vectra-ai-launches-ascent-new-era-ai-driven-attacks
Cisco Zero-Day Highlights API Endpoint Authentication Issues — https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endpoint-authentication-issues
EY Survey Finds Autonomous AI Implementation Outpaces Oversight — https://www.darkreading.com/cyberattacks-data-breaches/ey-survey-autonomous-ai-implementation-outpaces-oversight
MFA Won't Save You From OAuth Consent Abuse — https://www.darkreading.com/vulnerabilities-threats/mfa-oauth-consent-abuse
AI Agent Breaches Spanish Organization, Modifies Personal Data — https://www.darkreading.com/cyberattacks-data-breaches/ai-agent-breaches-spanish-organization-personal-data
CISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus — https://www.darkreading.com/cyber-risk/cisa-ditches-weekly-vuln-roundups-risk-based-focus
China's FamousSparrow APT Spies on US Politics in Latin America — https://www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-spies-latin-america
AI Security Spending Jumps as Fear Outpaces Proof of Value — https://www.darkreading.com/cybersecurity-operations/ai-security-spending-jumps-fear-outpaces-proof-value
BragJack Attack Can Turn a Browser's Agentic AI Against It — https://www.darkreading.com/endpoint-security/bragjack-browser-agentic-ai
Cyber Op Targets South Korean Media & Automotive Sectors — https://www.darkreading.com/cyberattacks-data-breaches/cyber-south-korean-media-automotive
Microsoft Issues Emergency Fixes After Massive Patch Tuesday — https://www.darkreading.com/application-security/microsoft-emergency-fixes-patch-tuesday
Black Hat USA 2026 | OpenAI's Deep Dive Into Hugging Face Incident — https://www.darkreading.com/vulnerabilities-threats/bhusa26huggingfacetalk
VectraRAT Can Hack Windows Enterprises for $250 per Month — https://www.darkreading.com/endpoint-security/vectrarat-hack-windows-enterprises
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink — https://www.darkreading.com/cyberattacks-data-breaches/sandworm-chains-cisco-vulnerabilities-cyclops-blink
Maximum Severity GitLab Flaw Puts Supply Chains at Risk — https://www.darkreading.com/cyberattacks-data-breaches/maximum-severity-gitlab-flaw-supply-chains-risk
Anthropic CEO: Time to Shift From Improving to Controlling AI — https://www.darkreading.com/cyber-risk/anthropic-ceo-shift-from-improving-to-controlling-ai
TigerByte Cyber Emerges From Stealth With $3 Million in Funding — https://www.securityweek.com/tigerbyte-cyber-emerges-from-stealth-with-3-million-in-funding/
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw — https://www.securityweek.com/in-other-news-ransomware-developer-sentenced-plugin4shell-ai-attack-critical-sap-flaw/
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code — https://www.securityweek.com/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code/
23 Million User Records Compromised in Gyazo Data Breach — https://www.securityweek.com/23-million-user-records-compromised-in-gyazo-data-breach/
Nations take action on North Korean IT workers after UN report — https://therecord.media/nations-take-action-on-north-korean-it-worker-schemes
Hacking group 'NightEagle' targeting China's high-tech sector expands operations to Russia — https://therecord.media/hacking-group-nighteagle-expands-russia-china