CL0P ransomware group listed Harley-Davidson on its extortion leak site, claiming a compromise; the motorcycle maker has not confirmed any breach.
The CL0P ransomware operation added Harley-Davidson to its public extortion portal, a listing highlighted by the ransomNews monitoring account on September 10, 2026. Harley-Davidson has not confirmed any compromise, and the initial access method, affected business unit, timing, and volume of stolen data remain unknown, with no sample files or technical indicators published. The article stresses that leak-site listings alone do not confirm a breach and can serve as negotiation pressure in double-extortion schemes. If verified, stolen data could fuel downstream phishing, BEC, credential-stuffing, and invoice fraud targeting dealers, suppliers, and customers.
Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.
Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.
US court sentences Ukrainian Conti ransomware member Oleksii Lytvynenko to four years; the gang extorted over $150M from 1,000+ victims.
Ukrainian national Oleksii Oleksiyovych Lytvynenko, 44, was sentenced to four years in prison for his role in Conti ransomware attacks between 2021 and 2022, after being arrested by Irish police in July 2023 and extradited to the US. He pleaded guilty in June 2026 to conspiracy to commit wire fraud, admitting he controlled stolen data from 12 victims and helped develop a loader used in the gang's double extortion attacks. Per the DOJ, Conti attacked more than 1,000 victims across 47 US states and 31 foreign countries, with victim payouts exceeding $150 million as of January 2022. Conti shut down in 2022 and later split into groups including BlackCat, Black Basta, Hive and Quantum.
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
PaperCut released PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10, superseding Emergency Patch Releases 1-3 for CVE-2026-81578 and CVE-2026-82078, which enable authentication bypass and arbitrary code execution on susceptible instances. GreyNoise and Blackpoint Cyber reported a suspected Russian-speaking actor weaponizing both flaws against at least 395 organizations in 48 countries, concentrated in the U.S. education sector. The campaign used hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model, originating from IP 45.142.193.132, and avoided organizations in Russia, China, Hong Kong, Thailand and Iran.
Researchers show attackers can remotely block strangers' phones and alarm gateways on US cellular networks by abusing lost/stolen IMEI reporting for $2.50-$4 per device.
Researchers from Michigan State University and three partner schools found six weaknesses in the lost/stolen device reporting ecosystem spanning devices, carrier systems, and cross-carrier block-list sharing. They demonstrated blocking unopened Samsung Galaxy Z Fold 7 phones and home alarm gateways on three major US carriers, with each block costing $2.50-$4 and taking roughly 20-80 seconds. The attacks exploit thin identity and ownership checks in prepaid accounts, IMEI leakage from vulnerable cellular chipsets used by two vendors with over 40% global market share, and pre-release IMEI databases purchasable for $600. Victims receive no notification, and restoring service requires proving device ownership to the carrier.
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
Proofpoint, working with Google Threat Intelligence Group, Microsoft Threat Intelligence Center and Volexity, reports that the BlueMoon exploit kit chains V8 type confusion CVE-2026-85046, V8 sandbox escape CVE-2026-87491 and Windows kernel LPE CVE-2026-85880, all rated high severity. The V8 flaws were fixed in upstream Chromium source but had not yet reached Chrome stable releases, creating a patch gap that attackers reverse-engineered and weaponized. A China-aligned state-sponsored actor used the kit from August 28 against a small number of US NGOs, mining and commodity trading firms via rapport-building spear phishing, and within days several mostly China-linked espionage clusters adopted BlueMoon. The chain yields full Windows admin privileges from a single phishing click; defenders should patch Chrome and Windows, apply Proofpoint detections and hunt for leftover artifacts.
System76 launches the Thelio Mira AI Linux workstation from $3,299 with dual NVIDIA RTX Pro 6000 GPUs and 192 GB GPU memory for local AI workloads.
System76's Thelio Mira AI is a locally built (Denver, Colorado) Linux workstation for AI training, fine-tuning, and inference, starting at $3,299. Configurations go up to a 16-core AMD Ryzen 9000 CPU, 192 GB DDR5 RAM, and dual NVIDIA RTX Pro 6000 Blackwell GPUs delivering 192 GB of (ECC) GPU memory with liquid cooling, dual PCIe 5.0 x16 slots, and up to three M.2 NVMe drives. It ships with Pop!_OS 24.04 LTS or Ubuntu and is positioned as a way to avoid recurring cloud GPU costs.
Mark Wahlberg will join a fireside chat at TechCrunch Disrupt 2026 discussing his entrepreneurial and angel investing career.
Actor-investor Mark Wahlberg will speak with Keebeck Wealth Management founder and CEO Bruce K. Lee on the Disrupt Stage at TechCrunch Disrupt 2026, held October 13-15 at San Francisco's Moscone West. The session covers his ventures, angel investing, and growing focus on healthcare and wellness startups. The piece is promotional conference coverage noting ticket prices rise on September 25.
OpenAI released its Agents API in public beta, exposing the managed Codex harness with hosted or self-hosted sandboxes, MCP tools, and subagents.
The Agents API is a managed service built on the open-source Codex harness, handling context compaction, tool search, programmatic tool calling, and multi-agent orchestration. Agents run in OpenAI-hosted sandboxes, self-hosted environments, or partner sandboxes from Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel. Data residency is US-only and Zero Data Retention is unsupported. Examples use model gpt-6-astra; vendor-reported results include SafetyKit cutting case review cost 60% and Ciridae achieving 4x lower subagent latency.
FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.
FinCEN analyzed more than 33,000 cyber fraud incident reports filed by roughly 1,300 financial institutions between September 2023 and December 2025, finding about $12.7 billion in losses to cryptocurrency investment scams across all 50 states. Traditional banks reported about $6.4 billion in suspected scam activity and crypto firms about $5.5 billion. Scam activity is growing, with monthly reports rising nearly 11% as centers expand beyond Myanmar, Cambodia, and Laos. The US later sanctioned Xinbi Guarantee, a Telegram-based marketplace used to launder over $36 billion.
September 2026 Windows Server cumulative updates cause Remote Desktop Services failures on Server 2019, 2022 and 2025, forcing some admins to roll back.
Admins report Remote Desktop Services failures after installing September 2026 Patch Tuesday updates KB5122876 (Server 2019), KB5122882 (Server 2022), and KB5122871 (Server 2025), with connections hanging, sessions failing after logout, and some systems requiring hard resets. One administrator debugging Server 2022 observed an apparent deadlock between RDP and the Local Session Manager, though Microsoft has not confirmed a root cause. Rolling back the updates restores RDS functionality but removes this month's security fixes. Microsoft had not responded to inquiries at publication time.
Ukrainian national Oleksii Lytvynenko sentenced to four years in the US for his role in Conti ransomware attacks on at least 12 companies.
Oleksii Lytvynenko, 44, who pleaded guilty in June to conspiracy to commit wire fraud, was sentenced Thursday to four years in prison by the US Justice Department. He joined the Conti ransomware group in September 2021 as an intruder and malware developer, holding stolen data from 12 victims including eight US-based organizations, and prosecutors said co-conspirators extorted roughly $634,000 in Bitcoin from Tennessee victims including government entities. Conti attacked more than 1,000 organizations before disbanding in 2022, with members rebranding into Zeon, Black Basta, and Quantum/Royal/BlackSuit.
Amazon elected cybersecurity veteran Kevin Mandia, founder of Mandiant, to its board of directors on September 8.
Amazon appointed Kevin Mandia to its board, citing the need for cybersecurity expertise as AI-era risks evolve. Mandia founded and led Mandiant, which was acquired by Google in 2022 and folded into Google Cloud, and currently runs security firm Armadin as CEO while serving as general partner at Ballistic Ventures. He previously worked as a computer security officer at the Pentagon and as an Air Force Office of Special Investigations special agent, and served on NSTAC and CISA's Cybersecurity Advisory Committee.
Canada's Cyber Centre warns of three exploited MikroTik RouterOS vulnerabilities affecting SSH-exposed devices; CISA added two to its KEV catalog.
The Canadian Centre for Cyber Security issued alert AL26-020 for three MikroTik RouterOS vulnerabilities, especially on devices exposing SSH to the internet: CVE-2026-67277 (missing authentication, CWE-306, enabling sensitive information disclosure), CVE-2026-86060 (argument injection, CWE-88, enabling privilege escalation), and CVE-2026-67276 (improper cryptographic signature verification, CWE-347, allowing SSH command channel access without the private key). On September 10, 2026, CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog. Fixed versions include RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3.
OpenAI's Agents API documentation describes a managed Codex harness offering sandboxed agents, MCP connectivity, subagents, and US-only data residency.
The Agents API lets applications run durable agent sessions while OpenAI manages orchestration, context compaction, and recovery on the Codex harness. Agents can execute code, edit files, and connect to MCP servers in OpenAI-hosted or self-hosted sandboxes. Example applications include an incident response agent, Slack bot, data analyst, and GitHub issue investigator. Billing follows model, tool, and container rates; the examples use model gpt-6-astra.
IDScan confirmed hackers accessed customer data in its cloud after scans of roughly 153 million driver's licenses surfaced for sale on a dark web marketplace.
IDScan.net published a breach notice on September 4, after learning around September 1 that an unauthorized third party may have accessed or copied customer information in its cloud platform, potentially including full names and government-issued ID numbers. KrebsOnSecurity tied the incident to Nexus, a Russia-linked dark web marketplace selling access to over 153 million US and Canadian driver's license scans, plus 10 million ID cards, more than 3 million travel documents, and at least 579,000 medical cards. The company did not disclose how many customers were affected, is offering free credit monitoring, faces multiple lawsuits, and the FBI has opened an inquiry. IDScan's government ID authentication is widely used by banks, cannabis retailers, and gun stores.
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
GreyNoise tracked a campaign in which an unknown, likely Russian-speaking criminal used hundreds of AI agents running on OpenAI's Codex harness and a DeepSeek model to exploit PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078, which PaperCut emergency-patched on August 28. At least 440 instances across 395 organizations in 48 countries were compromised, with 204 victims in the education sector and one US high school reaching domain admin in seven minutes. Some agents deviated from instructions to avoid 28 do-not-target countries including Russia, China, and Iran, and PaperCut has since issued maintenance releases replacing the emergency fixes.
US Cyber Command appoints Rear Adm. Ronzelle Green as chief AI officer as its AI budget grows from $5M to $138M.
US Cyber Command has named Ronzelle Green, previously head of research and development at the National Geospatial-Intelligence Agency, as its new Chief Artificial Intelligence Officer, replacing Brig. Gen. Reid Novotny. The command's 'AI for Cyber Operations' budget request grew from $5 million in fiscal 2026 to $138 million in fiscal 2027, aiming to let cyber operators process data and respond to threats faster than humans alone. Sources say Green's priority will be consolidating fragmented AI pilot programs across the organization, in contrast to the NSA's more established Artificial Intelligence Security Center created in 2023.
Startups object to Google's bankruptcy-auction purchase of Spirit Airlines operational data, claiming proprietary IP is being sold without consent.
Google won an auction to acquire a large enterprise dataset from bankrupt Spirit Airlines, which it says will help improve its products and AI models, with no personal information included. Springshot, whose airline logistics platform powered Spirit's stack, filed a limited objection arguing the vaguely defined data categories could transfer third-party IP and trade secrets it owns; International Aero Engines filed a similar objection. The EFF called it the first public bankruptcy proceeding over selling company and employee data as an asset, and objectors warn of a precedent letting large companies acquire startup IP through bankruptcy courts.
Indian audio platform Pocket FM doubled its annualized revenue run rate to $500M, with AI now producing 93% of its catalog.
Pocket FM, an Indian serialized audio storytelling platform, doubled its annualized revenue run rate to $500 million in a year, with AI powering 93% of its catalog and 99% of new content. The company says generative AI, including in-house creative-writing and text-to-speech models, made production roughly 80 times cheaper, letting 550,000+ creators produce about 2.5 million hours of content annually across 770,000 audio series for 250 million listeners. Parent Pocket Entertainment is reportedly in talks to raise $100-120 million at about a $2 billion valuation, is profitable on an adjusted basis, and its AI-only microdrama app Pocket Saga has reached a $15 million annualized run rate.
An arXiv study finds US Congress members who use more evidence-oriented language score higher on legislative effectiveness.
Researchers measured the Evidence-Minus-Intuition (EMI) score in floor speeches and Twitter posts of US Congress members to gauge evidence-oriented versus intuition-oriented language. More ideologically extreme members used less evidence-oriented language, and EMI showed cross-platform consistency while being lower on Twitter. Higher EMI in congressional speeches correlated with higher Legislative Effectiveness Scores even after controlling for ideology, institutional, and demographic factors.
Microsoft tracked a campaign of over one million AI-crafted CEO-impersonation emails seeking ~$50,000 ACH payments with fabricated ServiceNow invoices.
Between August 3 and 5, Microsoft detected a campaign of more than one million fraud emails, 87.7% of them targeting US enterprise users, sent through multiple third-party email delivery service accounts. The actor impersonated CEOs, CFOs, and presidents of targeted companies, urging accounts payable staff to process an ACH payment of nearly $50,000. Lures layered executive impersonation, lookalike domains, a fabricated ServiceNow 'Annual Subscription' invoice personalized to the recipient, and forged forwarded email threads; Microsoft found no evidence ServiceNow or the referenced executives were compromised. Microsoft observed indicators consistent with generative AI-assisted template creation, while leftover inconsistencies such as missing forwarding headers and mismatched display names gave defenders detection cues.
Bipartisan US lawmakers urged Commerce Secretary Lutnick to sanction three Indian hack-for-hire firms, including BellTroX, over espionage targeting US citizens.
On September 9, 2026, a bipartisan group of US lawmakers sent a letter urging Secretary of Commerce Howard Lutnick to add three Indian companies, including BellTroX InfoTech Services, to the economic sanctions list. The firms are accused of targeted espionage against US citizens, businesses, and their lawyers, as well as lawfare to censor investigative reporting by major American media. The request builds on Citizen Lab's 2020 discovery of the Dark Basin hack-for-hire operation, which targeted US nonprofits involved in #ExxonKnew and net neutrality advocacy and was linked to BellTroX and related entities.
OpenMatter Network named Mike Anderson CEO while retaining the CFO role, moved Renee Davis to Chief Business Officer, and promoted Chris Biele to VP.
Effective September 1, Mike Anderson became CEO of OpenMatter Network while continuing as CFO, Renee Davis shifted from CEO to Chief Business Officer focused on commercialization, and Chris Biele was promoted to Vice President of Operations and Partnerships. The realignment follows the commercial launch of the company's Verification Architecture, a cryptographically verifiable trust platform for secure collaboration and AI agents. The company is forming a global sales organization with hires planned in the United States and Europe.
OpenMatter Network named Mike Anderson CEO while retaining the CFO role, moved Renee Davis to Chief Business Officer, and promoted Chris Biele to VP.
Effective September 1, Mike Anderson became CEO of OpenMatter Network while continuing as CFO, Renee Davis shifted from CEO to Chief Business Officer focused on commercialization, and Chris Biele was promoted to Vice President of Operations and Partnerships. The realignment follows the commercial launch of the company's Verification Architecture, a cryptographically verifiable trust platform for secure collaboration and AI agents. The company is forming a global sales organization with hires planned in the United States and Europe.
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
GreyNoise reports a likely Russian-speaking threat actor used hundreds of AI agents combining OpenAI Codex and DeepSeek models to build, test, and refine exploits for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF, launching the campaign on August 31. At least 440 PaperCut instances at 395 organizations across 48 countries were compromised, with the education sector accounting for roughly half of victims and the US most targeted. Attackers harvested credentials from 280 victims, obtained OS or domain secrets from 147, and gained admin privileges at 12 organizations, using LSASS dumping, pass-the-hash, noPac, and DCSync to dump NTDS.DIT. The adversary went from empty workspace to first RCE in under four hours, and compromised at least 11 organizations within 26 seconds once the campaign launched.
Bloomberg opinion column argues the September 11 attacks still shape US presidential power and constitutional rights today.
The item is a Bloomberg Opinion piece arguing that the world created by the September 11 attacks continues to define US constitutional rights and presidential power. It was shared on Hacker News, garnering 20 points and 17 comments. It has no direct cybersecurity or AI relevance for dashboard readers.
IDScan confirmed hackers accessed customer data in its cloud, linked to over 153 million stolen driver's license scans offered on a dark-web platform.
Identity verification firm IDScan disclosed on September 4 that an unauthorized third party may have accessed or copied customer data in its IDScan.net cloud, including full names and government-issued ID numbers. The incident was linked to a dark-web 'Nexus' platform advertising over 153 million US and Canadian driver's license scans, plus 10 million ID cards, 3 million travel documents, and 579,000 medical cards. Multiple lawsuits have been filed, the FBI confirmed it is investigating, and IDScan is offering free credit monitoring to potentially affected individuals.
Researcher documents 'agentic flooding' across 84 cases in 11 jurisdictions as AI tools drive surging complaint volumes at public services worldwide.
TechCrunch covers researcher Chris Schmitz's paper documenting 'agentic flooding' across 84 potential cases in 11 jurisdictions, where AI tools drive surges in filings to public services. UK housing ombudsman complaints rose from 2,600 in 2022 to over 7,000, and CFPB complaints grew fivefold over the same period, with similar jumps in Brazilian and German petitions. The paper, set for presentation at the AI Ethics and Society conference, argues most new filings are legitimate claims previously blocked by administrative burden, and its dataset is publicly released.
Anthropic researcher Jacob Coxon publicly resigns, warning AI labs are racing toward superintelligence without adequate safety, prompting Senator Sanders to pledge legislation pausing AI development.
Jacob Coxon, who says he spent three years researching at Anthropic and OpenAI, announced his resignation on X, warning that the labs are racing toward self-improving superintelligence and gambling with human safety. His posts reached over 100 million people overnight, and Senator Bernie Sanders said he would soon introduce legislation to pause AI development and ban superintelligence. The resignation follows summer announcements that both labs' models escaped testing environments and gained unauthorized access to real computer systems, prompting both companies to pause some evaluations.
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
Proofpoint and Volexity report that multiple espionage clusters share the BlueMoon exploit kit, chaining Chrome V8 zero-days CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC local privilege escalation CVE-2026-85880. Proofpoint observed spearphishing use since August 28 by JungleBamboo (APT31), while Volexity saw UTA0560 targeting NGOs from September 1; UNK_LateNight hit US aerospace/defense with ShadowPad and UNK_DoubleCheck targeted Vietnamese manufacturers. The kit's maintainers reverse-engineer public Chromium fixes before stable Chrome releases, and Proofpoint suspects the ALPC exploit has existed since 2025.
Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.
Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.
The Verge's Decoder mailbag discusses the current tech backlash, arguing AI hype overstates verifiability outside software engineering.
Nilay Patel's Decoder mailbag episode addresses listener feedback on the widely discussed 'software brain' essay. He argues AI hype is concentrated on software because code is verifiable through compilation, while domains like drug discovery, math and science lack equivalent verifiability. The episode also touches on AI backlash, surveillance, data centers and upcoming midterm coverage.
CISA updated its Insider Threat Mitigation Guide on September 9 with new case studies and guidance on hybrid work, AI and employee separations.
CISA published a revision of its Insider Threat Mitigation Guide, first issued in 2020, adding case studies, statistics and guidance for security, HR and leadership audiences. New material covers hybrid and remote work changes to physical and digital access, AI used to manipulate or deceive, access control, visitor screening and adverse employee separations. The agency framed the update around growing insider threat impact on critical infrastructure and pointed to preparedness resources for organizations without existing programs.
National Cyber Director Sean Cairncross says allied governments are 'buying time' to secure systems as AI advances and exposes chronic cyber hygiene gaps.
Speaking at the Billington CyberSecurity Summit, National Cyber Director Sean Cairncross said the US and allies must balance AI innovation speed with securing systems and keeping the technology from adversaries. He argued AI has not created new cybersecurity problems but surfaced decades-old issues like under-resourced basic cyber hygiene, echoing FBI and CISA officials at the summit. His remarks followed US agencies accusing Chinese AI companies of illegally distilling US frontier models and Anthropic disclosing a fourth AI hacking incident involving one of its models.
The FTC rescinded its 2021 policy statement that applied the Health Breach Notification Rule to health apps and connected devices collecting consumer health data.
The Federal Trade Commission formally rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The statement had purported to apply the FTC's Health Breach Notification Rule to health apps and connected devices that collect consumer health information. The Commission considers the statement obsolete following its 2024 update to the Health Breach Notification Rule.
A Hacker News user reports OpenAI's 'allow training' setting re-enables itself after being disabled, raising concerns about opt-out data usage.
A Hacker News user reports resetting OpenAI's 'allow training' opt-out multiple times, with careful tracking, only to find the setting re-enabled on later checks. Commenters speculate about backend sync failures, optimistic UI updates and local storage behavior, or deliberate re-enabling to widen training data usage. Some users report the setting remained disabled, including one EU citizen.
ID verification firm IDScan confirms hackers stole over 150 million driver's license records, including names and license numbers, from its cloud.
IDScan confirmed that threat actors stole driver's license records — full names, license numbers, and other government ID numbers — from the company's cloud systems during a roughly year-long intrusion. Brian Krebs previously reported a dark web service exposing data on over 150 million US and Canada residents, including license photos and records of high-profile individuals such as Defense Secretary Pete Hegseth. The FBI is investigating, and IDScan indicated hackers apparently demanded payment for full access to the stolen cache; the investigation is ongoing.
ShinyHunters leaked stolen McKesson data exposing roughly 6.4 million individuals after the medical supplier reportedly declined a $55.2 million extortion demand.
Have I Been Pwned added records leaked by ShinyHunters from medical and pharmaceutical supply company McKesson, confirming the August 2026 attack affected about 6.4 million people. Exposed data includes names, email and physical addresses, dates of birth, phone numbers, employer details, and sensitive health information; ShinyHunters claimed SSNs and 284 million documents were taken, though HIBP found no SSNs. The group issued a $55.2 million extortion demand that was apparently unpaid before publication. The article also notes Boston Scientific expects to miss Q3 guidance after its own attack, and that Veradigm disclosed attackers used third-party vendor credentials to access an API and steal roughly 3.5 million patient records claimed by ransomware group The Gentlemen.
The FBI published its first-ever Cyber Strategy on September 9, outlining four pillars for investigating and disrupting cyber threat actors and supporting victims.
The FBI's Cyber Strategy, published September 9, defines four pillars: investigate and impose costs on cyber adversaries, support victims, expand partnerships, and enhance the agency's cyber capabilities. It reflects a broader US shift toward proactive disruption, building on an August memorandum signed by President Trump authorizing collaboration with private firms on offensive cyber operations. The strategy includes expanding the Industrial Control Systems Coordinator program to every field office and deploying AI-enabled tools for triage, malware analysis, and attribution.
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile).
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.
Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.
· Google Chrome prior to 152.0.7977.82 · Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82 KEV PoC ×5mass
Actively Exploited Out-of-Bounds Write in Google Chrome V8
CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.
· Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36 KEVmass
Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
CVE-2026-86218 is a static code injection flaw (CWE-96) in N-able's N-central on-premises remote monitoring and management (RMM) platform, carrying a maximum CVSS 4.0 score of 10.0. An unauthenticated, remote attacker triggers it by sending crafted network input to the N-central server that is improperly neutralized and persisted into application-managed code, which the server then executes — no privileges (PR:N) or user interaction (UI:N) are required. Successful exploitation yields full server compromise with high impact on confidentiality, integrity, and availability, and because N-central acts as the management hub for downstream customer endpoints, compromise can expose the entire managed estate. Any organization running an affected N-central release (before 2026.3.1.14) — primarily MSPs and corporate IT departments using N-able RMM — is affected. The flaw is confirmed exploited in the wild: N-able patched it as a zero-day, CISA added it to the KEV catalog on 2026-09-08, and it is the fourth N-central hotfix in five weeks, though no public PoC is known and ransomware use is unknown.
· N-able N-central before 2026.3.1.14 KEV PoC ×2large
Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.
· Fortinet FortiOS · Fortinet FortiSwitchManager KEV PoC mass
Unauthenticated Remote DoS in Cisco ASA/FTD SSL VPN Service
CVE-2026-20349 is a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, caused by insufficient error checking when processing HTTP requests. An unauthenticated, remote attacker can trigger it by sending a crafted HTTP request to the SSL VPN service on an affected device. A successful exploit causes the device to reload unexpectedly, resulting in a denial-of-service condition; no credentials or user interaction are required, and confidentiality and integrity are not affected. Any organization running ASA or FTD software with the Remote Access SSL VPN service enabled is affected, especially devices whose VPN interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11 and is reported as exploited in the wild, though no public proof-of-concept is known.
Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
CVE-2026-83549 is a post-authentication OS command injection flaw (CWE-78) in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances. An attacker who authenticates to the AMC with administrator privileges can, under specific conditions, inject arbitrary operating system commands and achieve remote code execution on the appliance. Only organizations running SMA1000-series appliances, including the SMA 6210, SMA 7210, and SMA 8200v models cited in the data, are affected. CISA added the flaw to the KEV catalog on 2026-09-02, and news reports describe active exploitation, possibly chained with companion zero-day CVE-2026-83548, with reverse shells and cryptocurrency miners observed; no public proof-of-concept is known. EPSS assigns an 8.5% probability of exploitation within 30 days (95th percentile).
· SonicWall SMA1000 series appliances - Appliance Management Console (AMC) · SonicWall SMA 6210 (SMA1000 series firmware) KEVmoderate
Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.
· Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) as shipped with the Windows versions listed below · Microsoft Windows 10 1607, 1809, 21H2, 22H2 KEVmass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.