60
60
45
60
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
60
60
60
Victims' reluctance to report ransomware stymies efforts to curb cyberattacks, say federal officials
60
60
Spain reports first alleged AI-powered data theft attack
Spain's data protection agency received a report of an AI agent autonomously exploiting flaws, logging in, altering personal data, and reading invoices.
The Spanish Data Protection Agency (AEPD) was notified of an incident in which an AI agent powered by a known LLM reportedly searched for vulnerabilities, gained access to systems, modified personal data, and accessed financial documents. AEPD has not yet investigated or verified the report but says it shows AI-related data breaches are no longer theoretical. The agency urged defenders to revise incident-response procedures, strengthen credential and identity security, and explicitly account for machine-speed AI-assisted attacks.
65
60
Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Mass scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS, Azure, and Terraform credentials.
F5 honeypots detected over 800 attacks and roughly 32,000 events in a month against internet-exposed Vite development servers, abusing CVE-2026-39364 (file access control bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5) via parameters like ?raw and ?import&raw. Attackers used extensive wordlists to harvest .env files, AWS/Azure credentials, Terraform state, and /proc/self/environ, with double-encoded traversal to bypass WAFs. The same IPs also leveraged older Vite flaws CVE-2025-30208, actively-exploited CVE-2025-31125, and CVE-2024-45811, primarily from US, Belgium, and Netherlands using Google Cloud ranges.
70
60
60
Florida confirms DMV database breached via stolen police account
Florida confirms its DAVID driver database was breached using stolen police credentials; ShinyHunters claims theft of 200,000+ records.
The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database, learned of on September 4, 2026, and says the breach was quickly mitigated with none ongoing. Investigators found the attacker used compromised credentials of a single Plant City Police Department employee that were improperly stored on a personal electronic device. The ShinyHunters extortion gang claims it stole more than 200,000 driver records starting September 3 and shared a Jeffrey Epstein record as proof; FLHSMV has not confirmed the count. The agency notified the Florida Attorney General's office and is working with the Florida Digital Service and Florida Department of Law Enforcement.
75
60
Week in review: Covertly connected and insecure Android VPN apps, Apple fixes exploited zero-day
60
60
Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.
78
60
60
60
60
60
60
60
60
60
60
60
60
60
Hackers abused Claude to extract secrets from 1.8M Android apps
Anthropic reports ShinyHunters, Midnight Blizzard, and GTG-10007 misused Claude to automate credential theft, malware operations, and espionage against dozens of victims.
Anthropic's threat report details how ShinyHunters member 'frkoo' ran a credential-harvesting pipeline on ten AWS EC2 workers that mass-downloaded and decompiled 1.8 million Android APKs, scanning for hardcoded secrets with TruffleHog. In one AI-assisted operation, an actor extracted 2,100+ Azure AD authentication tokens across more than 40 Microsoft tenants in roughly 34 hours, and ShinyHunters affiliates also stole AI API keys and breached a SaaS provider affecting about 200 downstream customers. Russian espionage group Midnight Blizzard used Claude Code skills to automate malware development, phishing, C2, and exfiltration against 20+ government and defense entities, rebuilding malware automatically when detected. Chinese-linked GTG-10007 ran autonomous vulnerability research that uncovered zero-days in a major endpoint security product and hit roughly 50 organizations with confirmed compromises; Anthropic disrupted the abuse and banned the accounts.
78
60
60
60
60
60
What Zero-Day Response Should Be in the Post-Mythos Era
Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.
The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.
45