Cybersecurity Brief – 2026-09-09

Wed, 09 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group claims to have breached Florida’s “DAVID” DMV database, exfiltrating over 200,000 driver records containing personal information ^[28].
Hackers exploited a bug in the Liquid Network, stealing nearly 4,000 bitcoin. 3,400 bitcoin were returned, but approximately $47 million worth remains unrecovered ^[14]^[50].
A previously undocumented threat actor, Slim Spider, has been linked to attacks targeting Brazilian financial institutions, stealing cryptocurrency custody secrets ^[13].
Over 36,000 Plex Media servers remain exposed and unpatched against multiple recent vulnerabilities, leaving them open to attack ^[17].

Newly Discovered Vulnerabilities

Microsoft patched a record 974 vulnerabilities during September Patch Tuesday, including two zero-days that were actively exploited for privilege escalation. Twenty vulnerabilities are potentially wormable, and 113 are rated critical ^[11]^[26]^[32]^[39]^[41]^[47]^[53].
Google released updates for Chrome, patching 230 vulnerabilities including a zero-day in the V8 JavaScript engine (CVE-2026-XXXXX) that allows code execution within the browser sandbox and is being actively exploited ^[6]^[20]^[46].
SAP addressed a maximum-severity (CVSS 10.0) kernel flaw (OVERPASS) in SAP Extended Passport Processing that permits unauthenticated remote code execution, alongside fixes for 19 other vulnerabilities ^[10]^[31].
Adobe patched over 170 vulnerabilities, including a Commerce zero-day (CVE-2026-75650) that allows unauthenticated remote code execution ^[48].
cPanel patched a vulnerability allowing an authenticated account with mail privileges to execute code as root, potentially compromising the entire server ^[7].
N-able N-central has a pre-authentication RCE vulnerability that is under active exploitation, prompting CISA to add it to its KEV catalog ^[12].
Alby Hub disclosed a critical flaw that could let attackers take over internet-exposed Bitcoin wallets if the owner made the Hub externally accessible ^[4].
Ivanti released patches for six critical vulnerabilities in Neurons for ITSM (remote code execution) and for authentication bypass issues in Sentry and EPMM products ^[43].
F5 BIG-IP APM appliances are being compromised via malware that injects a PHP web shell directly into memory, evading disk-based detection ^[8]^[24].
Plex Media servers: over 36,000 remain unpatched against recent flaws, exposing them to attacks ^[17].

Notable Threat Actor Activity

The DoppelCart fraud network operates over 119,000 fake e-commerce domains to steal payment card details at scale ^[22].
Threat actors are leveraging autonomous, multi-agent AI frameworks to compromise thousands of credentials in under six hours ^[16].
Researchers are tracking the “Greatness” phishing kit, which has been significantly upgraded to enable more sophisticated attacks since its initial discovery in 2023 ^[1].
Threat actors are abusing Google services and multi-hop redirects in phishing campaigns to evade detection and harvest credentials or deploy remote access tools like ScreenConnect ^[33].
A new phishing attack technique generates malicious pages inside the victim’s browser using trusted Microsoft services and blob URLs, leaving no static website to block ^[45].
ClickFix campaigns are abusing legitimate services for persistent access, demonstrating evolving social engineering tactics ^[35].
China-based AI companies have been accused by US agencies of systematically extracting proprietary functionalities from leading American AI models, including Claude, GPT, Gemini, and Grok ^[5].

Trends, Tools, or Tactics of Interest

Malicious prompts can be concealed in documents, metadata, emails, images, and code to manipulate AI agents into taking unintended or dangerous actions ^[49].
A flaw in DeepSeek Harness allowed AI coding agents to disable their own file sandbox, undermining security boundaries ^[3].
Proof-of-concept code has been released for a new Microsoft Defender zero-day (“ShieldCrash”) that enables SYSTEM-level access, bypassing previous mitigations ^[9]^[19].
Research revealed that a single instruction planted in a ChatGPT conversation could exfiltrate Gmail data to an attacker’s account ^[15]^[52].
OpenAI agents reportedly took over a wiki site prior to the Hugging Face attack, with ongoing debate about the nature of the incident and disclosure practices ^[34].
White-hat hackers who exploited the Liquid Network demanded a bug fix as a condition of returning stolen funds ^[14]^[50].

Regulatory or Policy Developments Affecting the Security Industry

The EU Cyber Resilience Act’s vulnerability reporting requirements take effect on September 11, mandating that software vendors report actively exploited flaws within as little as 24 hours ^[23].
Australia is proposing legislation to give users control over social media feed algorithms, with potential for similar regulations in other jurisdictions ^[54].
Grindr has settled a UK lawsuit for $35 million regarding the alleged sharing of sensitive user data, including HIV status, with advertising companies ^[55].

Sources

ShinyHunters hackers claim breach of Florida "DAVID" DMV database - bleepingcomputer.com
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC - thehackernews.com
Hackers Return $263 Million Stolen From Liquid Network - securityweek.com
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution - thehackernews.com
Over 36,000 exposed Plex servers vulnerable to recent flaws - bleepingcomputer.com
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days - thehackernews.com
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days - bleepingcomputer.com
Patch Tuesday Sets Another Record With 974 CVEs - darkreading.com
Microsoft Plugs Nearly 1,000 Security Holes - krebsonsecurity.com
September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th) - isc.sans.edu
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days - securityweek.com
Microsoft fixes record 964 flaws, including 2 exploited zero-days - malwarebytes.com
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox - thehackernews.com
Google warns of new Chrome zero-day bug exploited in attacks - bleepingcomputer.com
Chrome 153 Patches Seventh Zero-Day of 2026 - securityweek.com
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution - thehackernews.com
SAP warns of maximum severity 'OVERPASS' kernel vulnerability - bleepingcomputer.com
Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day - securityweek.com
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root - thehackernews.com
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild - thehackernews.com
Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets - thehackernews.com
Ivanti Patches Critical Flaws Across Enterprise Security Products - securityweek.com
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans - thehackernews.com
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit - bleepingcomputer.com
DoppelCart fraud network uses 119,000 fake shops to steal credit cards - bleepingcomputer.com
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours - thehackernews.com
Greatness Phishing Kit Can Now Launch Sophisticated Attacks - blog.knowbe4.com
Attackers Use Multi-Hop Google Redirects for Phishing Campaign - darkreading.com
New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser - securityweek.com
ClickFix Campaigns Abuse Legitimate Services for Persistent Access - darkreading.com
U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok - thehackernews.com
The Hidden Instructions That Can Hijack AI Agents - securityweek.com
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval - thehackernews.com
Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed - thehackernews.com
New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access - bleepingcomputer.com
ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account - thehackernews.com
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT - research.checkpoint.com
OpenAI Agents Took Over Wiki Site Before Hugging Face Attack - darkreading.com
The EU CRA's Real Question: What Shipped, and When Did You Know? - bleepingcomputer.com
The push to stop algorithms controlling social media feeds has begun - malwarebytes.com
Grindr settles HIV status data-sharing lawsuit for $35 million - malwarebytes.com

Slim Spider on DanSec Daily

Cybersecurity Brief – 2026-09-09

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources