Cybersecurity Brief – 2026-09-14

Mon, 14 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Revolut disclosed a data breach in which sensitive customer data, including financial information and passport details, was released to a threat actor impersonating a government agency and using a legitimate government email domain. The number of affected customers has not been specified ^[7]^[16]^[24].
Telus warned customers of account breaches after attackers used stolen credentials over several months to access subscriber personal data and billing records ^[20].
A malicious Twitch browser extension leaked OAuth tokens for nearly 31,000 users to proxy servers operated by a Russian commercial bot service ^[3].

Threat actors are actively exploiting a maximum-severity GitLab vulnerability, according to CISA ^[9].
Chinese threat actors are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows, enabling remote code execution and deployment of the GrayRabbit backdoor ^[10]^[18].
Three vulnerabilities in JFrog Artifactory have been exploited to bypass authentication and escalate privileges to administrator, facilitating backdoor deployment ^[21].
ConnectWise patched a vulnerability in ScreenConnect that allowed attackers to send and execute files without authorization during active remote sessions, which was exploited in worm-like attacks ^[22].

Threat actors are leveraging AI hallucinations by using “slop squatting” techniques to plant phishing links and other malicious content in AI-generated outputs, directing users to phishing pages ^[1].
Chinese-aligned espionage groups are exploiting the Tencent Sogou Input Method vulnerability to deploy malware ^[10]^[18].

Attackers are increasingly combining social engineering with malicious OAuth applications to access Google Workspace data without relying solely on stolen passwords ^[5].
There is a trend of using AI in both offensive and defensive cybersecurity operations, with vulnerability discovery accelerating due to AI-driven tools ^[2].
Sexually explicit deepfake websites are targeting over 100 politicians across 22 European countries, with nearly all victims being women ^[13].

Rising concerns and debate over the risks of AI to humanity are prompting renewed scrutiny and calls for regulatory oversight as AI models become more powerful ^[15]^[17].