Major Incidents or Breaches

  • Hackers exploited a vulnerability in a VPN product used by Japan’s Digital Agency, resulting in a data breach that exposed the personal information of approximately 246,000 government employees [20][36].
  • Revolut unintentionally disclosed personal and financial information of users to a third party impersonating a government agency [43].
  • HBO Max’s official Reddit account was compromised and used to distribute malicious ads containing ClickFix attacks, leading to malware infections on Windows and macOS devices [23][39][45].

Newly Discovered Vulnerabilities

  • A critical vulnerability in LiteSpeed Web Server Enterprise allows a low-privilege website user to gain root access on a shared-hosting server, according to a cPanel advisory [6].
  • Cisco Secure Email Gateway is affected by a critical zero-day vulnerability (CVE-2026-76461) that enables unauthenticated attackers to execute arbitrary commands as root. This flaw is under active exploitation [7][18][40].
  • A new hardware attack named DDRop has been disclosed, which can bypass the memory protection of Intel TDX and AMD SEV-SNP confidential computing environments by silently dropping memory writes [9].
  • A maximum severity path traversal vulnerability (CVE-2026-85706) in GitLab Community Edition and Enterprise Edition puts software supply chains at risk [27].
  • A flaw in Telegram Desktop allowed hidden JavaScript to be embedded in messages, which could exfiltrate chat content when exported to HTML files [11].
  • Apple released a major update across all operating systems, patching over 200 vulnerabilities, including kernel flaws that could allow memory corruption, privilege escalation, system termination, and information leaks [33][37].

Notable Threat Actor Activity

  • A Chinese threat actor exploited a chain of recently patched Chrome and Windows zero-days to deliver the GRIMWEDGE JavaScript backdoor via spear-phishing [8].
  • The Red Heron group, suspected to be China-linked, rapidly exploited a recently disclosed Gitea RCE vulnerability to compromise 13 organizations across six countries [12].
  • Russian threat group Sandworm chained Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet malware [26].
  • Ransomware gangs have begun exploiting a critical VMware vCenter RCE vulnerability, as warned by CISA [15].
  • Five alleged leaders of the Black Axe cybercrime syndicate, known for global cyber-enabled financial fraud, have been extradited to the United States to face charges [16].
  • An attacker gained and maintained root access inside the network of Thai broadband provider 3BB using the MeshCentral management tool and targeted subscriber credentials [10].

Trends, Tools, or Tactics of Interest

  • Social engineering campaigns are employing phony NDA documents to lure employees into moving conversations to WhatsApp and personal email, evading corporate security controls [1].
  • Threat actors are leveraging AI hallucinations to plant phishing links in AI-generated output, a tactic known as “slop squatting” [2].
  • Mass-scanning campaigns are targeting internet-exposed Vite development servers to extract cloud credentials and configurations from AWS and Azure environments [5][24].
  • Attackers are exploiting the Marimo RCE vulnerability to reach SSH bastions in as little as eight seconds, with AI accelerating the timeline from discovery to exploitation [3][14].
  • The whitelist-bypass tool tunnels traffic through commercial video-calling platforms using WebRTC, bypassing network domain restrictions [34].
  • Fake Bitrefill checkout pages are appearing in search results, tricking users into sending cryptocurrency to scammers [47].
  • A Twitch browser extension with 30,000 installs was found to be exposing users’ OAuth session tokens to a commercial bot service [22].
  • Google’s new search result redirects make it more difficult for users to verify link destinations before clicking, potentially increasing phishing risk [48].
  • Homebrew 7.0.0 introduces a built-in vulnerability scanner and stronger security controls [21].
  • WordPress is launching automated security reviews for every plugin release before distribution through its update API [13].

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft introduced an AI Code of Conduct establishing boundaries for cyberattack capabilities, chain of command, and safety constraints, differentiating between defensive research and operational attack use [38].
  • The Manhattan District Attorney’s Office seized 12 deepfake websites targeting around 1,200 victims, marking the largest legal action against harmful deepfake sites to date [31].
  • The CEO of Anthropic called for slowing the pace of frontier AI development to allow security and risk prevention efforts to catch up, prompting public debate and a response from China’s Ministry of Foreign Affairs advocating for international cooperation on AI [28][41].

Sources#

  1. Japan's Digital Agency says VPN flaw exposed 246,000 personnel records - bleepingcomputer.com
  2. 240,000 Hit by Data Breach at Japan’s Digital Agency - securityweek.com
  3. Personal, Financial Info Exposed in Revolut Data Breach - securityweek.com
  4. Hackers hijack HBO Max Reddit account to push malware in ClickFix ads - bleepingcomputer.com
  5. Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack - securityweek.com
  6. HBO Max’s verified Reddit account hijacked to spread malware - malwarebytes.com
  7. LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server - thehackernews.com
  8. Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution - thehackernews.com
  9. Cisco patches Secure Email Gateway zero-day exploited in attacks - bleepingcomputer.com
  10. Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation - securityweek.com
  11. New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing - thehackernews.com
  12. Maximum Severity GitLab Flaw Puts Supply Chains at Risk - darkreading.com
  13. Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports - thehackernews.com
  14. Apple Updates Everything, (Mon, Sep 14th) - isc.sans.edu
  15. Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases - securityweek.com
  16. China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE - thehackernews.com
  17. Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries - thehackernews.com
  18. 'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink - darkreading.com
  19. CISA: Critical VMware RCE flaw now exploited by ransomware gangs - bleepingcomputer.com
  20. Suspected Black Axe gang leaders face cybercrime charges in the US - bleepingcomputer.com
  21. 3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials - thehackernews.com
  22. Social Engineering Campaign Uses Phony NDAs to Avoid Detection - blog.knowbe4.com
  23. Warning: “Slop Squatting” Directs AI Users to Phishing Pages - blog.knowbe4.com
  24. Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers - thehackernews.com
  25. Hackers target exposed Vite dev servers to steal AWS, Azure secrets - bleepingcomputer.com
  26. Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds - thehackernews.com
  27. ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits - thehackernews.com
  28. whitelist-bypass – WebRTC Tunnels Through Video-Calling Platforms - darknet.org.uk
  29. Search results are sending people to fake Bitrefill checkouts - malwarebytes.com
  30. Twitch extension with 30K installs exposes users’ OAuth tokens - bleepingcomputer.com
  31. Google’s new search redirects make links harder to check before you click - malwarebytes.com
  32. Homebrew 7.0.0 gets built-in GUI, better security controls - bleepingcomputer.com
  33. WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution - thehackernews.com
  34. Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints - securityweek.com
  35. New York Seizes a Dozen Celebrity Deepfake Websites - wired.com
  36. Anthropic CEO: Time to Shift From Improving to Controlling AI - darkreading.com
  37. Beijing Hits Back at Anthropic CEO’s Call to Curb China’s AI Development - securityweek.com