Cisco ISE zero-day bypasses authentication and is under active attack
CVE-2026-76460 lets remote attackers bypass authentication on Cisco ISE and ISE-PIC regardless of configuration. Cisco confirmed active exploitation, offers no workaround, and recommends reimaging compromised nodes because attackers may erase evidence after gaining access. The Hacker News, September 17, 2026
Unbound DNSSEC flaw can enable remote code execution from a malicious zone
A critical heap overflow in Unbound’s DNSSEC validator affects every release through 1.26.0. An attacker controlling a malicious zone can trigger the flaw remotely, making upgrades to 1.26.1 a priority for enterprise and service-provider resolvers. The Hacker News, September 17, 2026
Brevo supply-chain attack used a Cloudflare key to alter customer-facing JavaScript
Attackers used a hardcoded, full-permission Cloudflare API key to modify Brevo content at the CDN edge and inject ClickFix scripts into embedded customer components. Origin files remained unchanged, demonstrating how edge compromise can evade conventional integrity monitoring. BleepingComputer, September 17, 2026
AI-powered RatHat malware adapts its navigation across compromised Android devices
RatHat sends Android Accessibility data to an AI assistant for real-time interface navigation, while abusing ADB for shell access and persistence. The approach replaces rigid automation with adaptive control, expanding the practical role of AI in endpoint malware. BleepingComputer, September 17, 2026
Spain’s data agency gets first report of AI-powered data breach
The Spanish Data Protection Agency received a breach report alleging an AI agent autonomously found vulnerabilities, accessed systems, modified personal data, and viewed financial documents. The case highlights how automated attacks can compress detection and response timelines. BleepingComputer, September 16, 2026
Iran-linked spyware uses messaging platforms to target dissidents and journalists
U.S., U.K., and Dutch agencies warned that Iranian state-linked actors deploy CHOSEN BRICK through social engineering on WhatsApp and Telegram. The Windows malware can steal messages and email, capture screens, access microphones, and maintain persistence after reboot. National Cyber Security Centre, September 15, 2026
AI-assisted researchers generate 1,285 reports during Vercel sandbox security challenge
Vercel’s two-week challenge produced 1,285 vulnerability reports against its Firecracker-based AI-agent sandbox, including one validated critical flaw. The volume forced automated triage and illustrates how AI assistance is changing vulnerability discovery speed and security-testing capacity. SecurityWeek, September 15, 2026
Attackers compromise Thai broadband provider and maintain access with MeshCentral
Researchers uncovered an attacker toolkit tied to an intrusion at broadband provider 3BB, including Fortinet and F5 exploit scripts, credential-harvesting tools, and a MeshCentral agent for persistent remote access. Telecom compromises can expose both infrastructure and subscriber credentials. SecurityWeek, September 15, 2026
Red Heron automates Gitea exploitation and pivots into victim infrastructure
A suspected China-linked actor converted public CVE-2026-60004 exploit code into an automated Gitea attack framework within days, scanning 1,386 instances. Compromises progressed from repository theft to credential collection, persistence, lateral movement, and root access on Proxmox infrastructure. Acronis, September 13, 2026
AWS confirms permanent customer data loss after physical destruction of data centers
AWS acknowledged that some customer resources and data could not be recovered after Iranian strikes damaged facilities in Bahrain and the UAE. The loss highlights the limits of provider resilience and the operational need for independent, geographically separated backups. Ars Technica, September 16, 2026
Russian-linked hackers use Claude across malware development and network operations
Anthropic identified a Russia-linked group using Claude against more than 20 organizations for malware development, phishing, credential collection, data extraction, and partially autonomous operations. Defenders should expect AI to accelerate multiple stages of established intrusion playbooks. Euronews, September 16, 2026
Google Cloud expands session controls to reduce credential-theft exposure
Google completed deployment of a 16-hour default session length and added granular Context-Aware Access controls for cloud sessions. Administrators can now apply shorter sessions to sensitive resources, reducing the useful lifetime of stolen credentials and hijacked authenticated sessions. Google Cloud, September 15, 2026
More cybersecurity news
- Last week’s news roundup
- More cybersecurity news
- All articles sponsored by NetworkTigers
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
