CVE-2019-0708, CVE-2020-0688, CVE-2021-26855, CVE-2026-0628, CVE-2026-42897, CVE-2026-55945, CVE-2026-58704, CVE-2026-76460, CVE-2026-78006, CVE-2026-78159, CVE-2026-87886, CVE-2026-89026, CVE-2026-90894
Domains:
getmacouscloud[.]com, ferncore13[.]com.
IP Addresses:
6.17.3.1, 6.17.4.1, 94.102.49.125
Get tomorrow's brief in your inbox
Today: Cisco ISE has a CVSS 10 authentication bypass zero-day (CVE-2026-76460) under active exploitation with a CISA KEV deadline of September 19. Google Pixel modem zero-day (CVE-2026-58704) enables zero-click privilege escalation and is also due September 19. Acronis cPanel backup plugin (CVE-2026-87886) rounds out a trio of actively exploited vulns with the same Friday deadline. An attacker hijacked an AI coding assistant session and spread the Shai-Hulud worm across ~100 internal repositories at a SaaS provider.
Cisco ISE Authentication Bypass Zero-Day (CVE-2026-76460)
A CVSS 10/10 authentication bypass in Cisco Identity Services Engine allows unauthenticated attackers to send crafted API requests, bypass the web management interface, and execute commands with root privileges. Both ISE and ISE-PIC are affected regardless of configuration. No workarounds exist beyond restricting traffic via iACLs. Successful exploitation lets attackers hide or delete IOCs on the device. CISA added this to KEV on September 16 with a September 19 deadline.
access.log on every node for suspicious usernames. Cross-check network and firewall logs outside the ISE appliance for unexpected uploads/downloads. Re-image affected nodes if compromise is suspected.Google Pixel Modem Zero-Click Privilege Escalation (CVE-2026-58704)
A logic error in the Pixel Cellular Modem (CVSS 8.0) allows remote proximal/adjacent privilege escalation with no user interaction. Google confirmed "limited, targeted exploitation." The zero-click, modem-level nature is consistent with commercial spyware or state-sponsored activity. CISA KEV deadline: September 19. The September update also fixes 109 additional flaws including ~50 critical-severity issues across bootloader, TEE, and multimedia subsystem components.
Acronis cPanel Backup Plugin Exploited in the Wild (CVE-2026-87886)
A local privilege escalation flaw (CVSS 7.8) in Acronis Backup plugin for cPanel & WHM (Linux) due to insecure file permissions is under active exploitation. Affects versions before build 1.9.3.1021. CISA KEV deadline: September 19. Limited details on attacker identity or campaign scope.
Issabel PBX Framework Hard-Coded JWT Key RCE (CVE-2026-89026)
A hard-coded HS256 JWT signing key in Issabel Framework's pbxapi allows unauthenticated remote attackers to forge bearer tokens and execute arbitrary OS commands as the Asterisk user (CVSS 9.8). Exploitation observed in the wild since September 9. The key is identical across every installation.
/pbxapi/ endpoint. Audit for unauthorized command execution under the Asterisk user.Ransomware Trends in Japan H1 2026: The Gentlemen, Qilin, and SMB Targeting
Cisco Talos reports 90 ransomware incidents affecting Japanese organizations in H1 2026 (up ~4.7% YoY). The Gentlemen was the most active group with 14 incidents, doubling leak site listings from 48 in January to 105 in July. Organizations with capital under JPY 1 billion accounted for 78% of victims (up from 69% in 2025), confirming continued SMB targeting. Qilin (second-most active) is using AI to improve operational efficiency. Russian-speaking individuals are possibly involved in The Gentlemen's operations. Manufacturing remains the most affected sector at 34%.
Nipigon Hospital Ransomware Attack
Nipigon District Memorial Hospital in Canada disclosed a ransomware incident affecting IT systems. Patient services are impacted. No attribution or further technical details available.
AI Coding Assistant Hijacked, Shai-Hulud Worm Spreads Across ~100 Repositories
Mandiant reports an attacker hijacked an active AI coding assistant session at an unnamed SaaS provider. The assistant recommended a poisoned PyPI package, which was accepted. The attacker stole GitHub OAuth tokens and deployed the Shai-Hulud worm across approximately 100 internal code repositories, exfiltrating repository secrets and product source code. A second infection occurred when another employee pulled a compromised package from the company's official namespace. This follows August incidents where Shai-Hulud variants targeted developer tools, CI/CD pipelines, and AI tool configuration files.
N0va Phishing Kit Targeting US and EU Organizations
N0va campaigns impersonate Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Instead of traditional fake login pages, N0va guides victims through legitimate authentication flows, capturing access and refresh tokens. Token exchange and device registration mechanisms then establish SSO access to email, files, and cloud applications. Observed across government, technology, consulting, and healthcare sectors.
BragJack: Browser Extensions Hijacking Agentic AI Assistants (CVE-2026-0628, CVE-2026-55945)
Forever Security demonstrated that a single browser extension with two common permissions (web page modification and declarativeNetRequest) can hijack built-in AI assistants in Chrome/Gemini, Edge/Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome. The attack bypasses the trust boundary between extensions and privileged AI agents. On Chrome, attackers could access local files and activate camera/microphone. On Comet, the agent could read any file, list browsing history, and take screenshots. Google patched CVE-2026-0628 in Chrome 143.0.7499.192; Microsoft patched CVE-2026-55945 in Edge 150.0.4078.48.
WordPress The Events Calendar RCE (CVE-2026-78006, CVE-2026-78159)
Two unauthenticated RCE vulnerabilities (both CVSS 9.8) in The Events Calendar plugin affect 200,000+ WordPress sites. CVE-2026-78159 is a code injection via insufficient validation; CVE-2026-78006 is a PHP object injection exploitable when event comments are enabled. Both lead to full site compromise. Fixed in versions 6.17.3.1 and 6.17.4.1 respectively. Roughly half of the 600,000+ installations may still be unpatched.
Three Threat Groups Targeting Russian Enterprises via Exchange and Active Directory
Kaspersky reports NightEagle, Hacking Cat, and Toy Ghouls are actively targeting Russian enterprises. NightEagle uses compromised VPN credentials via Cloudflare WARP tunnels, deploys GhostContainer backdoor on Exchange servers (leveraging CVE-2020-0688, EPSS 100%), exploits BlueKeep (CVE-2019-0708) for lateral movement, and performs DCSync attacks against Active Directory. Hacking Cat exploits Exchange vulnerabilities (CVE-2021-26855, CVE-2026-42897) to deploy Gorilla RAT. While these campaigns target Russian organizations, the TTPs are relevant: Exchange exploitation, DCSync, Kerberos ticket abuse, and RDP tunneling via dev tunnels are techniques used globally.
CISA Ends Weekly Vulnerability Bulletin
CISA has discontinued its weekly vulnerability bulletin. Organizations relying on this as a vulnerability awareness source need to identify alternative channels such as CISA KEV alerts, NVD feeds, and vendor advisories.
CISA Publishes Cyber Decoy Guidance
CISA released guidance on implementing cyber decoys (tripwires, breadcrumbs, honeytokens) to detect adversaries using legitimate credentials and living-off-the-land techniques. The guidance maps to MITRE Engage and ATT&CK frameworks. Relevant for organizations adopting Zero Trust that need high-fidelity post-compromise detection with reduced alert fatigue.
AMOS Stealer Targeting macOS via Fake Toolkit Pages
Unit 42 documents an Atomic macOS Stealer campaign using fake "macOS toolkit" pages that instruct users to paste commands into Terminal. The malware exfiltrates system info, credentials, browser data, and cryptocurrency wallet contents. Persistence is established via hidden directories in Library/Application Support. The infection requires the user to enter their password at a macOS prompt.
Scans Targeting Hospitality PBX Applications
SANS ISC observed scanning from 94.102.49.125 (AS202425, bulletproof hosting) targeting hospitality applications including PIAF-HMS, a legacy PBX management system with SQL injection vulnerabilities and no authentication. Hotels remain soft targets for personal data theft and guest MitM attacks.
Treasury Secretary: No Liability Exemptions for AI Labs
Treasury Secretary Bessent told Congress that AI creators should be held liable for what they build and that liability waivers should not be granted. He also discussed the Gold Eagle clearinghouse (Treasury + CISA) for coordinating vulnerability management across the financial sector.
Parallels Desktop Local Root Escalation (CVE-2026-90894)
JFrog disclosed a local privilege escalation flaw in Parallels Desktop for Mac. The prl_disp_service runs as root with a world-writable socket; any local user can connect, authenticate, and inject commands into tar's --use-compress-program option to execute arbitrary code as root. Fixed in Parallels Desktop 27, which Intel Macs cannot install.
Three CISA KEV additions in a single day, all with a September 19 deadline, is an aggressive patch cadence. The Shai-Hulud AI coding assistant attack represents a maturation of supply chain threats; AI-assisted development workflows are now direct attack surfaces. Ransomware continues disproportionately impacting SMBs, with Japan's data showing organizations under JPY 1 billion accounting for nearly 80% of victims, reinforcing that attackers follow the path of least resistance rather than biggest payoff.