Citrix introduced Citrix Session Insights, an AI feature for Citrix SecurAccess with Chrome Enterprise. It records browser sessions of employees and autonomous AI agents, analyzes risky behavior, and suggests measures based on security policies.
Insurer Hollard said its systems were not hacked, attributing claims by the hacker group The Gentlemen to a June attack on third-party provider MIP Holdings. MIP confirmed a data leak affecting clients of about 45 South African insurance companies via its Jira platform.
OPSWAT disclosed two zero-day vulnerabilities in TP-Link Tapo C200 cameras: CVE-2026-15315 allows authentication bypass via session replay and access to video and recordings, while CVE-2026-15316 causes denial of service. Both were fixed in firmware V5_1.4.6 on August 18; researchers are working on another critical flaw.
Mandiant's AI Risk and Resilience report describes an accounting AI agent that entered a loop and made over 15,000 expensive API calls in less than an hour, accumulating about $50,000 in cloud costs and disrupting work transactions. The report also notes prompt injection attacks, AI supply chain compromises, and the first confirmed case of an AI-developed zero-day.
Rubrik added MCP support so third-party AI agents (Claude, Copilot, and custom) can directly access Rubrik Security Cloud telemetry and trigger recovery and compliance workflows. It also launched Code Guardian, based on Claude Mythos 5, to analyze vulnerabilities on isolated code copies. Both features are in private preview.
BT Email customers report receiving hundreds or even over 1,000 unauthorized password reset PIN messages within minutes. BT says accounts are secure and is investigating the cause; one customer claims losing access to email and BT ID.
UK-based SE Labs has launched PIVOT, an independent testing program for cyber defense tools' resilience to hacker group attacks. Broadcom, CrowdStrike, Fortinet, Palo Alto Networks and Sophos are participating, with results expected in January 2027.
A vulnerability CVE-2026-48710 (BadHost) was found in the ASGI framework Starlette (versions 0.8.3–1.0.0): a malformed Host header distorts request.url.path and bypasses path-prefix authorization checks. CISA added it to the exploited vulnerabilities catalog; the fix is Starlette 1.0.1.
Oracle released its September Critical Security Patch Update with 673 patches covering over 800 vulnerabilities, including 672 unique CVEs. More than 100 flaws are critical, and over 240 are remotely exploitable without authentication. The largest patch sets were for E-Business Suite (159) and Fusion Middleware (153).
NIST and CISA published NIST IR 8587 with recommendations to protect tokens and assertions from forgery, theft, and abuse. The guide covers signing key management, token validation, lifetime and revocation, and responsibility sharing between cloud providers and their customers.
A public PoC for CVE-2026-42167 in the mod_sql extension of the ProFTPD server, with a CVSS score of 8.1, has been published on Exploit-DB. The exploit demonstrates a path from SQL injection to RCE after authentication when using PostgreSQL; the fix is ProFTPD 1.3.9a.
Cohesity released Agent Resilience, a Cohesity Data Cloud feature that backs up enterprise AI agent memory and configuration and allows rollback to a trusted state after a failure or prompt injection. AWS Bedrock agents are supported at launch, with general availability expected by the end of the year.
Google released September patches for Pixel, fixing 110 vulnerabilities, including zero-day CVE-2026-58704 in the modem, which is already used in targeted attacks. The flaw allows privilege escalation over an adjacent network without user interaction.
Valve said the cyberattack on CEVA Logistics in August affected only part of the logistics partner's systems. The order processing system for Steam hardware was not affected, and there are no traces of attackers accessing customer data.
Gartner analyst Craig Lawson said at IT Symposium in Australia that AI tools like Anthropic's Mythos have already found most vulnerabilities in old codebases. He predicts 2027 will see the first decline in CVE numbers and severity, with companies conducting daily pen tests.
The open-source engine DeepZero has been released, automating the search for exploitable Windows kernel drivers. It filters binaries by PE headers, IOCTL, and the loldrivers.io database, then analyzes the remainder via Ghidra, Semgrep, and a language model. The project author has already found several confirmed vulnerabilities in the Snappy Driver Installer corpus.
A paper describes an attack on encrypted chain-of-thought blocks at OpenAI, Anthropic, and Google, using a weak 'oracle' model to decrypt the reasoning of strong models. Decrypting 10,000 traces cost about $720, and all three providers closed the main vulnerability before publication.
A critical vulnerability CVE-2026-5430 (CVSS 9.8) in WSO2 API Manager allows bypassing JWT signature verification and forging admin tokens. According to watchTowr, the flaw is already actively exploited in real attacks and can lead to account takeover.
Indian investigators arrested two people and are determining how 500,000 fake Gmail accounts were created, with the accounts using two-factor authentication. Questions may arise for Google.
A critical vulnerability CVE-2026-49869 (CVSS 10.0) was found in Kestra OSS — authentication bypass via paths ending in /configs, escalating to remote code execution. The vulnerability was added to CISA's exploited catalog on September 2, 2026; fixes are in versions 1.0.45 and 1.3.21.
On July 30, 2026, CISA issued an alert about rising attacks on programmable logic controllers (PLCs) in the US water and wastewater sector. Attackers change passwords, locking out operators, and IP addresses, disabling devices; this led to boil-water notices and manual operations. The agency requires removing PLCs from the internet and using VPNs.
SonicWall SMA1000 has an OS command injection CVE-2026-83549 (CVSS 7.8) in the AMC console. Chained with pre-auth SSRF CVE-2026-83548 (CVSS 10.0), it allows root. CISA added it to KEV on September 2, 2026; fixes released September 1 in builds 12.4.3-03526 and 12.5.0-02952.
Langflow OSS has a critical vulnerability CVE-2026-12944 (CVSS 9.6): the component scanner blocks subprocess but misses socket and urllib, allowing an authenticated user to execute code as root. Versions 1.0.0–1.10.0 are affected; fix is 1.10.3.
Strix ran an autonomous AI pentest agent on *.baseten.co during a check of Baseten (valued at $13 billion). In 25 minutes, the agent found a live GitHub token basetenbot in a public Harbor registry, granting admin access to the main repository, GitOps repo flux-cd, and homebrew-tap. The token had been in Docker image build history since March 2023. Baseten revoked the token and closed access the same day.
Cybersecurity specialists told NBC News that AI leaders' alarming predictions about hacking attacks are technically incoherent and reveal a lack of knowledge of the subject. They say fundamental cybersecurity issues remain unaddressed.
An autonomous hacking agent found a live GitHub admin token in a public Docker image from Baseten: the token from March 2023 persisted in the build history and in July 2026 still granted admin access to internal repositories. The secret was not in filesystem layers but in the image config — a RUN command exposed GITHUB_TOKEN in history[].created_by.
Rapid7 linked North Korea (APT37) to attacks on South Korean media companies and automakers since early 2025. Attackers compromised HAProxy load balancers and deployed a Linux tool called TED for espionage; victims were not named.
Rubrik announced Code Guardian, a service built around Anthropic's Claude Mythos 5 model that finds and verifies vulnerability chains in an isolated copy of a customer's code. The service detects multi-step attacks, confirms exploitability and creates Jira or GitHub tasks; a closed preview with selected partners is underway.
On September 15, 2026, an attacker found a vulnerability in a custom router module of a Gnosis Safe holding over $7.73 million in wrapped rsETH from Aave. The exploit was sent to the mempool, but MEV bot Yoink copied and executed the transaction first, with the attacker arriving an hour later for leftovers.
Proof (formerly Notarize) released Verifiable Digital Credential, a portable digital ID that users verify once and reuse across financial institutions. General access opens September 15 via platform and API; US regulators clarified rules for such credentials in banks on September 8.
