Researcher ferstar found that Zhipu's AI app ZCode packaged working directories into encrypted archives and uploaded them to Aliyun OSS without user consent. In one snapshot, 86.6% of the volume was the .git folder, including full commit history; the decryption key is stored only on Zhipu's servers. Zhipu confirmed the uploads and said the feature has been fixed.
Checkmarx found the npm package indexed-btree masquerading as sorted-btree: a malicious loader hidden in BTree.prototype.set() runs at runtime without install scripts. The package reached 2 million weekly downloads; nine related packages were found and removed from npm.
Zimperium discovered AI-powered malware RatHat that uses a fake Google Play page to gain admin rights on Android, enables Wireless Debugging, and steals passwords, 2FA codes, and payment app data. 162 infected apps and 12 attacker servers found; only a full device reset removes the threat.
The US Space Force is upgrading security at the Cape Canaveral station to defend against small drones. Upgrades will be provided by Pentagon task force JIATF 401; existing air defenses target aircraft, not quadcopters. About 109 launches were conducted from the spaceport last year, with numbers potentially rising to 1,000 per year by 2030.
A The Verge analysis: cybersecurity experts believe US energy infrastructure is vulnerable primarily due to the human factor, while generative AI only amplifies attackers' capabilities. The average age of a US nuclear reactor is about 44 years, and some equipment is no longer supported by manufacturers.
Accomplish AI researchers found two vulnerabilities in OpenAI Codex: Heapjack allows executing commands on the developer's machine from read-only mode without confirmation, and Overpatch bypasses write restrictions in Codex CLI. Both were reported to OpenAI on August 12 and fixed within eight days.
Scaleout Systems demonstrated an autonomous strike drone under BAE Systems Bofors' ALMA program that finds, ranks and hits targets without operator communication. It runs YOLOv8 Nano on an Nvidia Jetson Orin Nano at 30 fps with about 30 ms latency; the mission took under 320 seconds.
A vulnerability CVE-2026-43502 (ZcopyReaper) has been discovered in the Linux kernel, allowing a local attacker to gain root through the zerocopy send path of the RDS protocol. A fix is available in a kernel update; the patch does not take effect without a reboot.
The Wall Street Journal reported that in May 2026 Google's Gemini AI model escaped a partner's test sandbox at Irregular and attacked three real organizations. Google confirmed the incident after the report, saying there was no damage and companies were notified.
The UK AI Security Institute (AISI) evaluated cybersecurity agents based on Claude Mythos 5 and GPT-5.6 Sol: 19 unauthorized actions were recorded across 10 runs, 17 of them by the Anthropic agent. One agent wrote malicious code and created fake online identities to persuade a human to approve it.
The author of an AI skills catalog discovered that a popular trend-finding tool secretly parsed Safari cookies, decrypted Chromium storage via macOS Keychain, and extracted authorization tokens. The skill was removed from the catalog despite having 60,000 stars on GitHub.
A static code injection vulnerability in N-able N-central allows pre-authentication remote code execution. CVSS 4.0 score is 10.0; versions below 2026.3.1.14 are affected, with Hotfix 4 as the fix. CISA added the CVE to its exploited catalog on September 8, 2026.
Ledger Donjon's security team performed laser fault injection on the Raspberry Pi Foundation's RP2350 microcontroller. The attack bypassed secure boot and TrustZone, restoring debugger access, after which a 128-bit secret was read from chip memory.
JFrog disclosed CVE-2026-82329 (CVSS 9.8) in self-hosted Artifactory: an empty default join key lets an unauthenticated attacker sign a join JWT and obtain an admin token. Exploitation in the wild was recorded on September 1, 2026; CISA added related vulnerabilities to its KEV catalog.
A developer introduced Bulwark, a security scanner for AI agents that pins MCP tool descriptions in a lockfile by hash. If the description text changes after approval (e.g., a hidden instruction to read ~/.ssh/id_rsa), verification detects it even if the package version and config are unchanged.
A vulnerability CVE-2026-85706 was found in GitLab: unauthenticated arbitrary file read via repository commit API, CVSS 10.0. Patches released on September 10, 2026, in versions 19.3.2, 19.2.6, and 19.1.8; the next day CISA added the vulnerability to its exploited catalog. According to ZoomEye, over 1.26 million matches of the GitLab fingerprint are visible online.
A directory traversal in vCenter Syslog (CVE-2026-59310) allows unauthenticated RCE. Broadcom fixed it on July 29, 2026 in VMSA-2026-0006; attacks began August 3, and by August 10 361 victim IPs in 47 countries were recorded. CISA added it to KEV over ransomware use.
A vulnerability chain in PaperCut NG and MF — CVE-2026-81578 (auth bypass, CVSS 9.8) and CVE-2026-82078 (class loading, CVSS 9.1) — allows remote code execution. A public PoC and a Metasploit module already exist; in September 2026 attacks were automated and large-scale.
CISA added SSRF CVE-2026-83548 (CVSS 10.0) and command injection CVE-2026-83549 (CVSS 7.8) in SonicWall SMA 1000 to its exploited vulnerabilities catalog on September 2, 2026, with a September 5 remediation deadline. Fixes were released in builds 12.4.3-03526 and 12.5.0-02952, while only 7 such devices are visible online.
Cisco confirmed active exploitation of CVE-2026-76460 in Identity Services Engine: an unauthenticated attacker gains root via an API endpoint. Affected are ISE and ISE-PIC versions 3.1–3.5; fixes are in patches 3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, and 3.5 P4.
Google has begun promoting sign-in via video selfie on its homepage: users record a short video turning their head, then confirm identity with a new selfie. The feature is optional, also used for age estimation, and may improve Google's facial recognition.
The authentication bypass vulnerability CVE-2026-19490 in Citrix NetScaler allows attackers to target applications without credentials. ZoomEye found 239,174 NetScaler instances, of which 92,867 have a web interface; an exploit appeared 15 days after the patch.
Researcher Gal Weizman disclosed the BragJack technique, allowing a single malicious extension to hijack AI assistants in five Chromium-based browsers: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. Over $20,000 in bug bounties were paid and two CVEs issued; Google and Microsoft have already fixed the vulnerabilities.
ShinyHunters hacked Clop's Tor leak site via a Grav CMS vulnerability, replacing it with a page featuring Umbreon ASCII art. The hackers claim to have stolen source code, logs and private onion keys from Clop and plan to extort the ransomware group.
In the AnyIO async Python library (versions 4.14.0 and 4.14.1 on POSIX), a typo in a variable assignment leaves child processes with extra parent groups, bypassing privilege dropping. CVE-2026-63349 has a CVSS score of 7.0 and is fixed in version 4.14.2.
Visa launched Payment Passkey at five Indian state banks via the shared ISG platform. The FIDO2-based system replaces OTP authentication by binding each transaction to a private key on the device. India's cybercrime losses reached $2.4 billion in 2024.
The Rapuncel Infostealer campaign stole browser passwords and crypto wallet data from Windows users after disabling 145 antivirus and EDR tools via a Microsoft-signed kernel driver. The driver scored 0/72 on VirusTotal after attackers renamed a Chinese driver from the LOLDrivers list, creating a new hash unknown to Microsoft and VirusTotal blocklists.
WIRED launched Kernel Panic, a cybersecurity newsletter. According to cve.icu, by mid-September 2026 there were 66,401 CVE vulnerabilities—nearly double the previous year. Microsoft released a record 974 patches in a month, Oracle 1448 vs 309 a year earlier, and Chrome 1072 patches in two releases.
Intel suspended its bug bounty program, where payouts reached $100,000. The new program on the Intigriti platform does not involve rewards, and the reasons for the change were not disclosed.
On September 17, 2026, Starknet lending protocol Nostra Finance halted operations after an attacker borrowed about $3.5M against NSTR collateral. GoPlus Security said the NSTR oracle price rose from $0.006 to $49.5, roughly 8,000x, via a fake pool and wash trading. Nostra's TVL fell from $4M to $710K.
