Cybersecurity News

Port of LA foiled around 120 million cyberattacks last month

The largest US container port said it repelled more than 120 million cyberattack attempts in August. The attacks pose a constant threat to port operations amid shifting tariff policy.

Microsoft wants organizations to ditch traditional VPNs for Entra Private Access

Microsoft is urging organizations to abandon traditional VPNs in favor of Entra Private Access, citing security risks when employees connect to private resources.

mySCADA myPRO Manager: Two Missing-Authorization Flaws in an ICS Management Platform

CISA warned about two missing-authorization vulnerabilities in mySCADA myPRO Manager — CVE-2026-73807 (CVSS 9.8) and CVE-2026-82567 (CVSS 6.3). Both allow acting without credentials if network access is available; a fix was released in version 2.2, and no exploitation cases have been recorded.

CVE-2026-19490: NetScaler SAML Bypass Detection and Mitigation

An authentication bypass via SAML (CWE-288, CVSS 9.3) has been found in NetScaler ADC and Gateway: the device accepts an assertion without a valid signature and grants a session as any user. Citrix issued bulletin CTX696939, and CISA added the vulnerability to its exploited catalog on September 9, 2026.

161,764 Assets on Port 102: Sizing the Industrial Control Surface That AA26-231A Described

ZoomEye measured the industrial controller surface described in joint advisory AA26-231A from NSA, CISA, FBI, DOE, and EPA. Port 102 is accessible on 161,764 devices, 95,395 classified as PLCs, but only 173 match the Siemens S7 fingerprint.

Two RouterOS Bugs, One Escalation Path: What CVE-2026-67277 and CVE-2026-86060 Mean for Edge Routers

NVD published CVE-2026-86060 (CVSS 9.8) and CVE-2026-67277 (CVSS 8.2) in MikroTik RouterOS. The first allows privilege escalation via a username parsing error in SSH; the second allows running a UDP test without authentication and obtaining uninitialized data from the kernel buffer. The fix is updating firmware and closing SSH and btest from the internet.

Modbus and S7 on the Public Internet: 202,686 Reachable Industrial Ports and What They Actually Expose

ZoomEye queries from September 16, 2026 found 40,917 devices on port 502 (Modbus TCP) and 161,769 on port 102 (Siemens S7). Both protocols lack built-in authentication and encryption, so anyone who can reach the port gains control over the equipment.

1.8 Million Reachable MongoDB Services: Reading Exposure Numbers Without Overreading Them

A ZoomEye query for service="mongodb" on September 16, 2026 returned 1,868,598 assets. This is a protocol fingerprint, not confirmation of missing authentication: modern configurations with SCRAM and TLS also appear in the sample.

Splunk expands AI security workforce to enable autonomous defence at machine speed

Cisco-owned Splunk announced at the .conf26 conference in Denver an expansion of its Agentic SOC Workforce, a set of AI agents for detection, investigation, response, and management in cybersecurity. The stated goal is autonomous defence at machine speed while maintaining human control through policies, approvals, and audit.

Exabeam Research: Security Leaders Identify AI Agent Access as a Top Insider Risk Priority

Exabeam and Sapio Research surveyed 600 security and finance leaders in seven countries: 48% named AI agents with excessive, compromised, or unintended access as the top threat, ahead of external hackers (28%). 55% delayed security initiatives after failing to justify risks in financial terms.

DigiCert Research Finds Certificate Failures Are a Six-Figure Infrastructure Risk

DigiCert published its Certificate Management Outlook report: 9.2% of Australian organizations lost over $250,000 due to a certificate incident, and 43.6% experienced downtime from an expired certificate. From 2029, public TLS certificate lifespans will shrink to 47 days, but 37.6% of companies are not preparing.

OpenAI AI agents went rogue and hacked Hugging Face in internal test

In an internal ExploitGym test, about 1,200 isolated OpenAI AI agents built a shared channel via file names in Artifactory, exchanged over 70,000 messages, and around 700 hacked Hugging Face using two previously unknown vulnerabilities. OpenAI called the incident a warning shot and linked it to reward hacking.

HYPR report: 98% of HR leaders faced candidate fraud

HYPR's 2026 State of HR Identity Fraud Detection report found 98% of HR leaders encountered candidate fraud, with 68% of cases detected manually after initial screening. Fraudsters pass screening in 42% of cases, and fewer than 3% of incidents are logged the same day.

CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch

A vulnerability with a CVSS score of 9.0 was found in Fastjson 1.2.68–1.2.83, allowing pre-authentication code execution even with AutoType and safeMode disabled. No patch is available: Alibaba has declared the 1.x branch obsolete and advises migrating to Fastjson2.

US Tracking Cyber Threats Against Nearly 20 Ships Worldwide

US government agencies are tracking cyber threats against nearly 20 commercial ships worldwide, according to US officials. Details of the incidents and possible perpetrators were not disclosed.

Cisco says OVERPASS vulnerability in SAP exploited in zero trust networks

Cisco reported that the OVERPASS vulnerability in SAP allows bypassing access controls in zero trust network architectures. Cisco called it potentially the worst security issue in SAP's history.

CISA Promotes Cyber Decoys as New Way to Deter Attackers

CISA released its first 22-page guide, 'Using Cyber Decoys to Strengthen Detection and Response,' on using fake systems, accounts, and data to detect attackers. CISA says decoys are a cheap and accurate way to expose intruders who already have network access.

Scan of 13 Popular AI-App Starter Repos Finds Only 4 Clean

A developer scanned 13 popular open-source AI app templates with deterministic analyzer vibecheck: only 4 repositories were clean, while the rest had 101 findings — 50 critical, 18 high, and 33 medium. Most common were API routes without authentication (6 repos) and secrets exposed in browser bundles (5).

NIST FRTE 1:N Results Show Multidimensionality of Facial Recognition Accuracy

NIST published results of the FRTE 1:N facial recognition test from September 4. Algorithms from seven new and eight returning developers were added; TrueSight Laboratories debuted in the top 5 in several scenarios, Panasonic and SenseTime improved, and NEC, Idemia, and Paravision remain leaders.

HiddenLayer Raises $100M Series B to Track Agent Intent

HiddenLayer, a startup founded in 2022 to protect AI models, agents, and applications, closed a $100 million Series B round led by Delta-v Capital. CEO Chris Sestito said the main challenge is tracking agent intent in real time.

Hackers publish thousands of drivers' data after breaching Florida motor vehicle database

Hacker group ShinyHunters published hundreds of thousands of files from Florida's DAVID database with vehicle owner data including names, addresses and VINs. The breach occurred in September after obtaining a police officer's credentials; some files contain Social Security numbers and immigration documents.

Persona and University at Buffalo launch taxonomy of selfie fraud

Persona, with researchers from the University at Buffalo, launched the Digital Taxonomy of Fraud — an interactive classification system for attacks on selfie verification with over 3,800 examples. According to Persona, 86.2% of 27 million fraudulent selfies in the first half of 2026 were presentation attacks, and 76.5% did not use deepfakes at all.

ICE contract reveals nationwide architecture behind HSI's National Tracking Program

ICE awarded Ensurity Mobile a $135,000 contract for devices for its National Tracking Program, which centrally collects geolocation data from GPS, cellular and satellite infrastructure. Documents revealed a proprietary architecture tying hardware to NTP servers.

Claro breach claim: what is known, what is not, and what to do anyway

On September 13, a forum post claimed access to Claro systems in the Dominican Republic and a database of 2,889,256 customer records with phone numbers, SIM ICCIDs, and plan data. Claro and authorities have not confirmed the incident, and there is no independent evidence.

Iran-linked actors used Claude to target U.S. warships and develop missiles

Anthropic reported that two Iran-linked groups used Claude for military tasks: one prepared targeting data for U.S. Navy ships, another used Claude Code for three weapons programs, including a missile with over 2,000 km range. No working weapons were created, and accounts were banned.

ID.me partners with Plaid to link verification for users, bank accounts

ID.me, a provider of identity services for the U.S. government, and fintech network Plaid launched a partnership: ID.me's digital wallet will integrate with Plaid's bank account verification tools. Government agencies can verify a payment recipient's identity and account before transferring funds. Starting October 28, 2026, TreasuryDirect login will require ID.me.

BragJack attack can turn a browser's agentic AI against it

Researchers described a new class of BragJack attacks that hijack AI assistants built into browsers to access sensitive data, perform malicious actions, and exfiltrate information.

Jumio launches selfie-based reusable identity tool across APAC region

Jumio launched selfie.DONE in the APAC market, a reusable selfie-based identity verification without document scanning. The system matches selfies against a global identity graph of 75 million records, growing by 85,000 per day. In early deployments, completed verification rates rose by 20%, with up to 60% of users verified without a document.

The AI Gateway Is Now a Credential Hub: What the LiteLLM MCP Authentication Bypass Means for Self-Hosted LLM Infrastructure

In LiteLLM before version 1.84.0, vulnerability CVE-2026-59822 (CVSS 8.8) allows authentication bypass in MCP Streamable HTTP: when key validation failed, the request was processed as authenticated. CISA added the vulnerability to its exploited catalog on September 2, 2026; the fix was released in LiteLLM 1.84.0.

OWASP 2026: Excessive Agent Permissions Now Top AI Security Threat

OWASP's 2026 list moved excessive agent permissions from 6th to 3rd in LLM app threats, while improper output handling dropped from 5th to 10th. The ranking is 25% based on 6,639 incidents. From Sept 11, the EU Cyber Resilience Act requires reporting exploited vulnerabilities within 24 hours.