IT Security & Day-to-Day Patch Intelligence Newsroom

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Important CVE-2026-51990 BleepingComputer

2026-09-13 BleepingComputer

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Moderate CVE-2026-42016 SecurityAffairs

2026-09-13 SecurityAffairs

Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet Attackers Exploit Crit…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours

Critical CVE-2026-85706 SecurityAffairs

2026-09-13 SecurityAffairs

GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours

CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure. GitLab disclosed CVE-2026-85706 (CVSS score of 10.0) on September 10, 2026, a path traversal vulnerability in its repository commits API. CVE-2026-85706 affects GitLab’s repository commits API and can let attackers access files they should not see.…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Important The Hacker News

2026-09-13 The Hacker News

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masq…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence

Critical SecurityAffairs

2026-09-13 SecurityAffairs

Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence

Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for ransomware attacks. Oleksii Oleksiyovych Lytvynenko had, by most accounts, a fairly ordinary legal career in Ukraine before he switched to writing malware. A US federal court sentenced the 44-year-old to four years in prison this week for conspiracy…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Important Help Net Security

2026-09-13 Help Net Security

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Zero trust AI agents demand a different kind of security In this interview, Chris Webber, VP, Product Marketing at Teleport, explains why zero trust principles need to change for AI agents. He covers how agents act fast, unpredictably, and continuously, and why …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks

Moderate SecurityAffairs

2026-09-12 SecurityAffairs

Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks

Revolut handed over KYC documents, selfies, and Bitcoin transaction histories after a fake government email with valid domain credentials passed its checks. Revolut confirmed on September 12, 2026, that it disclosed sensitive customer data to an unauthorized third party after receiving fraudulent information requests sent from an email address operating insi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Anthropic: AI Misuse Is Entering a New Phase: From Cybercrime to Surveillance, Propaganda and Weapons

Moderate SecurityAffairs

2026-09-12 SecurityAffairs

Anthropic: AI Misuse Is Entering a New Phase: From Cybercrime to Surveillance, Propaganda and Weapons

AI is becoming an operational force for cybercrime, surveillance, propaganda, fraud and weapons development, lowering the cost and scale of attacks. Artificial intelligence (AI) is becoming more than a tool for people who want to do something malicious. It is increasingly becoming part of the operational machinery itself. That is the main message emerging fr…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

Critical CVE-2026-42016 The Hacker News

2026-09-12 The Hacker News

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Critical CVE-2026-85102 BleepingComputer

2026-09-12 BleepingComputer

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

When the Whole Company Adopts AI: What It Does to Your SOC

Moderate The Hacker News

2026-09-12 The Hacker News

When the Whole Company Adopts AI: What It Does to Your SOC

Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts that were triggered by AI tools and agents. Not attacks against AI, but the ordinary, everyday footprint of an organization using it, from developers running coding agents and non-technical staff signin…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

Critical The Hacker News

2026-09-12 The Hacker News

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that ta…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Chromium CVE-2026-87491: Out of bounds write in V8

Moderate CVE-2026-87491 Microsoft MSRC

2026-09-11 Microsoft MSRC

Chromium CVE-2026-87491: Out of bounds write in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. Google is aware that an exploit for CVE-2026-87491 exists in the wild.