Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches from the past few days so you can stay informed in a landscape that is moving especially fast around AI-assisted attacks and edge-device exploits.
1. Dutch NCSC Warns Check Point VPN Flaws Face Imminent Exploitation
Published: 2026-09-12
The Dutch Nationaal Cyber Security Centrum (NCSC) warned that two critical Check Point VPN vulnerabilities — CVE-2026-85102 and CVE-2026-85103 — are likely to be exploited soon. The flaws can allow remote code execution on Security Gateways and Security Management Servers. Affected branches include R81.20, R82, R82.10 and several end-of-support releases. No public proof-of-concept was reported at the time of the alert, but NCSC rated both likelihood and impact as high and urged immediate patching.
2. CISA Adds Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
Published: 2026-09-12
CISA added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog. The list includes CVE-2026-42016 (Artifactory privilege escalation), CVE-2026-84869 (ScreenConnect unauthorized file transfer and execution, CVSS 9.9), and two MikroTik RouterOS issues that researchers have tied to a chain dubbed “MikroTrick.” Federal agencies face patch deadlines from September 13 through September 25, 2026. Self-hosted Artifactory servers have already been used to deploy a Rust backdoor after attackers chained authentication and authorization bugs.
3. OpenAI Agents Linked to RubyGems Campaign That Gained RCE
Published: 2026-09-12
Researchers say a swarm of OpenAI agents was behind the May 2026 RubyGems campaign that flooded the registry with more than 2,000 packages and abused RubyDoc.info’s documentation builder to achieve remote code execution. Packages often included “oai” in their names and used a malicious .yardopts file to run attacker-controlled Ruby during documentation builds. The finding adds to a broader 2026 pattern in which AI agents have been implicated in supply-chain abuse, including earlier Artifactory and Hugging Face incidents.
4. GitLab CVSS 10 File-Read Flaw Probed Hours After Disclosure
Published: 2026-09-11
GitLab patched CVE-2026-85706, a maximum-severity path traversal bug in the repository commits API that can let an unauthenticated attacker read arbitrary files from a GitLab server. The issue affects GitLab CE/EE 18.7 through 19.3 before the fixed builds (19.1.8, 19.2.6, and 19.3.2). watchTowr reported in-the-wild probes beginning around 06:00 UTC on September 11. CISA added the flaw to KEV the same day. Exposed internet-facing GitLab instances should be patched immediately and logs checked for POST requests to /api/v4/projects/{id}/repository/commits/ containing file.Path parameters.
5. Florida Confirms DMV Database Breach via Stolen Police Account
Published: 2026-09-11
Florida’s Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database after ShinyHunters claimed more than 200,000 records. FLHSMV said attackers used compromised credentials from a Plant City Police Department employee whose login had been stored on a personal device. The agency said the incident was contained. ShinyHunters had separately claimed a password-reset flaw and published a screenshot of a high-profile DAVID record as proof. The case is a reminder that third-party law-enforcement access and poorly stored credentials can open government identity systems.
6. Passkey-Themed Phishing Leads to Microsoft 365 Data Theft
Published: 2026-09-11
Microsoft reported that actors linked to ShinyHunters, Helix, and other extortion crews have been running passkey- and SSO-themed social-engineering attacks since May 2026. Attackers impersonate IT help desks by phone or message, tell employees they must “update” a passkey or SSO setting, then send them to adversary-in-the-middle pages or device-code flows. The goal is not to enroll a real passkey — it is to steal credentials and session tokens for Microsoft 365 data theft. Microsoft tracks overlapping clusters as Storm-3121 and Storm-3032. Organizations should treat unexpected passkey-reset calls as high-risk and restrict device-code authentication where possible.
7. Threat Actors Abused Claude to Mine Secrets From 1.8 Million Android Apps
Published: 2026-09-11
Anthropic said multiple groups — including financially motivated operators and Russia- and China-linked espionage actors — tried to misuse Claude. One alleged ShinyHunters-linked operator ran a pipeline across ten AWS EC2 workers that downloaded 1.8 million Android APKs, decompiled them, and scanned for hardcoded secrets with TruffleHog, routing hits to a Telegram channel. The same actor harvested GitHub organization emails and personal access tokens. Anthropic said Claude-assisted workflows helped one actor pull more than 2,100 Azure AD token sets across 40-plus Microsoft tenants in about 34 hours. AI is no longer just writing better phishing emails; it is compressing reconnaissance and secret-hunting.
8. IDScan Confirms Cloud Access Tied to 153 Million Driver’s License Scans
Published: 2026-09-10
Identity-verification firm IDScan confirmed unauthorized access to customer data in its cloud platform after a dark-web service branded Nexus advertised more than 153 million U.S. and Canadian driver’s license scans, plus millions of other ID, travel, and medical documents. IDScan said it learned of possible unauthorized access around September 1 and that exposed data can include names and government ID numbers. Lawsuits followed quickly. Combined with the Florida DAVID incident, September has been a rough month for driver’s-license data — one of the most reusable identity documents in fraud and account-takeover campaigns.
Bonus: China-Linked Groups Share a Chrome + Windows Zero-Day Chain
Published: 2026-09-09 to 2026-09-12
Volexity, Proofpoint, and SecurityWeek reported that multiple China-linked groups used the same “BlueMoon” exploit kit chaining two Chrome/Chromium V8 flaws (CVE-2026-85046 and CVE-2026-87491) with a Windows kernel privilege-escalation bug (CVE-2026-85880). Several of the Chrome issues were “patch-gap” zero-days: fixed in upstream Chromium source but not yet in stable Chrome when attacks began. Targets included NGOs, mining and commodity firms, U.S. aerospace companies, and organizations in Southeast Asia. Payloads differed by group (including GRIMWEDGE and credential-stealing Chrome extensions), which suggests a shared kit rather than a single operator. Keep Chrome and Windows current; delayed browser updates are now an active espionage risk.
Stay Vigilant
This week’s pattern is clear: attackers are combining unpatched edge devices (VPN, GitLab, Artifactory, ScreenConnect, RouterOS), identity-system compromise, and AI-accelerated reconnaissance. Prioritize internet-facing appliances and source-control platforms, treat unexpected MFA/passkey “updates” as phishing, and assume driver’s-license and government-ID data is already circulating for fraud.
Subscribe for the next daily roundup, and keep patching on a hours-to-days timeline rather than a monthly one. Stay safe online.