Stay updated with the latest cybersecurity news. This daily roundup covers actively exploited zero-days, major vendor patch cycles, nation-state spyware, supply-chain compromises, and significant data breaches so you can prioritize what actually matters this week.
1. Cisco Warns of Actively Exploited Secure Email Gateway Root RCE
Published: 2026-09-15
Cisco disclosed CVE-2026-76461 (CVSS 9.8), a critical email-parsing flaw in AsyncOS on Secure Email Gateway appliances. An unauthenticated attacker can send a crafted message containing malicious SQL and execute commands as root on the underlying OS. CISA added the bug to the Known Exploited Vulnerabilities catalog and gave federal agencies until September 17 to patch. Physical and virtual appliances are affected regardless of configuration.
2. CenterPoint Energy Confirms Customer Data Stolen After 7.5M-Record Leak Claim
Published: 2026-09-15
Houston-based utility CenterPoint Energy told the SEC that an unauthorized party obtained personal information for a portion of its customers through an external-facing system. A threat actor had posted that they pulled about 7.49 million records (names, addresses, billing data, partial SSNs) from a poorly protected API. Electric and gas service was not disrupted. Multiple proposed class actions have already been filed. CenterPoint has not confirmed the exact record count.
3. Apple Ships Record Security Wave With iOS 27 and macOS Golden Gate 27
Published: 2026-09-14
Apple released iOS 27, iPadOS 27, macOS Golden Gate 27, and companion updates addressing a record coordinated set of flaws — roughly 200+ unique issues depending on how overlaps are counted, and up to 273 unique CVEs across the full product set. Fixes include kernel memory-corruption and privilege-escalation bugs, a CoreMedia image-processing issue Apple removed rather than patched, Bluetooth remote code execution, and numerous WebKit issues. Apple has not flagged any of this cycle as exploited in the wild.
4. US, UK, and Netherlands Warn on Iranian Telegram-Controlled Spyware
Published: 2026-09-15
The FBI, UK NCSC, and Dutch AIVD published a joint advisory on Windows malware used by Iran’s Ministry of Intelligence and Security (MOIS) against dissidents, journalists, and activists. The FBI calls it HEAVYGRAM; the NCSC calls it CHOSEN BRICK. Each infected host gets its own Telegram bot for C2. Capabilities include screenshots, microphone recording, theft of Telegram/WhatsApp data and saved passwords, and additional payload delivery. The broader campaign is dated to autumn 2023.
5. CISA: Ransomware Gangs Now Exploit Critical VMware vCenter RCE
Published: 2026-09-15
CISA updated its KEV entry for CVE-2026-59310, a critical directory-traversal RCE in the vCenter Syslog server that Broadcom patched on July 29. After earlier APT-linked abuse (reverse SSH implants observed across dozens of countries), ransomware operators have now joined the exploitation. Compromising vCenter remains a high-leverage path to mass VM encryption. Unpatched 8.x/9.x deployments should be treated as an emergency.
6. KREMLIN Banking Malware Hijacks Chrome and Edge
Published: 2026-09-15
Elastic Security Labs (cluster REF9334) detailed a Brazilian banking operation active since at least May 2025. KREMLIN uses fake bank/invoice lures, multi-stage JavaScript loaders, custom C++ installers, and malicious Chrome/Edge extensions that bypass Chromium integrity checks by rewriting Secure Preferences and regenerating HMACs and App-Bound hashes. The goal is credential and session-token theft. Later stages have used Ethereum smart contracts to hide C2.
7. Compromised Admin Menu Editor Pro Update Backdoors ~1,500 WordPress Sites
Published: 2026-09-15
A threat actor compromised adminmenueditor.com and pushed malicious Pro versions 2.35 and then 2.36. The update dropped includes/wp-user-consent.php (web shell) and created a hidden wp_ user. Developer Janis Elsts says at least 230 customers installed the poisoned update on about 1,500 sites during a same-day window. Free Admin Menu Editor (300,000+ sites) was not implicated, but Pro customers should hunt for the listed IoCs immediately.
8. BambooToken Malware Controls Windows and Linux via MQTT
Published: 2026-09-15
Researchers disclosed BambooToken, a multi-platform framework active since at least 2023 that now uses MQTT (the IoT messaging protocol) as its C2 channel on Windows and Linux. Activity has been seen against organizations in Asia and South America. Using a protocol that blends into industrial and cloud telemetry traffic makes detection harder than classic HTTP beacons. Treat unexpected outbound MQTT from servers as suspicious.
Stay Vigilant
Patch first what is already in CISA KEV: Cisco Secure Email Gateway, VMware vCenter CVE-2026-59310, and any leftover September Patch Tuesday / RDS out-of-band fixes. Apple users should move to iOS 27 / macOS 27 or the matching 26.7 / 15.8 point releases. WordPress operators should verify plugin update sources and hunt for hidden admin users. Cyber threats are moving faster than weekly patch windows — subscribe for daily updates, and keep identity tokens, browser extensions, and internet-facing appliances under continuous review. Stay safe online