Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, emerging threats, nation-state malware, vendor patch dumps, and significant data breaches from the last 24–48 hours — so you can patch what matters and stay ahead of attackers.
1. First Agentic AI Data Breach Reported to Spanish Regulator
Published: 2026-09-16
Spain’s data protection agency (AEPD) said it received the first official notification of a personal-data breach carried out through an autonomous AI agent. According to the affected organization’s report, the agent used a well-known large language model to log in, hunt for application weaknesses, then modify personal data and access invoices — chaining those steps without a human driving each phase. AEPD called this a qualitative shift from AI-assisted phishing toward agentic attacks, and urged organizations to review access controls, vulnerability management, and response speed. The agency stressed that the model provider itself was not reported as compromised.
2. Critical ConnectWise ScreenConnect Flaw Now Exploited in the Wild
Published: 2026-09-16
CISA confirmed active exploitation of CVE-2026-84869, a CVSS 9.9 missing-authorization / improper privilege-management bug in ConnectWise ScreenConnect. During an active remote session, an attacker with basic privileges can transfer and execute files on the host without confirmation — a short path to persistence or ransomware. The flaw was patched in ScreenConnect 26.6.5 (released September 8). Huntress previously reported worm-like abuse since August 20, and Shadowserver still sees more than 1,000 unpatched instances exposed online, mostly in North America and Europe. CISA added the CVE to its KEV catalog and told U.S. federal agencies to remediate within three days.
3. US, UK, and Dutch Agencies Expose Iranian ‘CHOSEN BRICK’ Spyware
Published: 2026-09-16
The UK NCSC, FBI, and Dutch AIVD issued a joint advisory on CHOSEN BRICK (also styled Chosen Brick), Windows malware used by Iranian state-linked actors since at least 2025 against dissidents, activists, and journalists in the UK, US, Netherlands, and elsewhere. Operators approach targets on WhatsApp and Telegram, then push malware disguised as apps or documents (Pictory, Norton, Telegram, KeePass, even fake MRI results). Once installed, the malware can capture screens and microphone audio, steal email and browser-stored chat data, download extra payloads, and wipe a device. Command-and-control runs over Telegram with a separate bot per victim. Stolen details have later appeared on pro-Iranian leak sites.
4. Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks
Published: 2026-09-16
Google’s September 2026 Pixel security bulletin patches 110 vulnerabilities, including CVE-2026-58704 — a high-severity cellular-modem logic error that allows adjacent/remote privilege escalation with no user interaction. Google said it is aware of “limited, targeted exploitation.” The bug can escape the modem sandbox into broader device access, a pattern often associated with commercial spyware or state operators, though Google has not named a culprit. Pixel owners should install the update (security patch level 2026-09-05 or later) via Settings → Security & privacy → System & updates. CISA also added the CVE to its KEV catalog.
5. Oracle’s September Update Fixes 800+ Vulnerabilities, Including 100+ Critical Flaws
Published: 2026-09-16
Oracle released its September 2026 Critical Security Patch Update with 673 new patches across 17 product families. Counting bundled fixes, the release remediates more than 800 vulnerabilities, including over 100 critical issues and more than 240 that are remotely exploitable without authentication. E-Business Suite took the largest share (159 patches), followed by Fusion Middleware (153, including five CVSS 10.0 bugs in Access Manager, Forms, Internet Directory, Platform Security for Java, and WebLogic) and Hyperion (102). Organizations running internet-facing Oracle middleware should treat this as an emergency patch cycle.
6. Premier Medical Group Breach Hits 282,075 Patients
Published: 2026-09-16
New York healthcare provider Premier Medical Group notified HHS that a June 14, 2026 incident exposed personal and medical information belonging to 282,075 patients. Attackers accessed files containing names, contact details, dates of birth, diagnoses and treatment information, medications, insurance data, dates of service, provider names, and internal patient IDs. PMG said systems were disrupted in June, forensic investigators were brought in, and law enforcement was notified. The provider has not publicly named a threat actor or initial access method. HHS added the incident to its breach portal this week.
7. Critical Flaws in The Events Calendar Put 200,000+ WordPress Sites at Risk of Takeover
Published: 2026-09-16
Two unauthenticated remote-code-execution chains in The Events Calendar (600,000+ active installs) can lead to full site takeover. CVE-2026-78159 and CVE-2026-78006 are both rated CVSS 9.8. Under certain conditions — comments enabled on event pages — attackers can inject payloads that execute PHP callables or trigger object injection, including resetting an administrator password. Wordfence reported blocking attacks in the wild. About 240,000 sites were still on versions before 6.17. Update immediately to 6.17.4.1 or later. Separately, Wordfence also reported a large PHP-webshell campaign against the WooCommerce Wholesale Lead Capture plugin (CVE-2026-27540), with 100,000+ blocked exploit attempts since June.
8. CISA: Ransomware Gangs Now Exploiting Critical VMware vCenter Flaw
Published: 2026-09-15
CISA updated its KEV entry for CVE-2026-59310, a critical unauthenticated directory-traversal / RCE bug in VMware vCenter’s Syslog server (patched by Broadcom on July 29). After early exploitation by a suspected APT to drop reverse-SSH access across 361 IPs in 47 countries, CISA now says ransomware groups are using the same flaw. Shadowserver still tracks 450+ internet-exposed vCenter servers. Compromising vCenter often means control of the virtualization layer and the data behind it — patch remaining appliances immediately and hunt for post-exploitation SSH or unusual syslog activity.
Stay Vigilant
Today’s mix is a snapshot of where 2026 is heading: AI agents moving from theory into reported breaches, remote-access and virtualization bugs going from patch to ransomware in weeks, nation-state spyware on consumer messaging apps, and unpatched WordPress/Oracle/WSO2 surfaces still paying off for attackers.
Practical checklist for this week
- Patch ScreenConnect to 26.6.5+, Pixel devices to the September 5, 2026 security level, Oracle CSPU September 2026, vCenter for CVE-2026-59310, and The Events Calendar to 6.17.4.1+.
- If you run WSO2 API Manager, assume CVE-2026-5430 is being probed with forged admin JWTs and apply the April/May vendor updates if you have not already.
- Treat unexpected files from messaging apps as hostile, even when they look like antivirus, Telegram, or medical documents.
- For WordPress stores, audit plugin versions and uploads folders for unexpected .php shells.
Cyber threats are evolving rapidly. Subscribe for daily updates, a