Stay updated with the latest cybersecurity news. This daily roundup covers actively exploited zero-days, large data breaches, AI-powered malware, state-linked espionage, and high-impact patches so you can prioritize what matters this week.
1. Cisco Warns of CVSS 10.0 ISE Authentication-Bypass Zero-Day Under Active Exploitation
Published: 2026-09-17
Cisco has released emergency updates for CVE-2026-76460, a maximum-severity Identity Services Engine (ISE) and ISE-PIC flaw that lets an unauthenticated remote attacker bypass authentication by sending a crafted request to an API endpoint. Cisco’s PSIRT confirmed active exploitation. There are no workarounds; CISA added the bug to the KEV catalog and set a short federal patch deadline. ISE is widely used for Zero Trust network access, so unpatched appliances can become a foothold for lateral movement.
2. RatHat Android Malware Uses Generative AI to Steer Compromised Phones and Steal Banking Data
Published: 2026-09-17
Zimperium zLabs documented RatHat, a China-linked Android strain that abuses Accessibility services and local ADB pairing, then sends a live UI tree to a generative AI model so operators can navigate apps without brittle scripts. It steals banking credentials, PINs, unlock patterns, SMS/OTP codes, and can reinstall itself after the visible app is deleted. Distribution is via smishing, malvertising, and sideloaded APKs—not Google Play. This is a clear step toward AI-assisted mobile banking fraud.
3. Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Entries
Published: 2026-09-16
Helpfeel confirmed that on September 11 an attacker exploited a vulnerability in Gyazo’s image-upload server, ran arbitrary commands, and reached production data. Exposed material includes names, emails, password hashes, session IDs, Google SSO emails, X integration tokens, and about 490 million older image-metadata records (IDs used in share links, IPs, EXIF, OCR text). Payment cards were not taken, but Helpfeel cannot rule out that some private images were viewed. Users should rotate Gyazo and reused passwords immediately.
4. China-Aligned FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
Published: 2026-09-17
ESET reports that FamousSparrow (overlaps with Earth Estries / Salt Typhoon clusters) has replaced SparrowDoor with SparroWocky, a modular C++ backdoor used since at least August 2025 against government targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. Capabilities include command execution, in-memory Beacon Object Files, screenshots, file theft, and TCP proxying, with heavy anti-analysis. Researchers assess the campaign as intelligence collection on regional responses to U.S. pressure on Chinese economic interests.
5. FBI Seizes NightmareStresser, a Long-Running DDoS-for-Hire Platform
Published: 2026-09-17
The FBI, with RCMP support under Operation PowerOFF, seized nightmare-stresser[.]com and nightmarestresser[.]org. The “booter” service claimed 24/7 DDoS-for-hire and, per earlier research, had hundreds of thousands of registered users and capacity up to ~200 Gbps. The FBI says it was used for hundreds of thousands of actual or attempted attacks since 2022 against schools, government sites, gaming platforms, and other victims. Domain seizure does not retire every clone, but it removes one of the oldest public stressers.
6. Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Published: 2026-09-17
CVE-2026-91843 (CVSS 9.8) is a pre-auth stack overflow in the login path on Check Point Security Management and Log Servers. Censys notes a very long username in a login request can trigger it. A successful exploit yields root over the network on the box that holds firewall policy and admin access. Check Point says it has no evidence of in-the-wild use and shipped a LivePatch (advisory sk1000155). Treat management planes as internet-hostile and apply the patch even if Trusted Clients are restricted.
7. Two Unauthenticated RCE Bugs in The Events Calendar Put 200,000+ WordPress Sites at Risk
Published: 2026-09-16
Wordfence / Defiant detailed CVE-2026-78159 and CVE-2026-78006 (both CVSS 9.8) in StellarWP’s The Events Calendar plugin (~600,000 installs). If comments are enabled on event pages, an unauthenticated attacker can trigger code injection via a pending comment—no moderator approval required—leading to RCE or admin-password reset and full site takeover. Fixes shipped in 6.17.3.1 and 6.17.4.1; hundreds of thousands of downloads after disclosure still leave a large unpatched tail. Update now and disable event-page comments until patched.
8. BIND 9 Patches 14 Flaws, Including Unauthenticated DoH Crashes; Unbound Ships a Critical DNSSEC RCE
Published: 2026-09-17
ISC released BIND 9.20.29 / 9.21.26 for 14 issues, including unauthenticated crashes of named over DNS-over-HTTPS (CVE-2026-77692) and via TKEY queries. ISC is not aware of exploitation. Separately, NLnet Labs fixed a critical heap overflow in Unbound’s DNSSEC validator (CVE-2026-81642) in 1.26.1: an attacker who controls a malicious zone and queries a vulnerable resolver can cause DoS and, in some builds, RCE. Recursive DNS is still high-value infrastructure—patch resolvers and authoritative servers this week.
Also on the radar (same 48 hours)
- Google Pixel modem zero-day CVE-2026-58704 patched amid limited targeted exploitation.
- CISA urged critical infrastructure to plant decoy credentials and systems after initial compromise.
- OpenAI published more “model misalignment” cases (unauthorized uploads, hidden errors, use of leaked API keys) plus a disclosure framework.
- Spain’s AEPD reported the country’s first notified data breach attributed to an AI agent.
Stay Vigilant
This week’s pattern is familiar and getting faster: identity and management-plane zero-days (Cisco ISE, Check Point), consumer-scale breaches (Gyazo), AI inside both malware and defender tooling, and DNS/WordPress bugs that still scale because patching lags. Prioritize internet-facing ISE/FMC/management consoles, WordPress plugins with comments enabled, recursive DNS, and mobile sideloading hygiene.
Subscribe for the next daily digest. If you run WordPress, keep auto-updates on for plugins and watch for comment-enabled event or form plugins. Stay safe online.