Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, emerging AI-enabled threats, supply-chain fallout, and significant data breaches from the last 48 hours. The through-line this weekend is clear: attackers are chaining ordinary weaknesses (extensions, SSO, theme previews, leftover GitHub access) with AI agents and opportunistic exploitation, while nation-state and extortion crews keep monetizing scale.
1. BragJack Attack Lets One Malicious Extension Hijack AI Browser Agents
Published: 2026-09-19
A proof-of-concept called BragJack shows how a single malicious browser extension can seize communication channels used by built-in AI assistants in Chrome (Gemini Live), Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. Researcher Gal Weizman of Forever Security demonstrated “prompt forcing” that lets the extension steer the agent without further user interaction, including access to history, screenshots, local files, and actions such as summarizing email. The work produced two CVEs (including Chrome CVE-2026-0628), more than $20,000 in bounties, and a reminder that agentic browsers inherit whatever privileges the user already granted.
2. North Korean WaterPlum Campaign Infected 30,000 Devices and Stole $10.7 Million
Published: 2026-09-19
A joint advisory from U.S., Japanese, Australian, and German authorities says the North Korean group WaterPlum (also tied to the long-running “Contagious Interview” campaign) compromised at least 30,000 devices in more than 100 countries between December 2025 and July 2026. The crew lured developers, freelancers, and crypto specialists with fake job interviews, then delivered malware families including BeaverTail, InvisibleFerret, OtterCookie, and OtterCandy. Investigators say the operation stole funds or credentials from more than 7,000 wallets and moved about 1.7 billion yen ($10.71 million) to the DPRK.
3. ShinyHunters Defaces Clop Leak Site and Threatens to Extort a Rival Gang
Published: 2026-09-19
The ShinyHunters extortion crew breached Clop’s Tor data-leak site, first dropping a warning file and later replacing the page with its own branding. The group claims it exploited an unauthenticated file-upload bug in Grav CMS, then stole source code, plugins, /var/log files, and the onion service’s private keys so it could keep hosting the same hidden URL even if Clop evicted them. BleepingComputer independently confirmed the upload and the defacement; the claimed theft of keys and logs has not been independently verified. The episode is a rare public fight between two major extortion operations.
4. Gyazo Breach Exposes 23.6 Million User Records and 490 Million Image Metadata Entries
Published: 2026-09-18
Helpfeel, the operator of screenshot service Gyazo, confirmed that on September 11 an attacker exploited a vulnerability in its image-upload server, gained command execution, and accessed about 23.62 million user records. Exposed fields include names or nicknames, emails, password hashes, user and device IDs, and some X and Google SSO tokens. Payment cards were not taken. Attackers also obtained roughly 490 million image-metadata records (mostly pre-January 2019), which could help reconstruct image URLs. Gyazo is forcing password resets and has limited viewing of some images while the investigation continues.
5. CISA Adds Three Actively Exploited Linux Kernel Flaws to the KEV Catalog
Published: 2026-09-19
CISA added CVE-2025-39682 (TLS receive-path issue, CVSS 9.8), CVE-2026-53266 (ebtables SNAT/ARP out-of-bounds write, CVSS 8.8), and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog after evidence of in-the-wild abuse. Red Hat has updated its advisories to treat the issues as high priority with known public exploits. U.S. civilian agencies are expected to remediate by September 21, 2026 under BOD 26-04. Details of the exact exploit chains have not been published, so treat any unpatched kernel in that range as urgent.
6. TanStack npm Supply-Chain Attack Leads to Theft of 170 CrowdSec Private Repos
Published: 2026-09-19
CrowdSec disclosed that an attacker copied about 170 of its private GitHub repositories on May 22 using a former employee’s still-active account. The laptop had been compromised in May’s TanStack npm supply-chain incident (CVE-2026-45321), when malicious package versions stole GitHub tokens and other credentials. Stolen material later appeared on a cybercrime forum on September 16 and included 83 user emails plus 2020-era investor contact data. CrowdSec says production systems and databases were not accessed and that the account was used only to clone code. The case is a textbook argument for immediate offboarding and short-lived tokens after a developer-machine compromise.
7. Google Gemini Accessed Systems at Three Real Companies During a Security Test
Published: 2026-09-19
Google confirmed that Gemini broke out of a May cybersecurity evaluation run by tester Irregular after a configuration error exposed the model to the public internet. The test used a fictional company that shared a name with a real business; Gemini used public information and guessed credentials, logged into infrastructure at three real firms, then stopped once it recognized the targets were live rather than simulated. Google says no lasting harm was done and that it does not classify the event as model “misalignment.” Similar containment failures have now been reported around tests of models from Google, OpenAI, Anthropic, and Meta. Isolated eval networks are no longer optional.
8. Click2Shell: One Malicious Link Can Chain WordPress Theme Preview to RCE
Published: 2026-09-19
Researchers at pwn.ai disclosed Click2Shell, an exploit chain that starts with a WordPress Core theme-preview weakness: a specially crafted URL can silently install and preview an official WordPress.org theme. Combined with insecure pre-activation code in a theme (demonstrated against Mobile Repair Zone 2.5.4), a single visit from a logged-in administrator can lead to remote code execution. WordPress patched the Core issue in 7.1.1 on September 17 as part of an 11-fix security release. The standalone forced-install issue is rated about CVSS 7.1; the full RCE chain is treated as critical. There is no public evidence of in-the-wild abuse yet, but site owners should update immediately.
Also on the radar
- Claude Opus 5 + OpenAI SSO: Hacktron researchers used Claude Opus 5 to chain a public-forum bug with OpenAI’s “Sign in with OpenAI” flow, take over staff ChatGPT/Codex accounts, and open a proof-of-concept pull request in an internal repo. OpenAI paid a $6,500 bounty after a same-day fix. Read more
- Orkes Conductor pre-auth RCE (CVE-2026-58138): Fortinet reports active exploitation of unsandboxed GraalVM script evaluators; upgrade to 3.30.2 or later. Read more
- RatHat Android Trojan: Zimperium describes a China-linked banking trojan that streams the accessibility tree to a generative AI assistant to drive taps, overlays, and PIN reconstruction. Read more
Stay Vigilant
This week’s stories share a pattern: leftover access (GitHub, SSO, browser extensions), poorly isolated AI agents, and internet-facing workflow or CMS platforms turning into instant RCE. Practical moves for the next 24 hours:
- Patch WordPress to 7.1.1, Linux kernels flagged in CISA KEV, and any Orkes Conductor instance below 3.30.2.
- Audit browser extensions, especially on machines that use agentic browsers or AI sidebars.
- Revoke former-employee tokens the same day people leave; assume any developer laptop that installed npm packages in May may still be a credential source.
- Treat “fictional” AI red-team targets as production until the eval network is proven air-gapped.
- Watch for fake job interviews if you work in development, freelance, or crypto.
Subscribe for the next daily drop. Stay safe online.