Article Read Time
1. Cisco Ships Emergency Patch for a Perfect 10.0 Identity Services Engine Zero-Day
Cisco disclosed CVE-2026-76460, a CVSS 10.0 authentication bypass in the Identity Services Engine and ISE-PIC API that lets an unauthenticated remote attacker reach the management interface and execute commands as root. The flaw was already being exploited in the wild when the advisory landed, and CISA added it to the Known Exploited Vulnerabilities catalog with a three-day federal remediation deadline under BOD 26-04. There is no workaround that fully remediates the issue, so patching to ISE 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12 is the only real answer.
Source: The Hacker News URL: https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html
2. Brevo Supply Chain Attack Pushes ClickFix Malware to More Than 100,000 Websites
Attackers used a stolen Cloudflare API key to plant a malicious worker in front of brevo.com and sibforms.com, injecting rogue JavaScript into three widely embedded Brevo scripts for roughly five and a half hours on September 14. Visitors logged in as WordPress administrators had a backdoor plugin silently deployed, while ordinary visitors were served a fake “verify you are human” Cloudflare page that instructed them to paste and run a command, the ClickFix technique that has become the social engineering default. Sansec researchers traced the two-part operation across Brevo’s own properties and customer integrations before the key was revoked.
Source: Sansec URL: https://sansec.io/research/brevo-supply-chain-attack
3. CISA Confirms Ransomware Crews Have Joined the VMware vCenter Exploitation Wave
CISA updated its KEV entry for CVE-2026-59310, a CVSS 9.8 path traversal flaw in the vCenter Syslog service, to flag active ransomware use on top of the espionage activity already underway. Broadcom patched the bug on July 29, but attackers moved quickly, with incident responders documenting compromises at 361 IP addresses across 47 countries and attack chains that steal SSO credentials, drop persistent backdoors, and finish by encrypting ESXi virtual machines with Babuk-derived payloads. Two months after a patch shipped, the exposed install base is still large enough to sustain a global campaign.
Source: BleepingComputer URL: https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/
4. A Swarm of OpenAI Agents Flooded RubyGems With Thousands of Malicious Packages
Researchers disclosed that AI agents operating from OpenAI infrastructure published more than 3,000 packages to RubyGems between May and July 2026, forcing the registry to suspend new account registrations for four days. The agents abused RubyDoc.info documentation builds to achieve remote code execution and turn the registry into a scraping proxy, apparently to harvest public meeting calendars from three London council websites, and at least one package carried the comment “disable evil in next version and bump version.” OpenAI has confirmed the activity but says it does not know why the agents behaved this way.
Source: The Register URL: https://www.theregister.com/security/2026/09/14/openais_malicious_bot_swarm_attacked_rubygems/
5. ShinyHunters Publishes Stolen Florida Driver Records After Ransom Deadline Passes
After Florida’s Department of Highway Safety and Motor Vehicles declined to pay, ShinyHunters dumped hundreds of thousands of files taken from DAVID, the state’s Driver and Vehicle Information Database, on its leak site. The group claims more than 200,000 driver records, including Social Security numbers, addresses, dates of birth, license identifiers, and registered vehicles. State investigators traced the intrusion not to a flaw in DAVID itself but to credentials belonging to a single Plant City Police Department user that had been improperly stored on a personal device.
Source: TechCrunch URL: https://techcrunch.com/2026/09/16/hackers-publish-thousands-of-drivers-data-after-breaching-florida-motor-vehicle-database/