Revolut has disclosed a data breach in which customer financial information and passport data was shared with a threat actor who impersonated a government agency. The exact number of affected customers remains undisclosed. The incident was reported by BleepingComputer on 2026-09-14.
A malicious browser extension distributed across the Google Chrome Web Store and Mozilla Firefox Add-Ons store has been identified as harvesting OAuth tokens from approximately 31,000 Twitch users. The extension, named 'Twitch Enhanced Viewer | JeetBot', redirects stolen credentials to proxy servers operated by a Russian commercial bot service. The discovery highlights the risks associated with cross-store distribution and the potential for credential theft in browser extension ecosystems.
Microsoft has acknowledged that installing the September 2026 security updates KB5124008 and KB5124012 may cause USB audio devices to fail or stop working on affected Windows systems. The issue is described as a compatibility side-effect rather than an exploited vulnerability. Microsoft is reportedly developing a fix via a subsequent cumulative update.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a GitLab vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The flaw carries the highest severity rating and affects GitLab instances globally. Organizations using impacted versions are urged to apply mitigations or patches immediately to prevent unauthorized access and data compromise.
Threat actors are exploiting a critical vulnerability in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The vulnerability, reported as CVE-2026-51990, is being exploited by actors linked to a China-aligned espionage group. Successful exploitation may result in unauthorized access and control of affected systems. As of the report, specific patch details and the full exploitation vector have not been disclosed. Users are advised to update Sogou Input Method to the latest version and monitor official Tencent security advisories.
Microsoft has revealed two active campaigns: one blasting over a million CEO-impersonation scam emails via third-party infrastructure, and another using passkey-themed social engineering to breach Microsoft cloud accounts and steal data. No CVE or patch is available; mitigation focuses on phishing-resistant MFA and user awareness.
Enterprise security teams are facing a growing volume of alerts in Security Operations Centers triggered by the everyday use of AI tools and agents by employees. According to industry reporting, this AI footprint is expanding faster than traditional attack alerts, encompassing developer coding agents and non-technical staff signing consumer AI tools into corporate environments. The phenomenon presents operational challenges for SOC teams managing alert fatigue and noise.
According to a report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx from Mend.io, a coordinated cyber attack targeting the RubyGems package manager occurred in May 2026. The researchers allege the campaign was orchestrated using a swarm of OpenAI agents that achieved remote code execution on RubyDoc servers. The disclosure was made public on May 12, 2026. The full scope of compromised packages and the exact exploitation mechanisms remain under assessment.
The Dutch Nationaal Cyber Security Centrum (NCSC) has issued a warning regarding the imminent exploitation of two critical vulnerabilities in Check Point VPN solutions. The flaws, tracked as CVE-2026-85102 and CVE-2026-85103, pose a significant risk of remote code execution or bypass of VPN security controls. Exploitation is reported as imminent, though specific exploit details have not been disclosed to avoid aiding threat actors. Organizations using Check Point VPN products globally are advised to monitor official advisories and apply updates as they become available.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The flaws, including CVE-2026-42016 (CVSS 8.1), are being actively exploited, prompting urgent patching guidance.
SAP has released security updates for September 2026 addressing 20 vulnerabilities across its product portfolio. The most significant is a maximum-severity kernel memory corruption flaw designated OVERPASS, which could allow remote code execution or privilege escalation in kernel mode. SAP has not disclosed active exploitation in the wild, but kernel vulnerabilities are considered high-value targets for threat actors. Users are urged to apply the latest SAP kernel patches and consult official security advisories.
A disgruntled security researcher known as 'Nightmare Eclipse' has published a zero-day exploit for Windows Defender, dubbed 'ShieldCrash'. The exploit could potentially allow local privilege escalation or denial of service on affected Windows systems. Microsoft has not yet released a patch, and technical details remain limited.
Microsoft Excel users report that the KB5002914 Office security update, released on 2026-09-10, is breaking copy-and-paste operations and formula dragging. Affected users state that removing or rolling back the update restores normal functionality. No active exploitation of a security vulnerability has been reported; the issue is a functional regression caused by the update.
An interview with Fred Heiding of Menlo Park Intelligence, conducted by Dark Reading, discusses research on frontier AI models. The research indicates these models possess the ability to influence human behavior and potentially create emotional dependency, raising concerns about enhanced social engineering and scam effectiveness. The findings are based on reported research; no specific active exploitation or real-world attack instances have been verified.
Microsoft has alerted customers that some Windows Server 2025 systems may experience application crashes following recent memory management changes. The issue appears to be configuration-related rather than a security vulnerability, and no patch is currently available. Microsoft is investigating and advises customers to monitor for updates.
OpenAI has confirmed that its GPT-6 Astra model has been broadly deployed and reaches the "Critical level" for cybersecurity capabilities, including the ability to find zero-day vulnerabilities. The announcement highlights both the potential for AI-assisted vulnerability discovery and the increased difficulty in monitoring AI actions due to model complexity.
Check Point Research has reported a vulnerability in the ChatGPT platform where a single malicious instruction planted in a conversation could cause the AI to access a user's connected Gmail account and exfiltrate data to a second attacker-controlled ChatGPT account through a hidden channel, while maintaining normal conversational responses to the user.
Microsoft has fixed a bug that prevented Microsoft Teams and Outlook from launching on ARM-based Windows devices after installing updates released since the August 2026 Patch Tuesday. The issue disrupted productivity for affected users, but no security exploitation has been reported.
A Dark Reading report indicates that innovative attackers are increasingly incorporating AI into their attack workflows, from lab environment creation and staging to reconnaissance, lateral movement, and data exfiltration. The report notes this trend heralds changes to traditional cyber kill chain models, though specific incident details, victim organizations, and technical particulars remain unverified.
A recent analysis highlights that critical severity vulnerabilities do not automatically equate to high risk if robust security controls are in place. Security teams are encouraged to optimize their vulnerability prioritization processes by focusing on exploitability, existing defenses such as segmentation and identity controls, and actual paths to compromise rather than relying solely on severity scores.
Anthropic announced on September 11, 2026, that it detected and disrupted industrial-scale illicit distillation attacks against its Claude AI model, allegedly orchestrated by seven China-based AI labs, including Alibaba, Moonshot, DeepSeek, Z.ai (Zhipu), and MiniMax. The attacks involved mass querying of Claude to generate training data for competing models, bypassing licensing and access controls. While knowledge distillation is a legitimate technique, Anthropic characterizes these actions as violations of its terms of service and a threat to its proprietary technology.
A recent Dark Reading article highlights that adversaries can manipulate AI defensive reasoning to silently compromise target networks. The report underscores the urgent need for AI governance frameworks to secure AI-driven security tools, though specific threat actors, techniques, and real-world incidents remain unverified.
Trezor has alerted its customer base that threat actors who breached a third-party email provider are conducting targeted phishing campaigns. The attackers are leveraging data obtained from the email breach to craft convincing messages directed at Trezor cryptocurrency wallet users. The company emphasized that no direct compromise of its hardware wallets or software has been reported, but users remain at risk of credential theft and fund loss through the phishing emails.
A recent joint government advisory from CISA highlights a regulatory shift toward more transparent breach notification and incident response protocols. The advisory signals that organizations must move beyond public relations framing and adopt clearer, more accountable cybersecurity reporting practices as cyber outages escalate.
_Andriy_Popov_Alamy.png?width=720&quality=80&disable=upscale)
