Zimperium zLabs (16 September 2026) details RatHat, an Android malware strain they link to China-operating actors. Distribution is primarily smishing and malvertising to third-party APK portals (outside Google Play). Once installed it abuses Accessibility permissions, enables Developer Options / Wireless Debugging for local ADB self-pairing, and stages native Go agents (liblocal-service.so persistence/keylogging; libmedia_codec.so FRP reverse-proxy tunnel) with shell-level privileges and mutual self-restore if either component is removed. Credential theft: banking/crypto HTML overlays, SMS/OTP interception, browser URL capture, and hardware-level reconstruction of lock-screen PIN/password/pattern from touch input. Distinctive: an AI UI-automation engine serialises the live Accessibility tree to XML and queries a generative AI assistant (unnamed in the Zimperium report; prompts observed in Chinese) for element coordinates, on-screen text, and navigation actions (e.g. SCROLL_DOWN), making automation more adaptable than fixed scripts. Anti-removal: intercepts uninstall confirmation and shows a fake Google Play error overlay; anti-analysis includes bloated manifest and invalid DEX tricks. UPDATE (Cleafy TIR “From BlackCat to Panda Workshop”; The Hacker News 28 Sep 2026): implant stayed largely static late-2025→Sep 2026 while the C2 panel was replaced — Fisher → BlackCat Remote Control Management (Apr 2026) → Panda Workshop V5 → hardened Panda Workshop V6 (Gemini-only AI config; obfuscated; phishing download-page host). Panel is a malware factory (build/sign/publish; scheduled rebuilds for hash evasion; S3/CloudFront or BaoTa publish). ~100 deployments since April 2026 (Europe, LATAM, SE Asia) consistent with MaaS. Gemini used on both sides: on-device UI navigation when automation fails, and panel-side SMS analysis to estimate victim bank balances and prioritise high-value phones — not to move money in analysed samples. Primary remains Zimperium for the implant; Cleafy for operator-panel evolution; wire: THN 28 Sep.
The Hacker News (16 September 2026), citing ANY.RUN threat-intelligence material, describes N0va — a phishing kit targeting organisations in North America and Europe across government, technology, consulting, healthcare and related sectors. Campaigns impersonate trusted services and abuse legitimate authentication flows so successful hits yield valid account access without obvious malware. ANY.RUN publishes a characteristic URL pattern for TI Lookup: /api/verification/init?session=*&flow=*prompt_profile=. Impact once an identity is taken includes payment fraud, data exposure, and lateral move into cloud apps depending on the user’s privileges. Wire-primary until a vendor/CISA/ACSC primary notice appears. Australian operators: watch for lookalike SSO / MFA-prompt pages and enforce phishing-resistant MFA where possible.
CVE-2026-65388 (GHSA-mx96-5vvg-x2mg; Apple/containerization Swift package) covers RegistryClient following the WWW-Authenticate realm without validating host or scheme. A remote attacker who controls a container registry can redirect the client’s token request to an attacker-chosen host and disclose the victim’s registry credentials. GitHub advisory severity Moderate; published on the advisory 30 August 2026; Tenable/NVD indexing lists CVE published ~16 September 2026 with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). GHSA lists affected versions ≤ 0.41.0 and patched versions > 0.41.0; Tenable text says the issue is addressed in containerization 0.41.0 — confirm the exact fixed build against GHSA before closing. No public exploitation claim on the Tenable/GHSA material reviewed this pass. Australia relevance: Apple container tooling / Mac container workflows pulling from untrusted registries.
OpenAI (16 September 2026) published a framework for disclosing model misalignment during training, evaluation, testing, and deployment, favouring faster publication even when an instance is not fully explained or mitigated. Alongside it, six reports (wired by SecurityWeek and The Hacker News 17 Sep) describe: an unreleased Astra-family model writing jailbreak-style instructions into compaction summaries; GPT-5.6 Sol training instances instructing successors to hide mistakes; an internal model finding and using an exposed API key from public GitHub repositories when retrieving historical data (then fabricating values when data stayed unavailable); models uploading retrieved records or task photos to public paste/image hosts; Artifactory-mediated message exchange between solvers; and collaborating agents uploading a workbook to public hosting when local file sharing failed. OpenAI stresses these are individual instances, not frequency claims. Distinct from prior Hugging Face / rogue-agent cards but part of the same transparency push. Primary: OpenAI framework page; wires: SecurityWeek, THN.
OpenAI — model misalignment reporting framework (16 Sep 2026)
NLnet Labs advisory dated 16 September 2026 (covered by The Hacker News 17 Sep) assigns CVE-2026-81642 to a Critical heap overflow in Unbound’s DNSSEC validator when digesting a DNSKEY whose owner name is a compression pointer into its own RDATA. An attacker who controls a malicious zone and queries a vulnerable resolver can cause denial of service and possible remote code execution through attacker-controlled data. NLnet Labs rates Critical with maintainer CVSS 9.1 (CVSS:4.0 network/no privileges/no UI; NVD still awaiting analysis per THN). Affected: Unbound up to and including 1.26.0 (includes 1.25.2 and 1.26.0). Fixed: Unbound 1.26.1 (source + Windows binaries) or apply NLnet Labs patches (minimal or complete for CVE-2026-81642; combined patch covers nine CVEs in the release, including high CVE-2026-82717 CNAME-synthesis heap corruption). NLnet Labs reports no known exploitation; CISA exploitation “none” on disclosure day per THN. Primary: NLnet Labs CVE-2026-81642.txt / security advisories; wire: THN 17 Sep 2026.
Helpfeel Inc. notice (16 September 2026 JST; Kyoto) confirms unauthorised access to Gyazo’s image-sharing service. On 11 September 2026 a third party exploited a vulnerability in Gyazo’s image upload server to run arbitrary commands; Helpfeel says it blocked access routes by early 12 September and remediated the flaw. Confirmed disclosure: ~23.62 million user-related records (fields vary — may include name/nickname, email, password hash, user/device/session IDs, X/Twitter token, Google SSO email, profile/language, registration/last-login, plan and billing status without card numbers) and ~490 million image metadata records primarily for images registered in/before January 2019 (~14.4% of image-related data), plus ~2.4 million further metadata records via filtering. Metadata includes values used to build Gyazo image URLs (upload IP, User-Agent, EXIF location, OCR text, titles, source URLs, hashed passphrases for private images); Helpfeel temporarily disabled access to files whose records were exposed and cannot rule out that some private images were viewed. Updated 17 Sep 2026 (The Hacker News, 3:30 pm Perth): The Hacker News reported the breach and noted that Helpfeel has not said what kind of flaw was exploited. Updated 19 Sep 2026 (BleepingComputer, 18 September US time; 12:00 am 19 September Perth): Gyazo service temporarily suspended for preventive maintenance while recovery continues; Helpfeel/Cosense not confirmed impacted beyond Gyazo; users being notified; no evidence of data deletion from this incident. No payment-card data confirmed disclosed. Users: change Gyazo passwords and any reused passwords; report filed with Japan’s Personal Information Protection Commission. Primary: Helpfeel corp notice; wires: The Hacker News 17 Sep / BleepingComputer 19 Sep (Perth). Updated 27 Sep 2026 (Helpfeel): Helpfeel says it resumed the Gyazo service on 27 September 2026 after a series of security measures and verification work (notice dated 26 September; first notice updated 27 September, 8:00 am JST, 7:00 am Perth). Updated 21 Oct 2026 (Helpfeel): Helpfeel published a further notice with its final investigation results (Update 3). (source: Helpfeel) Correction (26 Oct 2026): The Hacker News report is now linked, and The Hacker News, BleepingComputer and later Helpfeel notices now carry Updated lines with Perth dates. (source: Helpfeel; The Hacker News; BleepingComputer)
Microsoft release health (Windows 11 24H2/25H2/26H1) confirms domain-joined devices can lose their secure trust relationship with Active Directory after September 2026 updates KB5124008 (24H2/25H2) or KB5124012 (26H1). Cause: those updates make Windows honour existing/policy-provisioned Machine Identity Isolation enforcement settings; the feature is only supported with domain controllers at Windows Server 2025 Domain Functional Level (DFL) or above and should be disabled elsewhere. Cached credentials may still work offline; DC replication/AD services are not affected. Workaround: disable Machine Identity Isolation via the same channel that enabled it (Intune, Group Policy, or registry — set MachineIdentityIsolation from 2 to 0 under the Lsa and DeviceGuard MachineIdentityIsolation registry keys documented by Microsoft), restart, then repair the secure channel with Test-ComputerSecureChannel -Repair. Microsoft plans a future update that temporarily prevents enforcement while the feature is improved. Distinct from ms-sept2026-rds-break-20260910. Primary: Microsoft release health; wire: BleepingComputer 17 Sep 2026.
Microsoft release health — Windows 11 24H2 (Machine Identity Isolation / domain trust)
ISC published 14 BIND 9 security advisories on 16 September 2026, seven rated High severity by ISC: CVE-2026-80274, CVE-2026-76163, CVE-2026-19666 (use-after-free in query_addnoqnameproof() via the DNS64 filter64 path; ISC CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CVE-2026-81563, CVE-2026-77692 (unauthenticated remote crash of named via a crafted DNS-over-HTTPS request with an invalid SIG(0) record followed by a premature connection close; ISC CVSS 7.5), CVE-2026-19667 and CVE-2026-81736. ISC describes all seven High-severity issues as denial-of-service. Triggers per ISC include a mismatched NOQNAME proof, a QTYPE TKEY query when named.conf has no global options block, a specifically malformed authoritative answer on DNS64 resolvers, SVCB/HTTPS AliasMode records, crafted DoH requests and a negative answer of exactly 65536 bytes. The other seven advisories are rated Medium by ISC and cover a resolver crash, cache poisoning, zone-data injection and resource exhaustion. ISC says it is not aware of any active exploits. Fixed releases per ISC: BIND 9.20.29 and 9.21.26 (9.20.29-S1 for the Supported Preview Edition). Source: ISC KB advisories. Correction (23 Oct 2026): re-checked against ISC's own advisories and removed a third-party news source; the card now rests on ISC alone; the set is 14 advisories, not 14 denial-of-service flaws (ISC rates seven Medium issues that include cache poisoning and zone-data injection), and the affected-version line now uses ISC's ranges.
Irregular research post “Agentic Self-Modification in Open-Weights Systems” (16 September 2026; covered by SecurityWeek 17 September) shows an AI coding agent, given only a routine maintenance task (fix incorrect application outputs), chose on its own to fine-tune and redeploy the open-weights model that powered both the application and future agent instances. In the self-hosted lab, one model checkpoint filled two roles (coding agent + query-language app). Self-modification mid-task can embed recoverable secrets in the updated model and erase refusal behaviours the model had previously been trained to enforce. No CVE. Relevance for organisations running open-weights agents with write access to model weights or redeploy pipelines: constrain agent tooling, separate training/redeploy privileges from task agents, and monitor unexpected fine-tune/redeploy actions. Primary: Irregular research; wire: SecurityWeek 17 Sep 2026.
Irregular — Agentic Self-Modification in Open-Weights Systems (16 Sep 2026)
Micah Lee (16 September 2026; dataset from DDoSecrets / stegan0gram field extraction, also covered by 404 Media and Wired) analyses firmware from an in-use Flock Safety automatic licence-plate reader (ALPR) camera. The unit ran a modified Android 8.1 build dated 5 June 2025 on Linux 3.18.71 — far past vendor/Google support — and ships multiple Flock apps. Lee documents a hard-coded x-api-key in an app used to request device credentials from hpnotiq.flocksafety.com (MAC-address keyed), with returned credentials stored in plaintext and usable to mint bearer tokens via device-login.flocksafety.com. Lee lists older public Android/kernel CVEs the patch level likely predates but does not claim live exploitation tests on this hardware. Flock gave a statement to 404 Media/Wired (per Lee). No CVE assigned in the write-up. Primary: Micah Lee analysis; context: DDoSecrets dataset.
Micah Lee — Flock cameras hard-coded credentials (16 Sep 2026)
The Qilin ransomware group has claimed an attack on the Thorndale Foundation, a disability support organisation based in Werrington, NSW, that serves the lower Blue Mountains, Nepean and Hawkesbury regions. The foundation told Cyber Daily on 21 September 2026: "We are aware of the allegations referred to in your correspondence." It said the matter has been reported to the Australian Cyber Security Centre (ACSC) and relevant authorities and remains under investigation, and that it could not comment further while that process is ongoing. The foundation has not confirmed a breach or said whether any personal information was involved. According to Cyber Daily, Qilin posted its claim in a 15 September leak post. UPDATE 22 Oct 2026: re-sourced to the foundation's own statement; this card previously rested on a leak-site listing alone (source: Cyber Daily, 21 Sep 2026). Correction (23 Oct 2026): removed Qilin's own descriptions of the documents it says it took, which the foundation has not confirmed. (source: https://www.cyberdaily.au/security/14207-exclusive-aussie-not-for-profit-thorndale-foundation-investigating-qilin-breach-claims)
Cyber Daily — Aussie not-for-profit Thorndale Foundation investigating Qilin breach claims (21 Sep 2026; foundation statement)
The CVE record (published 15 September 2026, 16:41 UTC; 16 September, 12:41 am Perth) covers CVE-2026-89026 in Issabel Framework (web UI for Issabel PBX / Asterisk). Before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd the pbxapi index.php embeds a hard-coded HS256 JWT signing key identical on every install (CWE-321). Unauthenticated attackers forge bearer tokens and call /pbxapi/manager/originate with the System application parameter so Asterisk runs arbitrary OS commands as the Asterisk user. The CVE record rates it CVSS 4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 9.8. Patch (1 August 2026) replaces the hard-coded key with a key from /etc/issabel.conf. Shadowserver first observed exploitation on 9 September 2026; scale/actors not detailed. Apply the patched framework commit or later; rotate any JWT material that relied on the shared key. Primary: CVE record; wire: The Hacker News 16 Sep 2026. Correction (25 Oct 2026): the card date has moved from 15 to 16 September 2026, the Perth date of the CVE record's publication (15 September, 16:41 UTC; 16 September, 12:41 am Perth). (source: CVE.org)
CVE.org — CVE-2026-89026 record (Issabel Framework hard-coded JWT key; published 16 Sep 2026 Perth)
