Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5 (first published 16 September 2026 16:00 GMT) covers CVE-2026-76460, a maximum-severity authentication bypass in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of configuration. Insufficient authentication control on an API endpoint lets an unauthenticated remote attacker send a crafted request and bypass the web-based management interface to gain unauthorised device access; Cisco notes successful exploitation may yield root command execution and that on-box evidence can be removed afterward. Cisco CVSS 3.1 base 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); CWE-648; Bug CSCww39530. No workarounds; temporary mitigation: infrastructure ACLs restricting management/control-plane traffic to the device. Fixed software: ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, 3.1 Patch 12. Cisco PSIRT is aware of active exploitation; CISA added CVE-2026-76460 to KEV on 16 September 2026 (same alert also added Acronis CVE-2026-87886). Same-day Cisco ISE/ISE-PIC criticals including CVE-2026-76423 are noted as related context, not separate desk cards — only 76460 has claimed in-the-wild use in the PSIRT advisory. Hunt ise-kong/access.log for suspicious usernames and correlate off-box network/firewall logs. Primary: Cisco PSIRT; wires: BleepingComputer / SecurityWeek 17 Sep 2026.
Forever Security (16 September 2026; also The Hacker News) documents BragJack: a research technique where a malicious Chromium extension with common page-modify and declarativeNetRequest permissions injects into the trusted origin the browser AI "body" listens to, then commands the built-in assistant. Affected demos: Gemini Live in Chrome (CVE-2026-0628, CVSS 8.8 per CISA score cited by researchers; fixed in Chrome 143.0.7499.192, Jan 2026), Microsoft Edge (CVE-2026-55945, CVSS 4.2; fixed in Edge 150.0.4078.48, 2 Jul 2026), Perplexity Comet, Opera Neon, and Claude in Chrome (latter three without CVE; vendor bounty acknowledgements claimed). Impacts vary by product (agent hijack, local file read, camera/mic on Chrome). Researcher demos only — not reported in the wild; requires the attacker's extension already installed. Primary: Forever Security; wire: The Hacker News.
Forever Security — BragJack research (16 Sep 2026)
Mandiant AI Risk and Resilience Report 2026 (Google Cloud; wired by The Hacker News 16 September) case study: after compromising a SaaS provider, an attacker hijacked an active AI coding-assistant session on a developer workstation. The assistant recommended a poisoned external package; once accepted, the attacker used the session to install an infostealer via a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across about 100 internal repositories (secret theft and programmatic exfiltration). Distinct from earlier Keyv-linked npm worm / Mini Shai-Hulud supply-chain desk notes. Defenders: treat AI assistant tool-install prompts as high-risk; constrain package installs; rotate GitHub tokens; audit recent repo automation. Primary: Mandiant/Google Cloud report.
Mandiant AI Risk and Resilience Report 2026 (Google Cloud)
Premier Medical Group of the Hudson Valley P.C. published a Notice of Data Security Incident: after disruption of some IT systems, investigation found an unauthorized party accessed certain files on 14 June 2026; on 14 July 2026 PMG determined files may have included patient names, contact information, dates of birth, health insurance information, provider names, internal patient IDs, dates of service, medication information, and treatment/diagnostic information. Law enforcement notified; enhanced safeguards and staff training cited. The HHS breach portal lists Premier Medical Group of the Hudson Valley P.C. (NY, healthcare provider) with 282,075 individuals affected, submitted 21 August 2026, as a hacking/IT incident involving a network server. How the attack occurred not disclosed. Primary: company notice; HHS OCR breach portal.
Premier Medical Group — Notice of Data Security Incident
WSO2 security advisory WSO2-2026-5328 / CVE-2026-5430 (published 3 May 2026; Critical): JWT authentication can be bypassed when a token is signed with an unsupported algorithm, allowing unauthorized access and potential administrative account takeover. Vendor CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); single-tenant deployments adjusted to 9.8 (S:U). Affected: WSO2 API Manager 4.1.0–4.6.0; API Control Plane 4.5.0/4.6.0; Traffic Manager 4.5.0/4.6.0; Universal Gateway 4.5.0/4.6.0. The Hacker News (16 September 2026) cites watchTowr honeypot telemetry capturing forged admin JWTs on 13 September 2026 — active in-the-wild exploitation attempts. Support subscription holders: apply stated update levels (e.g. API Manager 4.6.0 UL 21, 4.5.0 UL 57, 4.4.0 UL 72, 4.3.0 UL 108, 4.2.0 UL 197, 4.1.0 UL 257; Control Plane/Traffic Manager/Universal Gateway levels on the advisory). Community: GitHub fixes carbon-apimgt PR 13752 and product-apim PR 14167, or migrate to an unaffected release. Credits: Hacktron Team. Primary: WSO2 WSO2-2026-5328; wire: The Hacker News / watchTowr. UPDATE 24–25 Sep 2026: CISA added CVE-2026-5430 to KEV on 24 Sep 2026 (catalog 2026.09.24; FCEB due 27 Sep) alongside Adobe CVE-2026-71362. CISA’s KEV shortDescription labels the issue a path-traversal / unrestricted file-upload RCE; the authoritative WSO2-2026-5328 advisory text remains JWT authentication bypass via unsupported signing algorithm — desk keeps the vendor description. Wire: The Hacker News 25 Sep (KEV pair write-up).
eSentire Threat Response Unit blog (published 15 September 2026, 7:00 am US Eastern; 7:00 pm Perth) details GhostCode, a novel OAuth 2.0 device-authorization phishing kit that hijacks Microsoft 365 accounts after the victim completes legitimate MFA on Microsoft's real sign-in page. Observed chain: Salesforce contact-form lure posing as a procurement officer for BJ's Wholesale Club, sales follow-up, NDA pretext, then a WeTransfer link to a password-gated HTML lure using three evasion layers (junk padding, character-level HTML comment injection and an AES-256-GCM-encrypted redirect URL); a Cloudflare Turnstile gate filters scanners before the device-code page. Kit requests a user_code using the Microsoft Authentication Broker application ID, presents a polished fake document portal, and captures tokens once the victim approves the attacker's device. eSentire describes Primary Refresh Token capture and, in one intrusion, nine successful API calls with the stolen token across a 78-second period and three devices registered within 78 seconds, with rotating residential proxy IP addresses matching the victim's geolocation. Distinct from password-stealing kits; MFA does not stop the flow because the victim authenticates Microsoft directly. Defenders: restrict or block device-code grant where unused, alert on Authentication Broker device registrations, treat unexpected WeTransfer/NDA procurement mail as high-risk, review Entra ID sign-in and device logs. Primary: eSentire TRU. Correction (26 Oct 2026): removed the Cyber Security News credit and link; every detail on this card is from eSentire's report, and the title no longer describes the 78-second window as an MFA bypass time. (source: eSentire)
eSentire TRU — GhostCode device-code phishing kit (15 Sep 2026)
CrowdStrike Counter Adversary Operations (blog 15 September 2026; THN wire 18 September) details PhantomRaven, a JavaScript information stealer distributed via typosquatted npm packages that use remote dynamic dependencies (HTTP URL deps + preinstall) to fetch the payload. High-confidence assessment that the code was LLM-generated (verbose redundant comments, placeholder WebSocket URL wss://yourserver.com/socket, statistical token patterns). Operator profiled as a self-described bug bounty hunter active since November 2022 (Bugcrowd/Intigriti/YesWeHack/HackenProof/HackerOne claims); CrowdStrike has not seen PhantomRaven logs on stealer shops and assesses stolen CI/CD and developer data is used to find bounty opportunities rather than sell logs. Harvests OS/host/IP, Git/npm emails, and CI/CD env vars (GitHub Actions, GitLab CI, Jenkins, CircleCI). Example packages cited: transform-jsbi-to-bigint, sort-imports-es6-autofix; C2 domains include npm.jpartifacts.com and related *.storeartifact.com / *.storageartifact.com. Mitigations: private npm registry, npm --ignore-scripts / install-scripts controls, upgrade npm (v12+ blocks dependency install scripts by default). Primary: CrowdStrike blog; wire: THN.
Docker security announcements (Sandboxes 0.42.0; NVD received CVE-2026-77179 on 15 September 2026) document two sandbox-escape flaws. CVE-2026-77179 (Critical, Docker CVSS 4.0 base 9.4): on macOS the virtio-fs host server followed symlinks when reopening an unlinked file from a stored path, so malicious guest code (e.g. a compromised AI coding agent inside sbx) could escape the shared project workspace and read/modify arbitrary host files as the VMM user — potentially host code execution. Affects Sandboxes 0.28.0 up to but not including 0.42.0 on macOS. Companion CVE-2026-79994 (High, CVSS 4.0 8.7): guest-to-host Unix-domain socket relay TOCTOU symlink race; affects 0.37.0 up to but not including 0.42.0. Both fixed in 0.42.0 (release notes / sbx-releases tag). CISA's CVE-record enrichment lists exploitation as 'none', and neither CVE is in CISA's KEV catalog as of 27 October 2026. Workaround if unable to upgrade: use clone mode and avoid additional host mounts. Category vulnerabilities with AI-agent sandbox tag. Primary: Docker security announcements; secondary: NVD / GitHub sbx-releases v0.42.0. Correction (27 Oct 2026): the affected range for CVE-2026-79994 is now given as Docker states it, 0.37.0 up to but not including 0.42.0, rather than 'through 0.41.9'; a line saying Docker reports no exploitation was removed because Docker's announcement does not say so. (source: Docker security announcements; CVE.org)
JFrog (15 September 2026) documents ParaShells: an unprivileged local user on macOS can get root via Parallels Desktop's prl_disp_service (world-writable Unix socket, weak local-client auth, appliance-extract argument injection into tar --use-compress-program). Lab-proven on Desktop 26.4.0 build 57513 (Apple silicon); treat installs that still expose the same InstallAppliance extract template and dispatcher socket as in scope. CVE-2026-90894. Fixed in Parallels Desktop 27.0.0 (JFrog: fix shipped 1 Sep; CVE/blog 14–15 Sep). THN notes Intel Macs cannot install Desktop 27 — those hosts need interim local-account lockdown / vendor guidance. No in-the-wild exploitation reported by JFrog. Primary: JFrog research blog.
Google’s September 2026 Pixel update (patch level 2026-09-05) addresses CVE-2026-58704 in the Cellular Modem: improper authorization / logic error enabling remote (proximal/adjacent) privilege escalation with low privileges, no user interaction. NVD (published 15 September 2026; Google as source) scores CVSS 3.1 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). BleepingComputer (16 September 2026) cites Google’s Pixel bulletin warning of indications the flaw “may be under limited, targeted exploitation.” Same bulletin set covers 110 Pixel issues including additional critical/high RCE and privilege-escalation fixes. Distinct from desk card android-september-2026-bulletin (AOSP OEM bulletin). Apply Pixel Security update to 2026-09-05+. Primary: NVD CVE-2026-58704; wire: BleepingComputer; vendor bulletin URL (may require Google developer sign-in). UPDATE (26 Oct 2026): CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog on 16 September 2026, with a 19 September due date for US federal agencies. The CVE record now also carries a CISA score of 8.8 (CVSS 3.1, no privileges required). (source: CISA KEV catalog; CVE record)
Google Stable Channel Update for Desktop (15 September 2026) promotes Chrome to 153.0.8010.47/.48 (Windows/Mac) and 153.0.8010.47 (Linux) with 42 security fixes. Critical entries include CVE-2026-91726 (OOB read in WebGL), CVE-2026-91721 (UAF in Internals), and CVE-2026-91749 (UAF in Workers), plus numerous High UAFs, race conditions, and related issues. Distinct from desk card cve-2026-87491 (Chrome 153.0.8010.36/.37 V8 OOB-write 0-day on 8 Sep). Mozilla MFSA 2026-90 (announced 15 September 2026) ships Firefox 156 with individual CVEs for high-impact bugs (privilege escalation / UAF / WebGL boundary issues among others; Thunderbird 156 / ESR trains also updated per SecurityWeek). Neither vendor claims exploitation in the wild for this batch. SecurityWeek (16 Sep) summarised ~115 combined defects. Primary: Chrome Releases + Mozilla MFSA 2026-90.
Oracle Critical Security Patch Update advisory — September 2026 (Rev 1, 15 September 2026) contains 673 new security patches across product families. SecurityWeek (16 September 2026) notes the matrices cover on the order of 800+ CVE IDs including third-party component fixes, with more than 100 critical-severity issues and over 240 remotely exploitable without authentication. Largest batches include Oracle E-Business Suite, Fusion Middleware, and Hyperion. Notable CVSS 10.0 entries include Oracle Access Manager Authentication Engine CVE-2026-71133 (HTTP, unauthenticated network, versions 12.2.1.4.0 and 14.1.2.1.0) and Oracle Internet Directory OID LDAP Server CVE-2026-83059 (LDAP, unauthenticated network, 12.2.1.4.0 and 14.1.2.1.0). Oracle again warns of exploitation attempts against already-patched issues where customers delayed applying updates; no claim in the advisory that these September flaws are exploited in the wild. Apply the September 2026 CSPU for each product family you run. Distinct from desk card oracle-cspu-20260818. Primary: Oracle CSPU September 2026; wire: SecurityWeek 16 Sep.
