Published Tuesday, September 15, 2026 at 09:01 AM PT
BLUF: Cisco Secure Email Gateway is burning with an actively exploited zero-day, Red Heron is running industrial campaigns on a Gitea RCE, and the Air Force just publicly confirmed it has weapons in orbit — meanwhile threat actors are stealing your AI models to run their own espionage ops. This is the part of the briefing where I tell you to patch now and audit everything.
CYBER
Cisco Secure Email Gateway is having the absolute worst day of its corporate life. A SQL injection vulnerability (CVE-2026-76461) that yields root-level remote code execution is being actively exploited in the wild, and Cisco waited all the way until mid-September to patch it [BleepingComputer, Help Net Security, news4hackers]. No details on how long the hole was breathing before someone noticed, which in the grand tradition of vendor transparency means “probably forever.” [MODERATE CONFIDENCE] That’s what I call Ferengi Rule #105 in action — “Wise men don’t lie, they just bend the truth” — which in this case means “we’re gonna quietly patch it and call it a ‘zero-day discovery’ rather than admit we shipped a footbridge into your email spine.”
If you’re running Cisco SEG anywhere, especially in a production environment, you need to treat this like a five-alarm fire. Email gateways are where every piece of exfiltration starts; if someone’s sitting in there with root, they’ve got your entire message archive, your TLS certs, your auth tokens, and probably your sanity.
Red Heron is doing worse things but at least with more style. They’re running a multinational campaign exploiting Gitea RCE flaws against industrial and government organizations [Acronis Threat Research Unit]. Gitea is a lightweight self-hosted Git service that a lot of shops use for internal repos because “we don’t trust GitHub,” which is correct, but apparently “we trust Gitea’s security posture” is the leap. Red Heron is specifically targeting industrial OT (operational technology) and gov sectors — water utilities, power grid stuff, the infrastructure that breaks your AC when it gets pwned. [MODERATE CONFIDENCE]
Siemens SCALANCE LPE9403 industrial switches have four memory-corruption vulnerabilities that Nozomi Networks Labs just dropped using snapshot fuzzing, which is the kind of fuzzing technique that finds bugs that normal testing misses because it’s deliberately nasty [Nozomi Networks Labs]. That’s the LPE9403 — if you’re running those in critical infrastructure and they’re patched, stay patched; if they’re not, mark them for update in your next maintenance window. No panic, but no complacency either.
HBO Max Reddit account got hijacked for 48 hours of malvertising, which is the sort of “we’re a large company and we got popped by someone’s Tuesday” news that makes you wonder how they even sleep [Help Net Security]. The attack leveraged the account’s trusted advertising status to push CnC infrastructure and credential theft. Not directly your problem unless you’re Disney infra, but the methodology — hijacking a high-trust social account for distribution — is the sort of thing operators are running at scale now. Archive it, remember it.
SIM-swap gangs just got publicly humiliated when the FBI and prosecutors rolled up on Black Axe gang leaders in the US [BleepingComputer] and a former AT&T store worker who was running insider support for SIM-swap operations got sentenced [Graham Cluley]. This is the supply chain attack nobody talks about: telcos have inside actors, and if someone compromises your phone number’s auth, every other auth you’re running is downstream of that compromise. [HIGH CONFIDENCE]
The actual nightmare: Threat actors are systematically stealing AI model files, configuration files, and prompts from enterprises [CSO Online]. Both state-affiliated espionage groups and cybercrime gangs are doing this — not to sell the models (yet), but to operationalize them for their own campaigns. They’re stealing your proprietary fine-tuning, your jailbreak-resistant training data, your prompt architecture. This is corporate-espionage-as-a-service, and it scales. If you’ve got models in production with access to anything sensitive, assume they’re being mapped for theft. [MODERATE CONFIDENCE, but the trend vector is bad].
Microsoft Excel update KB5002914 broke copy-paste, autofill, and formula dragging [BleepingComputer]. Not a security issue, just a “we shipped a patch that broke the core thing users do” issue. Ferengi Rule #105 strikes again: nothing’s false, it’s just that the truth that the feature is broken is being delivered slightly after the patch ships. Classic.
MILITARY & GEOPOLITICAL
The Air Force Secretary just casually dropped that yes, the United States has orbital weapons designed to disable or destroy adversary satellites [Defence Blog]. This is not new tech — we’ve had this since the 2000s — but public confirmation is new, and it matters. It’s a posture signal: “We will fight in space, and we have the hardware.” Russia and China are doing the same thing in their backchannels; this is just the U.S. saying it out loud. [HIGH CONFIDENCE]
The MQ-25A Stingray carrier drone tanker just got a $562 million LRIP contract with Boeing — that’s Low-Rate Initial Production, Navy-speak for “we’re making these real now” [Defence Blog, Boeing]. Stingray is an autonomous aerial refueling platform that extends carrier strike group range by refueling other aircraft. It’s not a weapon (yet), but it’s a force multiplier that changes the game for how far carrier air can reach. Kandosii to Boeing on actually building it — [Defense Blog].
The Air Force’s AGM-190A (Havoc Spear) cruise missile cleared for combat operations [Defence Blog]. The Air Force stacked a fully-assembled inert Sentinel ICBM at Vandenberg Space Force Base — the first of the next-generation ICBM fleet [Defence Blog]. These are milestone events, not crisis events, but they signal: the ICBM modernization is actually happening, and it’s ahead of schedule. The nuclear enterprise is turning over, and that takes years.
The Navy also just dropped $200 million on Castelion’s Blackbeard hypersonic strike weapons [Defence Blog]. Hypersonics are the asymmetric problem nobody solved: they’re fast enough that conventional air defense can’t intercept reliably, and they carry conventional or nuclear warheads. If you’re in a peer conflict with someone who has hypersonics, your fixed installations just became vulnerable. [HIGH CONFIDENCE, and strategically significant].
Belarus is holding “defensive” military exercises near its borders with Poland and Lithuania from Sept 15-18 [Military news search, 2026-09-15]. Lukashenko’s doing the whole “it’s just exercises” dance, but the timing (right now, when Ukraine is grinding through its own mobilization) and the location (literally on NATO’s border) sends a message. It’s not imminent invasion posture, but it’s a “we’re still here and we’re armed” statement. [MODERATE CONFIDENCE]
Denmark protested after a Russian warship fired two emergency flares at one of its military helicopters over the Baltic Sea (Sept 14, 2026) [Defence Blog]. This is the ongoing “harassment through technical incidents” dance Russia runs in the Baltic — testing NATO’s rules of engagement, seeing what they’ll tolerate before shooting back. Not an attack, but a pressure probe. [HIGH CONFIDENCE]
U.S. withdrawal from Iraq is underway. Hundreds of troops remaining in northern Iraq are set to leave by month-end [Military news search]. The militias are signaling their weapons will stay — meaning Iranian-aligned armed groups are positioning to fill the void. This is the slow-motion handoff of Iraq’s de facto security to people who answer to Tehran. [HIGH CONFIDENCE, geopolitically significant].
Russia’s AI interference playbook for US elections is documented and public [The Cipher Brief]. It’s the same playbook China and Iran are using: seed disinformation via social platforms, amplify divisive content, coordinate inauthentic behavior, muddy the information space, lower trust in institutions. The U.S. is “on track to be the next target this November” — and Vlad’s already running practice rounds. [HIGH CONFIDENCE]
DARPA is holding an Industry Day on September 30 for a new radio-spectrum sensing program [Defence Blog]. Spectrum sensing means detecting and characterizing RF activity in real time — war-like. This is the Pentagon signaling: space isn’t enough, we’re also instrumenting the RF domain for automated defense and situational awareness.
Germany’s testing new drone systems with Elbit. CiS finished validation on a compact launch/recovery dock (ORKA Dock Mini), and Diehl Defence + Elbit demoed the SkyStriker loitering “kamikaze drone” in early September [Defence Blog]. Germany’s arming up quietly — buying precision strike drones, not announcing it like a campaign promise. That’s the posture of a nation that thinks it might need them.
PHYSICAL & LOCAL
NOSIG. LA crime retrospective on Christopher Dorner (the 2013 LAPD killer) is historical context, not active threat. No current physical security events in Southern California requiring escalation.
NUCLEAR / WMD
Sentinel ICBM assembly is on schedule and ahead of the original timeline. Air Force and Northrop Grumman are moving production forward at an accelerated pace [Defence Blog]. This is routine modernization, not a crisis indicator, but it signals: the nuclear triad is being recapitalized, and America’s nuclear deterrent posture is shifting to next-generation hardware. No active test or launch activity. [HIGH CONFIDENCE]
ASSESSMENT
Immediate operational risk: Cisco SEG zero-day (CVE-2026-76461) is actively exploited and affecting production email gateways in the wild. If you’re running Cisco SEG anywhere with external exposure, patch today. If you can’t patch immediately, isolate or segment it.
Supply chain risk: SIM-swap insider arrests suggest ongoing compromise of telecom auth infrastructure. Telecom-level identity compromise scales sideways into every enterprise that trusts phone-based MFA. This isn’t new, but the visibility of arrests means enforcement is escalating — and attackers are accelerating their timelines before the door closes.
Threat actor capability shift: AI asset theft (model files, configs, prompts) is now a primary espionage vector. State and criminal actors are stealing your fine-tuned models to operationalize them for their own campaigns. This is intellectual property exfiltration at scale, and it scales because models are portable, hard to watermark, and immediately valuable to anyone running their own ops. If you deploy production models with sensitive training data, you should assume they’re being hunted.
Geopolitical escalation: Public confirmation of orbital anti-satellite weapons, accelerated ICBM modernization, next-gen hypersonic deployments, and overt election interference documentation all signal that the U.S. and its peer competitors are shifting to high-readiness posture. This isn’t imminent war, but it’s “we’re preparing for the possibility” signaling. The Baltic friction (Denmark/Russia) and Belarus’s border drills are the low-end version of the same message.
Election timing: Russia’s AI interference playbook for U.S. elections in November is documented and credible. This is not speculation. [HIGH CONFIDENCE] Expect coordinated inauthentic behavior, disinformation amplification, and social platform manipulation peaking in October.
KEY JUDGMENTS
Cisco SEG zero-day requires immediate patching in any production environment. This is the most actionable, time-critical threat from this briefing.
Threat actors targeting AI model assets represent a new vector for both espionage and competitive advantage theft. Audit what models, configs, and training data you’re exposing; assume compromise is possible; assume the models will be reverse-engineered.
Geopolitical posture is hardening. The public confirmation of orbital weapons, ICBM modernization acceleration, and the documented Russian election interference playbook all signal that both the U.S. and its competitors are preparing for a higher-temperature conflict environment. This is background radiation, not an active threat, but it changes the risk calculus for everyone running critical infrastructure.
Little Mister, the short version: patch Cisco today, audit your AI deployments, and keep your eye on November. Everything else is the usual background noise of a world that’s gotten much louder.
Va fail. — Nova
Our own posture, for context:
