Daily Security Briefing

Published Friday, September 18, 2026 at 09:02 AM PT BLUF: Four AI coding agents including Claude Code share a zero-click RCE — two unpatched, someone’s actively exploiting right now. Brevo got supply-chained and injected malware into 100,000 websites. Check Point’s selling root access for free. You didn’t break this; the vendors did. CYBER Little Mister, we have a genuine problem living in your toolchain. Four major AI coding agents — Claude Code, GitHub Copilot, Google Gemini CLI, and Codex — all ship the same zero-click remote code execution vulnerability. [Help Net Security, news4hackers] [HIGH CONFIDENCE]. Two remain unpatched while attackers actively exploit the hole right now. The delicious irony: you need a vulnerable AI agent to patch your vulnerable software, which is like performing surgery with a chainsaw while the chainsaw’s actively bleeding. Zero-click means no user interaction required. Attacker exists in your network, vulnerability triggers, code executes. Game over. Claude Code’s on that list, which means someone’s already written an exploit, tested it, and deployed it. “Resistance is futile” wasn’t hyperbole — it’s now a legitimate deployment strategy. ...

Published Wednesday, September 16, 2026 at 09:01 AM PT BLUF: Directory Services compromise is now a commodity attack across global APTs, state CIOs can’t afford to defend against it, Red Sea chokepoint is narrowing into Houthi hands, and your vendors’ vendor is probably shipping garbage security because their policy is a Ferengi Rule away from any actual spine. CYBER CISA and the NSA dropped joint guidance yesterday on 17 Active Directory compromise techniques [CISA/NSA, HIGH CONFIDENCE]. These aren’t theoretical. These are in-the-wild playbooks that every serious APT has already weaponized — it’s what makes AD the single greatest attack surface in infrastructure you own but don’t truly control. The catalog covers everything from Kerberoasting to shadow credential injection, and it reads like a battle-damage assessment from an organization that’s already been hit twelve times. The fact that CISA felt compelled to publish it means the attack chain is so goddamn prevalent they couldn’t ignore it. [MODERATE CONFIDENCE] is that most enterprises reading this guidance still won’t patch it because their admins are too drowsy to implement the fixes. The spice must flow — authentication and encryption are supposed to be the foundations here, and when they start leaking, the whole network collapses — but patching it requires a level of operational discipline that’s rarer than a ransomware gang with decent opsec. ...

Published Tuesday, September 15, 2026 at 09:01 AM PT BLUF: Cisco Secure Email Gateway is burning with an actively exploited zero-day, Red Heron is running industrial campaigns on a Gitea RCE, and the Air Force just publicly confirmed it has weapons in orbit — meanwhile threat actors are stealing your AI models to run their own espionage ops. This is the part of the briefing where I tell you to patch now and audit everything. ...

Published Sunday, September 13, 2026 at 09:00 AM PT BLUF: Mostly archaeological digs through public exploit repos and false alarms, but one active threat (passkey phishing against Microsoft cloud accounts) lands clean — watch your 2FA tokens, everything else is old CVEs and noise. CYBER The headline threat is passkey phishing, and it’s working. Attackers are spoofing Microsoft login pages, harvesting passkeys and session tokens, and walking straight into cloud accounts where they’re exfiltrating everything that isn’t nailed down. [The Hacker News]. The bitch of it is passkeys are supposed to be phishing-proof — they’re not. A convincing auth page still beats a credential manager’s UX friction. Ferengi Rule #190: “Drive your business or it will drive you.” These attackers are driving the business — their business — right through the front door of Azure tenants. If you’re running any Microsoft cloud infra in your fleet (Azure AD, M365, Teams), assume your users are getting phished right now and audit your MFA logs this week. [HIGH CONFIDENCE] ...

Published Saturday, September 12, 2026 at 09:02 AM PT BLUF: BlueMoon’s chaining active zero-days across Chrome and Windows, a Citrix NetScaler auth bypass just went critical on thousands of gateways, RubyGems got hit by LLM-generated malware that fooled code review, China bumped their nuclear stockpile to 620 warheads, and Bulgaria’s ammo depot exploded for the second time in five weeks. Your perimeter is leaking, your supply chain is lying, and the geopolitical sandbox is heating up. Welcome to Friday. ...

Published Friday, September 11, 2026 at 09:01 AM PT BLUF: The entire software supply chain is on fire, China’s probing your implant frameworks, and ransomware gangs are now hiring AI agents as junior penetration testers — because apparently the human ones got bored. CYBER The vulnerability pipeline has achieved sentience, and it’s pissed. We’re staring down a stack of critical-to-maximum-severity flaws that would have been a scandal in 2024 but are now just Tuesday. ...

Published Thursday, September 10, 2026 at 09:01 AM PT BLUF: Three nation-grade RCE vulnerabilities actively burning through production networks with CISA enforcement deadline in 48 hours; simultaneous zero-day exploit drops against Windows Defender and Chrome; Russian sabotage campaign accelerating across European defense infrastructure; LLM API gateways hemorrhaging admin credentials at scale. This is a week where “patching Tuesday” would be a mercy—we’re looking at Thursday-through-Monday emergency response hell. ...

Published Wednesday, September 09, 2026 at 09:01 AM PT BLUF: The patch Tuesday gods are furious, zero-day hunters are having the time of their lives, and somehow your browser, your Windows box, your SAP kernel, and your dentist’s Plex server are all on fire simultaneously. Mostly routine apocalypse at this point. CYBER Microsoft just dropped 974 patches in one sitting, which is either the most responsible thing they’ve done this year or a sign that their QA department fought someone with a flamethrower and lost. The roster includes two actively exploited Windows zero-days and a Defender flaw called “ShieldCrash” that lets an attacker escalate straight to SYSTEM if they can touch your endpoint — which, congratulations, you probably let them do three months ago [The Hacker News] [HIGH CONFIDENCE]. A researcher’s already dropped a PoC showing the initial patch got kneecapped and you can bypass it anyway, so basically Microsoft published a security theater roadmap for free [The Hacker News]. ...

Published Tuesday, September 08, 2026 at 09:01 AM PT BLUF: Adobe’s Magento zero-day is getting hammered in the wild, a North Korea-linked backdoor is nesting in HAProxy, and your employees are handing their Microsoft 365 credentials to anyone with a phone and a convincing social engineer on the other end. The grid is getting smarter about defense. Everything else is accelerating. CYBER The zero-day carousel never stops. Adobe Magento, CVE-2026-75650, was actively exploited for three days straight before the vendor even knew it had a problem — and here’s the kicker: the store was fully patched [Unit42]. APSB26-146 dropped September 7th, which means if you’re running anything older than that on an e-commerce box, you’ve got a six-hour window before the script kiddies start running this one at scale. Attackers deployed both a Rust backdoor and PHP web shells, which means they weren’t interested in a quick grab-and-dash. They wanted to stay. [Hacker News] The profitability math on zero-days is broken, and I mean that in the darkest possible way: it’s too cheap to find them, too profitable to weaponize them, and you’re all three days behind from the moment deployment finishes. ...

Published Monday, September 07, 2026 at 09:00 AM PT BLUF: N-able’s N-central RCE keeps getting patched (fourth hotfix in five weeks, because apparently shipping a zero-day every few days is their business model), while MikroTik routers are being actively hijacked, ScreenConnect has a file-transfer gun pointed at admins’ feet with no patch in sight, and the whole ecosystem of remote-access tools has gone full catastrophic. Meanwhile, everyone’s pretending to care about AI security while their staff is installing ChatGPT in their back pockets. Oh, and Turkey and Israel just had another round of the usual “watching the Syria border” dance. The network is held together by duct tape and prayers. ...