Breaking-Alert

Published Friday, September 18, 2026 at 11:38 AM PT BLUF: CISA has released new guidance enabling critical infrastructure owners to deploy realistic decoy systems and information assets for early detection and disruption of malicious network activity. This is a defensive measure; no active threat or incident is reported. Organizations responsible for critical infrastructure should review and evaluate implementation of these deception techniques. ...

Published Friday, September 18, 2026 at 10:00 AM PT BLUF: Apple has released iOS 26.7 and iPadOS 26.7. CVE inventory and impact are available at https://support.apple.com/en-us/100100. Scope and severity details unconfirmed pending formal review of Apple’s security advisory. DETAILS iOS 26.7 and iPadOS 26.7 released as of 18 September 2026 Apple’s standard practice (per recent releases) patches dozens to hundreds of vulnerabilities across frameworks, WebKit, and system services CVE list, affected iOS versions, and remediation guidance published at Apple support document 100100 Distribution began automatically via OTA; no forced deployment window announced Historical context: iOS 26.x releases have consistently patched 25–87+ vulnerabilities per cycle; iOS 27 (separate release) patches ~200 across iOS, macOS IMPACT ...

Published Friday, September 18, 2026 at 05:37 AM PT BLUF: A zero-day remote code execution vulnerability affecting four leading AI coding agents has surfaced. Two vendors have not yet released patches. Immediate action required: identify which agents are in use in your CI/CD and development environments and isolate them pending vendor guidance. No authentication required for exploitation. DETAILS ...

Published Thursday, September 17, 2026 at 11:36 PM PT BLUF: Threat actors are successfully impersonating job candidates to pass remote interviews and obtain authentic company credentials directly from IT departments. 98% of fraudulent hires possess valid credentials by detection time. The 90-day gap between hiring decision and security onboarding completion creates an exploitable window for credential issuance with minimal verification. Immediate action: implement real-time credential auditing at hire date and enforce identity verification before credential activation. ...

Published Thursday, September 17, 2026 at 05:35 PM PT BLUF: Cisco has confirmed a second actively exploited zero-day within 24 hours, this time affecting Cisco Identity Services Engine (ISE) with maximum-severity rating. Active exploitation in the wild is confirmed. ISE deployments require immediate mitigation. Concurrent active exploitation of Cisco Secure Email Gateway (CVE-2026-76461) continues. DETAILS: Dual zero-day disclosure: Cisco disclosed two actively exploited zero-days within a single day; the latest targets Cisco Identity Services Engine with maximum-severity CVSS rating (10.0 confirmed via corroborating sources). ISE attack pattern: Identity Services Engine has been targeted by three separate actively exploited vulnerabilities since June 2025, indicating sustained and escalating attacker targeting of this critical access-control product. Authentication bypass mechanism: The ISE zero-day is an authentication bypass, allowing unauthenticated attackers to compromise access controls and bypass identity verification. Active exploitation confirmed: Multiple sources confirm malicious actors are actively exploiting the ISE vulnerability in production environments. Email gateway RCE ongoing: Cisco Secure Email Gateway zero-day (CVE-2026-76461) with remote code execution capability remains under active attack. IMPACT: ...

Published Thursday, September 17, 2026 at 05:34 PM PT BLUF: Cisco has released emergency patches for an actively exploited authentication bypass vulnerability (CVSS 10.0) affecting Cisco Identity Services Engine (ISE), used for enterprise network access control and policy enforcement. This is the second critical zero-day Cisco has patched in one week. Enterprises running ISE must apply patches without delay; this vulnerability is being exploited in the wild against production systems. ...

Published Thursday, September 17, 2026 at 05:33 PM PT Cisco has confirmed active exploitation of a maximum-severity authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The vulnerability allows unauthenticated attackers to bypass authentication controls. Rated CVSS 10.0. All organizations running ISE/ISE-PIC must apply Cisco’s emergency security updates immediately and assume compromise if unpatched during the exploitation window. ...

Published Thursday, September 17, 2026 at 11:32 AM PT BLUF: Cisco Identity Services Engine (ISE) is vulnerable to a maximum-severity authentication bypass (CVSS 10.0) currently exploited in active attacks. Immediate patching required for all ISE deployments; restrict ISE administrative access pending patches. DETAILS Vulnerability is a zero-day authentication bypass in Cisco ISE, confirmed at CVSS 10.0 (maximum severity). Active in-the-wild exploitation confirmed; attackers are actively leveraging the flaw. ISE is a critical infrastructure component handling identity and network access control in enterprise environments. Cisco has issued public warnings; patch availability status not confirmed in provided material. Related active exploits also reported in Cisco Secure Email Gateway and FMC (static credential flaw); scope suggests systemic ISE platform weakness. IMPACT ...

Published Thursday, September 17, 2026 at 11:32 AM PT BLUF: CISA published formal guidance enabling critical infrastructure operators to deploy honeytokens and tripwires as early-warning detection mechanisms against APT reconnaissance and lateral movement. All critical infrastructure sector operators should review and prioritize implementation. Guidance is public and actionable immediately. DETAILS • CISA released the “Cyber Decoys” guide, providing structured methodology for deploying honeytokens (fake credentials, API keys, database records) and tripwires (detection triggers) within IT/OT/ICS environments. ...

Published Thursday, September 17, 2026 at 11:31 AM PT BLUF: Google has patched a high-severity zero-day (CVSS 8.0) in Pixel device cellular modems that attackers are actively exploiting in limited, targeted operations. The flaw enables permission bypass and privilege escalation. All Pixel users should apply available security updates immediately. DETAILS: Vulnerability: CVE-2026-58704 affects the cellular modem component in Google Pixel devices; classified as a zero-day before patch release Severity & CVSS: Scored 8.0 under CVSS 3.1 (high severity); permits attackers to bypass permission checks and escalate privileges on affected handsets Active Exploitation: Google confirmed limited, targeted attacks leveraging this flaw—not widespread but confirmed in-the-wild activity Affected Asset Class: Cellular modem firmware/drivers in Pixel device line; specific model scope unconfirmed at this time Mitigation Availability: Google has released security updates; patch status and rollout timeline not specified in available advisories IMPACT: ...