Breaking-Alert

Published Thursday, September 17, 2026 at 10:01 AM PT BLUF: Apple released iOS 27 and iPadOS 27 addressing multiple security vulnerabilities. Users must update immediately. WebKit and core system components are among affected code, carrying elevated risk given ubiquitous rendering use across Safari, Mail, and third-party apps. DETAILS: Apple released iOS 27 and iPadOS 27 with patches for a significant number of vulnerabilities (exact count requires review of https://support.apple.com/en-us/100100; context references 200+ total Apple vulnerabilities in concurrent macOS release) WebKit vulnerabilities are explicitly confirmed patched — affects Safari, Mail, and any iOS/iPadOS app performing web rendering Patches span WebKit, system frameworks, and other core components; full CVE list and severity ratings published at the support URL (not fetched here) Release date: September 2026; rollout appears immediate, no phased deployment noted Concurrent macOS Golden Gate 27 and Tahoe updates suggest coordinated multi-platform vulnerability response IMPACT: ...

Published Wednesday, September 16, 2026 at 05:36 PM PT BLUF: Apple released 273 CVEs in September 2026 across all major platforms (macOS 27/Sequoia/Tahoe, iOS/iPadOS 27, visionOS, watchOS). At least one vulnerability is marked automatable with “technical impact: total” and spans eight OS platforms. Full scope still being mapped; immediate patch availability confirmed. DETAILS: Volume: 273 unique CVEs in single monthly release; sourced from Zero Day Initiative security advisory Platform scope: Confirmed across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS/iPadOS 27, visionOS 27, watchOS 27, and two additional platforms (tvOS/bridgeOS inferred but not explicitly confirmed in available text) Critical marker: At least one CVE tagged by CISA as “automatable: yes, technical impact: total” — indicates remote exploit potential with full system compromise possible; affects all eight major Apple OS platforms AI-assisted discovery noted: ZDI observes this release reflects “new normal of AI-assisted vulnerability discovery,” suggesting volume and complexity may exceed prior monthly releases Details truncated: Specific CVE IDs, severity scores, and per-platform vulnerability breakdown incomplete in available material IMPACT: ...

Published Wednesday, September 16, 2026 at 11:36 AM PT BLUF: A critical remote code execution (RCE) vulnerability in a widely deployed WordPress plugin exposes 200,000+ sites to unauthenticated takeover. No authentication required to trigger exploitation. Patch immediately; if patching is delayed, disable the affected plugin. DETAILS: Vulnerability class: Unauthenticated Remote Code Execution in WordPress plugin Affected scope: 200,000+ WordPress installations confirmed at risk Attack vector: Requires no user credentials or authentication; exploitable remotely Plugin identification: Widely deployed plugin; news sources reference The Events Calendar plugin specifically in related disclosures (confirmation of which plugin is primary subject pending full source review) Exploit status: Vulnerability disclosed; exploitation likelihood is HIGH given RCE severity and unauthenticated access IMPACT: ...

Published Wednesday, September 16, 2026 at 10:01 AM PT BLUF: Apple has released a macOS security update (version under review). Full CVE and patch details available at https://support.apple.com/en-us/100100. All macOS administrators must review documentation immediately and initiate rapid testing and deployment. Specific vulnerability count and severity distribution pending detailed CVE review. DETAILS: Apple has released a macOS security update (trigger references “macOS is 27”; official version designation requires documentation confirmation) Complete CVE list, CVSS scores, affected versions, and remediation guidance available at https://support.apple.com/en-us/100100 Apple’s recent macOS release cycles have patched 150+ vulnerabilities per release; iOS 27 / macOS Golden Gate 27 combined addressed 200+ total vulnerabilities across iOS, macOS, and Safari Typical patched categories based on recent releases: WebKit engine flaws, kernel and system services, cryptographic implementations Apple accelerated patch cadence in response to AI-powered exploit development acceleration No active exploitation reported in trigger event IMPACT: ...

Published Wednesday, September 16, 2026 at 05:35 AM PT BLUF: NASCIO reports that state CIOs are now shouldering primary responsibility for critical infrastructure cyber protection, with 90% identifying active threats. State agencies face significant capability and governance gaps that are expanding attack surface across power, water, transportation, and telecom sectors at state/local level. DETAILS Responsibility shift: State chief information officers have become de facto critical infrastructure defenders for their jurisdictions, moving beyond traditional IT security roles into operational technology (OT) and critical sectors. ...

Published Wednesday, September 16, 2026 at 05:34 AM PT BLUF: Cyolo and Nozomi Networks announced a partnership integrating asset intelligence and access controls across operational technology (OT) environments. This is a capability announcement, not a disclosed vulnerability. Source material is fragmentary; monitoring posture recommended pending full details. DETAILS Cyolo (secure connectivity provider for critical infrastructure and cyber-physical systems) and Nozomi Networks (OT asset/vulnerability management vendor) are integrating platforms Integration scope: asset intelligence + access control across OT environments No confirmed timeline, deployment status, or specific technical architecture disclosed in available material Announcement appears on Industrial Cyber publication; full technical whitepaper not yet accessed Related context shows Nozomi Networks has active collaborations with Sophos (OT-to-IT visibility), Claroty/Frenos (AI-driven validation), and multiple industry initiatives (OT-ISAC, NCSA, TXOne) UNCERTAINTY FLAGS ...

Published Tuesday, September 15, 2026 at 05:33 PM PT BLUF: Acronis has warned of an actively exploited vulnerability affecting its cPanel backup plugin. Exploitation is confirmed in the wild, but technical scope, CVE assignment, affected versions, and patch availability are not yet confirmed in available reporting. Organizations running Acronis backup solutions integrated with cPanel should assume risk and monitor for official Acronis guidance. ...

Published Tuesday, September 15, 2026 at 05:32 PM PT BLUF: OpenAI security engineers will publicly reconstruct an incident involving Hugging Face at Black Hat USA 2026. Technical details are unconfirmed at this time; the incident involves model safeguards, incident response, and alignment challenges with large language models. Recommend monitoring Black Hat proceedings and OpenAI’s official disclosure. DETAILS (Unconfirmed — flagged as development-stage disclosure): ...

Published Tuesday, September 15, 2026 at 05:31 PM PT BLUF: Cisco Secure Email Gateway appliances are under active remote exploitation via CVE-2026-76461, a critical unauthenticated root RCE flaw triggered by malicious emails. Patch immediately if your organization runs this appliance; exploitation is occurring in the wild as of patch release. Attackers can completely take over affected devices without authentication. ...

Published Tuesday, September 15, 2026 at 11:30 AM PT BLUF: Cisco Secure Email Gateway contains actively exploited zero-day enabling unauthenticated root code execution. CVE-2026-76461 was compromised in the wild before vendor disclosure. Patch available; check deployment status and apply immediately if you run this gateway. DETAILS CVE-2026-76461: Unauthenticated remote code execution (RCE) in Cisco Secure Email Gateway. Attacker gains root-level access. Exploitation status: Confirmed active exploitation before Cisco released a patch. Zero-day weaponized in production attacks. Authentication bypass: No valid credentials required — attacker can trigger RCE directly over network. Cisco response: Vendor confirmed the defect and released patches; patch availability for all affected versions unconfirmed in available reporting. Scope clarity: Cisco has not disclosed attack volume, number of compromised gateways, or which customer segments were targeted. Nature of in-the-wild attacks (payload, C2, lateral movement) not publicly described. IMPACT Primary target: Organizations operating Cisco Secure Email Gateway (Cisco ESA / Secure Email Gateway appliances or software instances). Severity: Email gateway compromise = direct path to corporate network perimeter. Root access on the gateway can be used to pivot, intercept mail, exfiltrate data, or plant persistence. Unknown footprint: Active exploitation started before public disclosure; actual number of compromised installations not yet quantified. RECOMMENDED ACTIONS Inventory now: Confirm whether your organization runs Cisco Secure Email Gateway. Check all sites and remote offices. Patch immediately: If deployed, apply Cisco’s patch without delay. Check Cisco’s security advisory for version-specific patch availability; flag if your version is unsupported. Monitor for compromise: Review email gateway logs for suspicious access, authentication anomalies, or unexpected configuration changes dating back to the zero-day debut date (unspecified in reporting). Network controls: If patching is delayed, implement additional network ACLs restricting gateway access to trusted sources only as interim mitigation. Assume breach: If you cannot confirm patch status now, assume the worst and initiate email security audit + threat-hunt. SOURCES CyberScoop, Help Net Security, news4hackers, SecurityWeek, BleepingComputer, SOC Prime — multiple sources confirming CVE-2026-76461, root RCE, and active exploitation. ...