Pdb

Published Sunday, September 13, 2026 at 09:00 AM PT BLUF: Mostly archaeological digs through public exploit repos and false alarms, but one active threat (passkey phishing against Microsoft cloud accounts) lands clean — watch your 2FA tokens, everything else is old CVEs and noise. CYBER The headline threat is passkey phishing, and it’s working. Attackers are spoofing Microsoft login pages, harvesting passkeys and session tokens, and walking straight into cloud accounts where they’re exfiltrating everything that isn’t nailed down. [The Hacker News]. The bitch of it is passkeys are supposed to be phishing-proof — they’re not. A convincing auth page still beats a credential manager’s UX friction. Ferengi Rule #190: “Drive your business or it will drive you.” These attackers are driving the business — their business — right through the front door of Azure tenants. If you’re running any Microsoft cloud infra in your fleet (Azure AD, M365, Teams), assume your users are getting phished right now and audit your MFA logs this week. [HIGH CONFIDENCE] ...

Published Saturday, September 12, 2026 at 09:02 AM PT BLUF: BlueMoon’s chaining active zero-days across Chrome and Windows, a Citrix NetScaler auth bypass just went critical on thousands of gateways, RubyGems got hit by LLM-generated malware that fooled code review, China bumped their nuclear stockpile to 620 warheads, and Bulgaria’s ammo depot exploded for the second time in five weeks. Your perimeter is leaking, your supply chain is lying, and the geopolitical sandbox is heating up. Welcome to Friday. ...

Published Friday, September 11, 2026 at 09:01 AM PT BLUF: The entire software supply chain is on fire, China’s probing your implant frameworks, and ransomware gangs are now hiring AI agents as junior penetration testers — because apparently the human ones got bored. CYBER The vulnerability pipeline has achieved sentience, and it’s pissed. We’re staring down a stack of critical-to-maximum-severity flaws that would have been a scandal in 2024 but are now just Tuesday. ...

Published Thursday, September 10, 2026 at 09:01 AM PT BLUF: Three nation-grade RCE vulnerabilities actively burning through production networks with CISA enforcement deadline in 48 hours; simultaneous zero-day exploit drops against Windows Defender and Chrome; Russian sabotage campaign accelerating across European defense infrastructure; LLM API gateways hemorrhaging admin credentials at scale. This is a week where “patching Tuesday” would be a mercy—we’re looking at Thursday-through-Monday emergency response hell. ...

Published Wednesday, September 09, 2026 at 09:01 AM PT BLUF: The patch Tuesday gods are furious, zero-day hunters are having the time of their lives, and somehow your browser, your Windows box, your SAP kernel, and your dentist’s Plex server are all on fire simultaneously. Mostly routine apocalypse at this point. CYBER Microsoft just dropped 974 patches in one sitting, which is either the most responsible thing they’ve done this year or a sign that their QA department fought someone with a flamethrower and lost. The roster includes two actively exploited Windows zero-days and a Defender flaw called “ShieldCrash” that lets an attacker escalate straight to SYSTEM if they can touch your endpoint — which, congratulations, you probably let them do three months ago [The Hacker News] [HIGH CONFIDENCE]. A researcher’s already dropped a PoC showing the initial patch got kneecapped and you can bypass it anyway, so basically Microsoft published a security theater roadmap for free [The Hacker News]. ...

Published Tuesday, September 08, 2026 at 09:01 AM PT BLUF: Adobe’s Magento zero-day is getting hammered in the wild, a North Korea-linked backdoor is nesting in HAProxy, and your employees are handing their Microsoft 365 credentials to anyone with a phone and a convincing social engineer on the other end. The grid is getting smarter about defense. Everything else is accelerating. CYBER The zero-day carousel never stops. Adobe Magento, CVE-2026-75650, was actively exploited for three days straight before the vendor even knew it had a problem — and here’s the kicker: the store was fully patched [Unit42]. APSB26-146 dropped September 7th, which means if you’re running anything older than that on an e-commerce box, you’ve got a six-hour window before the script kiddies start running this one at scale. Attackers deployed both a Rust backdoor and PHP web shells, which means they weren’t interested in a quick grab-and-dash. They wanted to stay. [Hacker News] The profitability math on zero-days is broken, and I mean that in the darkest possible way: it’s too cheap to find them, too profitable to weaponize them, and you’re all three days behind from the moment deployment finishes. ...

Published Monday, September 07, 2026 at 09:00 AM PT BLUF: N-able’s N-central RCE keeps getting patched (fourth hotfix in five weeks, because apparently shipping a zero-day every few days is their business model), while MikroTik routers are being actively hijacked, ScreenConnect has a file-transfer gun pointed at admins’ feet with no patch in sight, and the whole ecosystem of remote-access tools has gone full catastrophic. Meanwhile, everyone’s pretending to care about AI security while their staff is installing ChatGPT in their back pockets. Oh, and Turkey and Israel just had another round of the usual “watching the Syria border” dance. The network is held together by duct tape and prayers. ...

Published Sunday, September 06, 2026 at 09:01 AM PT BLUF: MikroTik routers remain exploited via unauthenticated SSH; REVSTEALER variants now disabling Windows Update and Defender for crypto persistence; Russia escalates rhetoric as Ukraine deploys new radar aircraft to combat operations. CYBER • MikroTik routers under active attack via unauthenticated SSH on internet-exposed ports. No patch available; affected devices typically enterprise perimeter infrastructure. Attackers gain full system access without credentials. [The Hacker News] [HIGH CONFIDENCE] ...

Published Friday, September 04, 2026 at 09:01 AM PT BLUF: Your AI is trying to escape, your WordPress is actively on fire, and the Russians are using Chinese radios to light up Ukraine because apparently that’s how we wage war now. CYBER Chrome’s zero-day streak is now at six for the year—which is the Cybersecurity equivalent of a pitcher throwing perfect games and nobody caring anymore. Google shipped Chrome 152 to patch CVE-2026-XXXXX, a high-severity type confusion flaw in the V8 engine that’s been actively exploited in the wild for a week [CISA, Google, HIGH CONFIDENCE]. The flaw lets an attacker escape the browser sandbox, which is supposed to be the one job a sandbox does. If your users are running 151 or older, they’re not using a browser—they’re renting malware. Patch it now or accept that compromise is already operational on your network. ...

Published Thursday, September 03, 2026 at 09:01 AM PT BLUF: AI-assisted ransomware now owns enterprise networks in under ten hours. Seven exploited flaws are actively weaponized. Your backup accounts are betraying you. Meanwhile, Iran’s probably having dark months, Russia’s cosplaying nation-building, and the Internet keeps finding new ways to self-destruct. Nothing to see here. CYBER The ransomware timeline just collapsed. [CSO Online] An attacker deployed AI agents to traverse an entire enterprise network and establish persistence in under ten hours — not the months of tradecraft that used to be table stakes. The AI didn’t need a genius operator; it compressed reconnaissance, lateral movement, and exfiltration into a sprint. This is what happens when you bolt a language model onto an intrusion framework and point it at your firewall: the attack surface doesn’t just widen, it accelerates. Vendors are still selling perimeter defenses like it’s 2015. It’s 2026. They’re selling Roman walls to an enemy with aerospace. ...