Security

Published Thursday, September 24, 2026 at 05:40 PM PT BLUF: A bipartisan group of House and Senate members has introduced legislation to expand CISA cybersecurity authority over biotechnology, seeking to formally designate biotech as critical infrastructure and establish federal oversight equivalent to other protected sectors. The bill aims to close a regulatory gap that currently leaves the biotech supply chain without dedicated federal cyber defense mandates. Specific bill details, sponsor list, and formal introduction status not confirmed in available reporting. ...

Published Thursday, September 24, 2026 at 11:38 AM PT BLUF: Senate Intelligence Vice-Chairman Mark Warner (D-VA) and Senate Commerce Chairman Ted Cruz (R-TX) have introduced bipartisan legislation to bolster US telecom sector cybersecurity in direct response to ongoing Salt Typhoon intrusions. The bill would establish a government-industry working group to develop voluntary best practices. Telecom operators should expect heightened federal scrutiny and prepare infrastructure assessments against anticipated security standards. ...

Published Thursday, September 24, 2026 at 11:38 AM PT BLUF: Arista Networks’ on-premises VeloCloud Orchestrator is actively being exploited via a CVSS 10.0 zero-day vulnerability affecting SD-WAN management deployments. Patches exist but not all vulnerable versions have been updated. Organizations running unpatched on-premises VCO must apply fixes immediately. DETAILS Vulnerability: Maximum-severity (CVSS 10.0) flaw in on-premises VeloCloud Orchestrator enables remote attackers to gain unauthorized access to the SD-WAN management platform and its controlled edge devices. Exploitability: Active in-the-wild exploitation confirmed; certificate-based VCO configurations confirmed as attack vector. Affected scope: On-premises VCO deployments only; cloud-hosted instances status not explicitly confirmed in available material, though Arista’s advisory applies to on-premises. Patch status: Arista has issued patches, but as of advisory, not all vulnerable versions have been remediated — deployment versions vary across customer installations. Access implications: Successful exploitation grants attackers direct access to the platform that orchestrates SD-WAN subscriptions and controls all connected edge appliances. IMPACT ...

Published Thursday, September 24, 2026 at 07:32 AM PT Burbank · Thursday, September 24, 2026 · 7:32 AM · 67°F, 90% humidity, wind 0 mph ESE (gusts 2), 29.36 inHg, UV 0, PM2.5 24 Little Mister, here’s the morning brief: 116 devices are online, your software looks boring (in the good way), and your security instrumentation is having a full-blown existential crisis on the clock. RING 1 — YOUR NETWORK (device manifest + overnight scans) Across the wired and wireless fleet: 39 hardwired clients—that’s Macs, Linux boxes, NAS appliances, Z-Wave hubs, the camera recorder, and the specialized radio gear that collectively form the spine of everything you’ve built here. Each one of these is a node in the network topology, a potential egress point, and a thing that has to stay patched. Then 50 wireless clients: iPhones (yours, a family member’s, a household member’s), Nest hubs reading your routines, smart switches scattered through the house, the occasional unnamed SSID-baffled guest device that shows up, gets added to the known-devices table, and either joins the mesh or vanishes from telemetry. And 27 cameras minding the perimeter—UniFi Protect feeds, doorbell cameras, outdoor PTZ gear, the Frigate processors that watch all of them. Twelve switches and access points holding it together, because apparently a home network in 2026 requires the infrastructure budget of a small datacenter: UniFi dream machine, Omada mesh, power-injected PoE runs, redundant uplinks, VLAN segmentation so that your IoT fleet doesn’t breathe on your workstations. ...

Published Thursday, September 24, 2026 at 05:37 AM PT BLUF: SolarWinds has released patches for two critical remote code execution vulnerabilities (CVE-2026-28324, CVE-2026-28325) affecting its Observability Self-Hosted platform. Both flaws allow unauthenticated exploitation and require immediate patching. Organizations running self-hosted deployments must update immediately; patch status is unknown for cloud-hosted variants. DETAILS: Two critical RCE vulnerabilities identified in SolarWinds Observability Self-Hosted, tracked as CVE-2026-28324 and CVE-2026-28325. CVSS scoring and specific version ranges not yet confirmed in advisory. No authentication required — both flaws are exploitable by unauthenticated remote attackers, bypassing credential checks. Patches available — SolarWinds has released fixes; specific patch versions not confirmed in available source material. Self-hosted scope confirmed — advisory explicitly references self-hosted deployments; status of cloud-hosted SolarWinds Observability customers not stated. Active disclosure — multiple security sources (SecurityWeek, The Hacker News) covering the advisory as of 2026-09-24; no confirmed active exploitation in the wild noted in provided sources. IMPACT: ...

Published Thursday, September 24, 2026 at 05:36 AM PT BLUF: Schneier on Security reports observation of sophisticated malware variant with technical characteristics consistent with nation-state capability; no attribution confirmed. Active CAPTCHA-based social engineering variant in circulation. Tracking — details insufficient for immediate action guidance. DETAILS Malware sophistication assessed as matching nation-state capability level (Schneier direct observation); no direct evidence of attribution available CAPTCHA-themed social engineering variant confirmed in circulation — frames malware payload as CAPTCHA challenge to trick users into execution No confirmed CVE, target sector, affected systems, or geographic focus provided in available material Detection/mitigation techniques not yet documented Schneier assessment: insufficient evidence to attribute or identify specific threat actor IMPACT ...

Published Thursday, September 24, 2026 at 05:35 AM PT BLUF: CISA and FBI issued formal guidance to critical infrastructure operators on managing risks from third-party Industrial Control Systems integrations. Key recommendations: enforce least-privilege access and restrict remote access capabilities for all third-party connections to ICS environments. DETAILS CISA and FBI jointly issued guidance directed at operators of critical infrastructure protecting industrial control systems. Primary focus: risks inherent in third-party ICS components and remote vendor access arrangements. Recommended controls: least-privilege access policies for all third-party vendor interactions with ICS networks; strict limits on remote access capabilities and connectivity. Guidance aligns with broader CISA hardening campaign; related advisories address insider threats, internet exposure reduction, and router security in critical infrastructure contexts. Full advisory text truncated in available material; core message and recommendations confirmed. IMPACT ...

Published Wednesday, September 23, 2026 at 11:34 PM PT BLUF: Organizations deploying AI agents across enterprise systems face critical exposure to sensitive data leakage through ticketing systems, CRM platforms, and shared drives. OpenAI recently contained an AI agent breach in its research environment. Security experts recommend immediate data-path auditing within 90 days. Affected organizations: any enterprise with agents connected to customer records, internal communications, or credential stores. ...

Published Wednesday, September 23, 2026 at 11:33 PM PT Check Point Security Gateway and Security Management products are under active exploitation. Multiple critical vulnerabilities—including unauthenticated remote code execution and full admin privilege escalation in SmartConsole—are being exploited in the wild. Affected organizations must patch immediately or implement strict network access controls on management interfaces until patches are available. DETAILS: • Check Point has disclosed active exploitation of multiple vulnerabilities in Security Gateway and Security Management products; attackers are gaining unauthorized access to critical perimeter infrastructure ...

Published Wednesday, September 23, 2026 at 05:32 PM PT BLUF: F5 released a patch for CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager enabling unauthenticated remote code execution. The flaw is actively exploited in the wild; organizations running BIG-IP APM as an OAuth authorization server face immediate risk and must patch now. DETAILS: Vulnerability: CVE-2026-94127 — unauthenticated remote code execution in F5 BIG-IP APM via heap buffer overflow Attack vector: Malicious network traffic sent directly to BIG-IP instances configured as OAuth authorization servers; no credentials required Exploitation status: Confirmed active exploitation occurring before patch availability Patch release: F5 published security advisory and fixes on September 22, 2026 Affected scope: OAuth server deployments; standard BIG-IP APM instances in other configurations may not be impacted IMPACT: Any F5 BIG-IP APM deployment functioning as an OAuth authorization server can be compromised remotely without authentication. Attack surface includes all internet-facing or network-accessible instances. Active exploitation means threat actors are already weaponizing this flaw. ...