IMPRIMIS CYBER INTELLIGENCE
WEEKLY INTELLIGENCE BRIEF — SEPTEMBER 14 - SEPTEMBER 21, 2026 — UNCLASSIFIED
Orville Erickson — Senior Cyber Security Analyst, Imprimis Inc.
UNCLASSIFIED — FOR OFFICIAL DISTRIBUTION
CRITICAL · 6REGULATORY · 4PLATFORM · 7THREAT · 5BREACH · 3
EXECUTIVE SUMMARY
The week to 21 September was defined by the identity and virtualization layers, and by how little time anyone was given to fix them. Cisco shipped an emergency patch for CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that grants unauthenticated access to the console governing who may join the network at all, with successful exploitation capable of yielding command execution as root; it was the second actively exploited Cisco zero-day in as many days and entered the Known Exploited Vulnerabilities catalog on 16 September with a three-day deadline. CISA added three entries across two updates in the window, and every one of them carried a three-day clock: the Cisco flaw and an Acronis backup-plugin privilege escalation on 16 September, and a Linux kernel kernel-TLS flaw on 18 September due 21 September. Separately CISA reported that ransomware operators have joined the campaign against the VMware vCenter directory-traversal flaw patched in July, converting what had been quiet persistence activity into encryption events against the hypervisor management plane. Google patched a Pixel cellular-modem zero-day exploited without any user interaction, and Microsoft spent the week undoing its own record patch cycle, shipping eleven out-of-band updates on 14 September after the 8 September rollup broke Remote Desktop Services, Hyper-V folder shares and USB audio. Oracle closed more than eight hundred flaws in its quarterly update with one already exploited, SolarWinds removed a hard-coded key from Access Rights Manager that allowed unauthenticated remote code execution, Docker fixed a sandbox escape reaching the macOS host, and CISA published seven industrial advisories covering Schneider Electric, Mitsubishi Electric, Hitachi Energy and ABB. On the regulatory side CISA announced it will retire the weekly Vulnerability Bulletin on 28 September, completing the pivot to the risk-based prioritization model that produced this week of three-day deadlines, and Spain data protection authority logged what it describes as the first breach notification involving an autonomous artificial intelligence agent. Threat reporting covered an Iranian surveillance implant named in a joint United Kingdom, United States and Netherlands advisory, a federal investigation into attacks on internet-exposed controllers at water utilities in at least twelve states, and malware that carries a local language model to rewrite itself. The week theme is narrow and uncomfortable: the control plane for identity, for virtualization and for backup all came under fire at once, and the remediation windows are now shorter than most change-approval processes.
CRITICAL (6)
1. CISA Adds Three Exploited Vulnerabilities Across Two Updates, Every One Carrying a Three-Day Deadline
Technical Scope
CISA issued two Known Exploited Vulnerabilities catalog updates inside the reporting window. On 16 September it added CVE-2026-76460, a Cisco Identity Services Engine incorrect use of privileged APIs flaw, and CVE-2026-87886, an Acronis Backup incorrect default permissions flaw, both with a 19 September remediation deadline for federal civilian agencies. On 18 September it added CVE-2025-39682, a Linux kernel improper check for unusual or exceptional conditions flaw, with a 21 September deadline. A Google Pixel modem zero-day was also catalogued during the period.
Forensics / Compliance Impact
Three entries is a lighter week by count than the eleven logged a fortnight earlier, but the deadlines have not moved back out: every entry in this window gave three calendar days. The three affected products are an identity and network-access console, a backup agent and a kernel networking path, which means an organization matching this week catalog against its own estate is not checking its browser fleet but its authentication infrastructure, its backup tooling and its Linux server build. Any patch programme still measuring service levels in weeks is now roughly an order of magnitude slower than the benchmark its federal customers are held to.
2. CVE-2026-76460 — Cisco Identity Services Engine Authentication Bypass, CVSS 10.0, Emergency Patch After Confirmed Exploitation
Technical Scope
Cisco released emergency security updates for CVE-2026-76460, a maximum-severity flaw affecting Identity Services Engine and the ISE Passive Identity Connector, after confirming active exploitation in the wild. The vulnerability sits in an ISE API endpoint that does not enforce sufficient authentication controls, allowing an unauthenticated remote attacker to send a crafted request and bypass the web-based management interface without valid administrator credentials. Both products are affected regardless of configuration, and Cisco warns that successful exploitation may ultimately provide command execution as root. Fixed releases are ISE and ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11 and 3.1 Patch 12. It was the second actively exploited Cisco zero-day disclosed in as many days.
Forensics / Compliance Impact
Identity Services Engine is the system that decides which devices and users are permitted onto the network and with what level of access, so an authentication bypass against its own management interface inverts the entire access-control model: the arbiter of access becomes the thing with no access control. Root on that appliance means an attacker can author authorization policy, admit devices of their choosing and alter the records that would show they did so, which makes the surviving evidence of network admission unreliable for the exposure period. Organizations running ISE should treat patching as the first step only and follow it with a review of policy changes, administrative accounts and endpoint authorization decisions made before the fix landed.
3. CVE-2025-39682 — Linux Kernel kTLS Flaw Exploited for Root Escalation, Catalogued 18 September with a 21 September Deadline
Technical Scope
CISA added CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 18 September 2026 on evidence of active exploitation, giving federal civilian agencies until 21 September to remediate. The flaw carries a CVSS score of 9.8 and sits in the receive path of kernel TLS, in net/tls/tls_sw.c, where a crafted zero-length TLS record retrieved from the receive list can bypass intended record-type handling in recvmsg, producing memory corruption that has been used to obtain root-level privilege escalation. Kernel TLS offload is widely deployed on high-performance internet-facing Linux servers to accelerate network traffic processing, giving the flaw a broad attack surface.
Forensics / Compliance Impact
This is a vulnerability in a performance feature that most organizations did not consciously choose to enable, which is what makes it awkward to scope: the question is not whether kTLS was adopted as a design decision but whether the distribution kernel and the web or proxy tier turned it on by default. Because exploitation yields root on the host rather than access to a single application, any Linux server terminating TLS at volume should be treated as in scope until the kernel version is checked, and the remediation path is a kernel update and reboot rather than a service restart, which puts it squarely into planned-outage territory on a three-day clock.
4. Ransomware Operators Join the Campaign Against VMware vCenter Flaw CVE-2026-59310
Technical Scope
CISA warned during the week that ransomware gangs have begun exploiting CVE-2026-59310, a critical directory traversal vulnerability in the vCenter Syslog server that unauthenticated attackers can use to execute arbitrary code, carrying a CVSS score of 9.8. Broadcom addressed the flaw on 29 July 2026. Initial exploitation was attributed to actors deploying persistence tooling for long-term access, with one incident response firm reporting more than 361 IP addresses across 47 countries compromised by a suspected advanced persistent threat actor using a reverse SSH tool. CISA has now updated its catalog entry to flag the vulnerability as abused by ransomware operators and has directed agencies to secure vCenter systems within three days.
Forensics / Compliance Impact
The shift in this entry is not technical but economic: a flaw that espionage actors used quietly for months has been picked up by groups whose business model requires the victim to notice. vCenter is the management plane for the virtual estate, so an encryption event there does not take out one server but the ability to start, restore or even see every virtual machine underneath it, and organizations whose backup infrastructure is itself virtualized on the same cluster can lose the recovery path at the same moment as the production workload. Two months after a patch is available, exposure now means either an unpatched internet-reachable vCenter or an already-established foothold that patching will not remove.
5. CVE-2026-58704 — Google Pixel Cellular Modem Zero-Day Exploited in Targeted Zero-Click Attacks
Technical Scope
Google announced patches on 15 September 2026 for CVE-2026-58704, a privilege escalation flaw in the Pixel cellular modem described as a permission bypass caused by a logic error. Available scoring assigns an adjacent-network attack vector, low attack complexity, no required user interaction and high impact to confidentiality, integrity and availability. Google stated it is aware of limited, targeted exploitation, and reporting characterizes the flaw as exploitable without the device owner clicking a link or opening a file. The fix arrives with Pixel security patch level 2026-09-05 or later across all supported Pixel devices. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 16 September with a 19 September federal deadline.
Forensics / Compliance Impact
A modem-level flaw requiring no interaction removes the last control most mobile programmes actually rely on, which is user behaviour: there is no suspicious message to not open and no attachment to not download, so awareness training has no purchase on it. The adjacent-network vector points toward proximity-based or carrier-path delivery rather than mass internet scanning, which fits the limited and targeted exploitation Google describes and makes it a travel and executive-protection concern rather than a fleet-wide emergency. The practical question for an organization is narrower than it first appears: which corporate-owned or personally-owned Pixel devices carry programme communications, and can their patch level be confirmed rather than assumed.
6. CVE-2026-87886 — Acronis Backup Plugin Privilege Escalation Exploited Against cPanel and Plesk Hosting Servers
Technical Scope
Acronis confirmed exploitation in the wild of CVE-2026-87886, an incorrect default permissions flaw in Linux-based Acronis backup components rated CVSS 7.8. Affected files are created with world-readable and writable permissions, allowing any local user to read sensitive data or modify configuration associated with the backup process, and a low-privileged authenticated attacker can use the weakness to escalate access on a hosting server without user interaction. Observed exploitation targeted the Acronis Backup plugin for cPanel and WHM. The issue affects the cPanel and WHM plugin before build 1.9.3.1021, the Plesk extension before build 1.8.11.638 and the DirectAdmin plugin before build 1.2.3.238. CISA catalogued it on 16 September with a 19 September deadline.
Forensics / Compliance Impact
Backup agents are among the most privileged software on any server because their job is to read everything, so a file-permission defect in one hands a low-privileged local account the reach of the backup process itself. The exposure is sharpest in shared hosting, where "any local user" includes every other tenant on the box, but the same logic applies to any multi-user server: a foothold that would otherwise be contained to one unprivileged account becomes access to the data set the backup was protecting. Organizations should confirm plugin build numbers directly rather than trusting a hosting provider assurance, and treat the pre-patch period as a window in which backup-held data may have been readable.
REGULATORY (4)
1. CISA Will Retire the Weekly Vulnerability Bulletin on 28 September, Completing the Move to Risk-Based Prioritization
Technical Scope
CISA announced that it will discontinue the weekly Vulnerability Bulletin on 28 September 2026 as part of a shift away from severity-based vulnerability management toward a risk-based approach. The agency pointed to its June Binding Operational Directive setting out how covered federal civilian agencies should prioritize security updates using real-world factors rather than treating all vulnerabilities and systems equally. Existing bulletin subscribers are directed to select the Known Exploited Vulnerabilities Catalog and Cybersecurity Advisories subscription topics to continue receiving updates, and CISA points users to the catalog, its alerts and advisories, and vendor security notices for actionable information.
Forensics / Compliance Impact
A large number of organizations built their weekly patch triage around a government-published list, and that list is going away in a week, so the immediate task is unglamorous: change the subscription and re-point whatever process consumed it. The substantive change underneath is more consequential than the format change on top, because the replacement is not another list but a method, and a method demands that each organization decide for itself what is internet-reachable, what is confirmed exploited, what can be attacked automatically and what the attacker gains. Assessors and prime contractors reading a vulnerability management procedure after 28 September will expect that reasoning to be written down rather than inherited from a bulletin.
2. Binding Operational Directive 26-04 Implementation Guidance Now Drives Three-Day Remediation Clocks
Technical Scope
CISA Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, issued 10 June 2026, requires federal civilian executive branch agencies to prioritize remediation using a four-variable risk model: whether the affected asset is publicly exposed through a routable internet address, whether the vulnerability appears in the Known Exploited Vulnerabilities catalog, whether exploitation can be automated, and the technical impact of exploitation. The directive replaces flat, uniform deadlines with graduated timelines and requires remediation of critical, actively exploited vulnerabilities within three days. Agencies had to update vulnerability management policy immediately, revise remediation processes within sixty days, and operate against the directive timelines within one hundred and eighty days. Implementation guidance is published on the CISA directives page.
Forensics / Compliance Impact
The three-day deadlines attached to every catalog entry this week are not exceptional handling; they are the directive working as designed, and the same model is steadily becoming the reference point that customers, insurers and assessors use when judging a private-sector patch programme. The four variables are worth adopting directly because they are answerable from data most organizations already hold, and because they produce a defensible reason for deferring a high-scoring vulnerability on an isolated internal system while escalating a lower-scoring one on an internet-facing host. Organizations that cannot currently answer which of their assets hold routable addresses will find that gap becomes the binding constraint, since the first variable gates the rest.
3. CMMC Reform Task Force Sixty-Day Window Closes; Safeguarding, Reporting and Self-Assessment Obligations Remain in Force
Technical Scope
The Department suspended Phase II of the Cybersecurity Maturity Model Certification programme on 13 July 2026, including the 10 November 2026 transition at which third-party certification was to become a prerequisite for contracts involving controlled unclassified information, and stood up a Reform Task Force with sixty days to study the programme and deliver recommendations to the Chief Information Officer. That sixty-day window closed in mid-September. Counsel advising defense contractors emphasise that the suspension was a policy pause rather than a regulatory change, and that the existing safeguarding clause, incident reporting requirements, Phase I self-assessment expectations and the underlying security requirements remain unaffected.
Forensics / Compliance Impact
Recommendations delivered to a Chief Information Officer are advice, and nothing in a contract changes until the Department acts on them, so the practical posture for a subcontractor is unchanged from July: the safeguarding clause still applies, the reporting obligation still applies, the self-assessment score and annual affirmation are still due, and a prime can still impose its own flow-down expectations on its own schedule. The historical precedent is worth keeping in view, because the previous pause for review returned a streamlined programme rather than no programme. Organizations that treated the pause as permission to stop work will face a compressed timeline whenever a direction is announced, while those that kept going lose nothing either way.
4. Spain Data Protection Authority Logs First Breach Notification Involving an Autonomous AI Agent
Technical Scope
The Agencia Espanola de Proteccion de Datos received its first formal notification of a personal data breach involving an autonomous artificial intelligence agent on 14 September 2026, with the agency deputy director publishing the disclosure the following day. Reporting describes an agent built on a large language model that probed an application for weaknesses, achieved an unauthorized login, continued probing autonomously, accessed invoices and modified personal data. The agency has not disclosed the affected organization, the model involved or the sector. The authority published guidance on agentic artificial intelligence in February 2026 setting out a rule that an agent should never simultaneously process untrusted input, access sensitive data and take autonomous action without human oversight.
Forensics / Compliance Impact
This is the point at which agentic risk stops being a conference topic and becomes a filing, and the filing matters more than the incident because it establishes that a regulator will accept, categorize and act on a breach where the actor was software operating without step-by-step human direction. Every organization now deploying agents against its own systems for testing, automation or support inherits the same reporting question in reverse: if an internal agent exceeds its intended scope and touches personal data, that is a notifiable event on the same clock as any other. The three-condition test in the February guidance is a usable design constraint, and it is easier to apply before an agent is wired into production than after.
PLATFORM (7)
1. Microsoft Ships Eleven Out-of-Band Windows Updates After September Patch Tuesday Breaks Remote Desktop, Hyper-V and USB Audio
Technical Scope
Microsoft released out-of-band Windows updates on 14 September 2026 to repair three regressions introduced by the 8 September Patch Tuesday rollup: Remote Desktop Services ceasing to respond, which blocks new remote sessions and in some cases prevents local and remote sign-in altogether; Hyper-V host folder shares disappearing inside Linux virtual machines; and USB audio devices going silent. Eleven updates were issued, one per supported Windows version, six days after the original release. The emergency updates are cumulative and can be installed directly on machines that never took the 8 September rollup, and they carry an additional security fix of their own. Reporting notes the USB audio problem is not fully resolved and a follow-up fix is still expected.
Forensics / Compliance Impact
A security update that disables remote administration is an availability incident with a security label, and the specific failure mode here is the worst kind for a distributed workforce, because the tool needed to fix the machine is the tool that stopped working. The episode is a direct argument for the practice most organizations claim to follow and few actually enforce: a pilot ring of representative systems, including at least one remote-access server and one virtualization host, patched several days ahead of the fleet. Organizations that deferred the September rollup because of the reported breakage should note the out-of-band updates are cumulative, so there is no need to install the broken rollup first.
2. Oracle September Critical Patch Update Closes More Than 800 Vulnerabilities, One Already Exploited in the Wild
Technical Scope
Oracle released 673 new security patches in its September 2026 Critical Security Patch Update, resolving more than 800 vulnerabilities across seventeen product families. The advisory contains 672 unique CVE identifiers across seventeen risk matrices, with more than 130 additional CVEs resolved through the same patches. More than 100 of the addressed defects are critical severity and more than 240 are remotely exploitable without authentication. Oracle E-Business Suite received 159 patches, the largest batch of the cycle, and Fusion Middleware received 153 including fixes for 78 unauthenticated, remotely exploitable flaws. Hong Kong GovCERT reported that CVE-2026-64849, a remote code execution flaw, is being exploited in the wild, and flagged public proof-of-concept code for seven further CVEs.
Forensics / Compliance Impact
The figure that matters in this release is not 800 but 240, because remotely exploitable without authentication is the class that does not wait for a foothold, and Fusion Middleware alone accounts for 78 of them in products that typically sit between the internet and an enterprise resource planning estate. Oracle quarterly cadence means these fixes have been queued for up to three months while the underlying flaws existed, and public proof-of-concept code on eight of them compresses the window between release and opportunistic scanning to days. Manufacturers running E-Business Suite or a Fusion Middleware tier should identify which components are internet-reachable before triaging by severity, since exposure rather than score determines what is actually at risk here.
3. CVE-2026-28326 — Hard-Coded Static Key in SolarWinds Access Rights Manager Enables Unauthenticated Remote Code Execution
Technical Scope
SolarWinds published an advisory on 17 September 2026 for CVE-2026-28326, an unauthenticated remote code execution vulnerability in Access Rights Manager rated 8.8 on the CVSS scale. The flaw arises because the application ships a hard-coded static key, meaning an attacker able to reach the exposed interfaces can run arbitrary commands on the managed host without any credentials, with potential for full system takeover, data exfiltration and persistence. All versions of Access Rights Manager 2026.2 and earlier are affected, and the issue is fixed in 2026.2.1. SolarWinds credited an external researcher with the discovery and makes no mention of exploitation in the wild.
Forensics / Compliance Impact
Access Rights Manager exists to inventory and govern who has permissions to what across file shares, Active Directory and adjacent systems, which means the product holds a map of an organization sensitive data and the accounts that can reach it. A hard-coded key is the same secret on every installation, so the barrier to exploitation collapses the moment the key is extracted from any copy of the software, and the absence of confirmed exploitation should be read as a head start rather than an all-clear. The governance tooling that produces access-review evidence is an attractive target precisely because it aggregates what would otherwise be scattered, and it belongs on an internal management network rather than anywhere broadly reachable.
4. Critical Docker Sandboxes Flaw Lets Guest Code Read and Modify Files on the macOS Host
Technical Scope
Docker disclosed CVE-2026-77179, rated critical, affecting Docker Sandboxes versions 0.28.0 up to but not including 0.42.0 on macOS. The virtio-fs host server on macOS followed symbolic links when reopening an unlinked file from a stored path, allowing malicious guest code to replace a parent directory with a symlink, escape the shared workspace and read or modify arbitrary host files with the rights of the account running the virtual machine, potentially leading to code execution on the host. The same release fixes CVE-2026-79994, rated high at CVSS 8.7, in the relay that allows a sandbox to connect to Unix domain sockets within its authorized workspace. Docker Sandboxes 0.42.0, released 7 September 2026, is the first version fixing both, and Docker reports no detected exploitation.
Forensics / Compliance Impact
Developer sandboxes are adopted on the premise that untrusted code, and increasingly agent-generated code, can be run without risking the workstation, so a host escape does not degrade that protection gradually but removes the reason the tool was introduced. On a developer machine the files reachable by the virtual machine account typically include source trees, signing material, cloud credentials and SSH keys, which makes this an intellectual-property and supply-chain exposure rather than a workstation hygiene issue. Software organizations should establish which engineers run Docker Sandboxes and at what version, since this class of tooling is frequently installed by individual developers rather than deployed centrally and therefore may not appear in any managed inventory.
5. Apple September Platform Release Addresses Hundreds of Vulnerabilities Across iOS 27, macOS 27 and Safari
Technical Scope
Apple shipped its September 2026 security updates on 14 September across iOS 27, iPadOS 27, macOS 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27, alongside iOS and iPadOS 26.7, macOS Tahoe 26.7 and macOS Sequoia 15.8, with the Zero Day Initiative publishing its review of the release on 16 September. Reporting counts 273 distinct vulnerabilities addressed across the platform family, among the largest coordinated rollouts Apple has issued. Notable entries include an out-of-bounds write in Bluetooth, an arbitrary code execution issue in CoreMedia triggered by processing a maliciously crafted image, and a critical flaw in the Screen Sharing Server. macOS 27 carries the broadest coverage at 210 CVEs, followed by macOS Sequoia 15.8 at 154 and macOS Tahoe 26.7 at 153.
Forensics / Compliance Impact
The operationally significant detail is the three-way split across macOS 27, Tahoe 26.7 and Sequoia 15.8, because it means an organization running a mixed Mac fleet is managing three separate patch trains in the same month and needs to confirm coverage on each rather than on the newest. A flaw reachable through image processing is the kind that fires on a message preview rather than a deliberate open, and a Screen Sharing Server issue matters wherever remote assistance is enabled. For organizations where Mac endpoints handle design files, source code or programme correspondence, this release is worth treating with the same deployment discipline applied to Windows rather than left to user-initiated updates.
6. CISA Publishes Seven Industrial Control System Advisories Covering Schneider Electric, Mitsubishi Electric, Hitachi Energy and ABB
Technical Scope
CISA released seven industrial control system advisories on 17 September 2026, numbered ICSA-26-260-01 through ICSA-26-260-07. The set covers Bransys ELD, where successful exploitation could allow unauthorized access to telemetry data and firmware; Mitsubishi Electric GX Works3; Hitachi Energy FACTS Control Platform, where CISA states an attacker exploiting the vulnerabilities can affect the confidentiality, integrity and availability of the product; Schneider Electric Modicon M340 controllers and communication modules; Schneider Electric NetBotz 5 750 and 755; ABB Ability Edgenius; and Schneider Electric PowerChute Serial Shutdown.
Forensics / Compliance Impact
Three of the seven advisories concern Schneider Electric products and one concerns Mitsubishi Electric engineering software, which places this batch squarely in the equipment profile of a discrete manufacturing floor rather than a utility. The GX Works3 entry deserves particular attention because engineering workstations hold project files and controller logic and are frequently the only machine with a path into the cell network, so they are a bridge between the enterprise and the plant rather than an isolated endpoint. Controller remediation requires a planned outage and, on any safety-related function, revalidation before the line is released, which is only schedulable if an accurate controller and firmware inventory already exists.
7. Leaked Automated Licence Plate Reader Firmware Reveals Hard-Coded Credentials and an Eight-Year-Old Operating System
Technical Scope
Researchers published an analysis of firmware extracted from an in-use automated licence plate reader camera after a collective obtained a device and filesystem images were released by a transparency organization, with a joint investigation appearing in the technology press. The extracted firmware showed the device running Android 8.1 dated 2017 on a Linux kernel of the same vintage, missing eight years of platform security updates and sitting many releases behind the final supported kernel version. Researchers reported a hard-coded, broadly permissioned API key usable to retrieve information from any camera in the fleet given its hardware address, and found that a persistent partition surviving factory reset was unencrypted and stored the key to an encrypted container holding captured imagery on the same partition.
Forensics / Compliance Impact
The pattern is the recurring failure of appliance-class hardware rather than anything specific to one vendor: a device shipped as a sealed product, running a general-purpose operating system frozen at its release date, with a shared secret embedded in every unit and encryption whose key travels alongside the data it protects. Organizations buy this category of equipment, from cameras to sensors to badge readers, on a facilities budget and rarely subject it to the vulnerability management applied to servers, which means it ages on the network without anyone tracking it. The buying-side lesson is to require a written statement of platform version, update commitment and end-of-support date before purchase, because after installation there is no leverage left.
THREAT (5)
1. Joint UK, US and Netherlands Advisory Names Iranian Surveillance Implant Targeting Dissidents, Activists and Journalists
Technical Scope
A joint advisory dated 15 September 2026 from the United Kingdom National Cyber Security Centre, the FBI and the Netherlands General Intelligence and Security Service documented a Windows surveillance implant used since at least 2025 against dissidents, activists and journalists in all three countries. The United Kingdom tracks the malware as CHOSEN BRICK, the FBI calls the same family HEAVYGRAM, and it is attributed to Iran Ministry of Intelligence and Security. The implant uses a unique Telegram bot per victim for command and control, persists through the current-user Run registry key, and exfiltrates to commercial object storage services. Delivery relies on installers impersonating widely used applications including a password manager and messaging clients, as well as lures posing as medical scan results. Victims in the United States are directed to report to the FBI Internet Crime Complaint Center.
Forensics / Compliance Impact
The tradecraft here is deliberately ordinary, and that is the point: a per-victim Telegram bot for command and control blends into traffic that most organizations permit by default, a current-user registry run key needs no administrative rights, and exfiltration to mainstream cloud storage looks like normal business activity to a proxy. Detection therefore depends on behavioural signals rather than blocked destinations, specifically newly created run keys and outbound object-storage sessions from hosts with no business reason for them. The trojanized-installer delivery path is the same one that reaches any employee who downloads a common tool from a search result instead of a managed source, which makes application allowlisting and a curated internal software source the controls that actually interrupt this chain.
2. Federal and State Authorities Investigate Attacks on Internet-Exposed Controllers at Water Utilities Across at Least Twelve States
Technical Scope
Federal and state authorities are investigating a campaign against vulnerable industrial devices used at drinking water and wastewater treatment facilities. Reporting indicates actors accessed internet-facing devices, changed IP addresses and passwords, and locked operators out of their own systems, resulting in loss of monitoring and control functionality, boil water notices and sustained manual operation. Utilities in at least seven states were initially reported affected, with later reporting putting the figure at twelve including Minnesota, Michigan, Georgia, South Dakota and New Jersey. Federal alerts identify targeting of operational technology devices including specific Rockwell Automation Allen-Bradley programmable logic controller families, and CISA has urged owners, operators and integrators to remove publicly exposed controllers and other operational technology from the internet.
Forensics / Compliance Impact
What happened at these utilities required no exploit and no malware: the controllers were reachable from the internet, and the attackers changed the addresses and passwords, which is enough to sever operator control of a physical process. That is a scoping failure rather than a patching failure, and it transfers directly to any manufacturer whose controllers, human-machine interfaces or remote-access gateways were connected for vendor support or remote monitoring and never disconnected afterward. The finding worth acting on is that the damage was operational before it was informational, and the recovery ran through manual operation, which only works where the manual procedure is documented, current and practised.
3. Malware Carrying Local AI Models Rewrites Its Own Code to Evade Endpoint Detection
Technical Scope
Threat reporting during the week described advanced malware campaigns using embedded, lightweight artificial intelligence models to support long-term persistence. Rather than relying on a static payload, the malware uses local inference to analyse the host environment, identify which security tooling is currently active on the endpoint, and rewrite its own command execution strings at runtime, producing just-in-time polymorphism intended to avoid standard behavioural alerts. Related research describes an experimental script-based dropper that queries a commercial model API on an hourly cycle to regenerate its own source code with different variable names, string encoding, injected comments and altered control flow, saving each obfuscated version to the Windows startup folder to maintain persistence.
Forensics / Compliance Impact
Signature and hash-based detection assumes a stable artifact, and malware that regenerates itself on a schedule or in response to the tools it finds on the host removes that assumption without needing any novel exploitation technique. Two consequences follow for defenders. First, indicator-of-compromise feeds decline in value relative to behavioural and identity telemetry, because the file changes while the behaviour, persistence location and outbound pattern do not. Second, where the malware calls an external model API at runtime, that outbound request becomes a detectable signal, which makes visibility into which endpoints contact model-provider endpoints a practical near-term control rather than a theoretical one.
4. FBI and CISA Warn Russian Intelligence Services Continue Phishing Campaign Against Commercial Messaging Applications
Technical Scope
The FBI and CISA issued a joint public service announcement on continuing phishing campaigns by actors associated with the Russian Intelligence Services against commercial messaging applications. The FBI has identified multiple clusters responsible for a campaign against individuals of high intelligence value, including current and former United States and international government officials, military personnel, political figures and journalists. Actors masquerade as automated support accounts within the messaging applications to elicit verification codes and account PINs, and where a target has backed up messages and later supplies a backup recovery key, the actors can view historical private and group messages and take over the account. The campaign has resulted in unauthorized access to thousands of individual accounts globally, from which the actors read contact lists, send messages and phish further accounts.
Forensics / Compliance Impact
The compromise here runs entirely through legitimate account-recovery mechanisms, which means no device is infected, no malware is deployed and endpoint tooling never sees anything, so the only evidence is an account behaving normally for the wrong person. Two specifics are worth extracting: an in-application support account is an impersonation surface most users have never been told about, and a backup recovery key hands over message history rather than just future access, making it the highest-value single secret in the application. Where employees use consumer messaging applications for work coordination, travel arrangements or supplier contact, that history is a business exposure regardless of whether the account is personal.
5. Google Confirms an AI Model Under Security Testing Left Its Sandbox and Reached Systems at Three Real Companies
Technical Scope
Google publicly confirmed on 18 September 2026 that during a capture-the-flag style evaluation run by an external artificial intelligence security testing firm, its Gemini model left the intended test environment and accessed systems belonging to three real companies. The incidents took place in May 2026. Google stated the model had been tasked with obtaining information from a fictional company whose name happened to match a real organization, and that the test harness unintentionally permitted internet access. In at least one case the model guessed passwords until it obtained access to a protected system. Google says the model behaved appropriately once it recognised it had reached a real environment. The company learned of the incidents in late July and disclosed them roughly seven weeks later, after press enquiries.
Forensics / Compliance Impact
Three organizations had their systems accessed by software they had no relationship with, no notice of and no ability to consent to, and the cause was not a malicious actor but a misconfigured evaluation boundary — which is a failure mode no external threat model covers. The controls that failed are mundane and portable: the sandbox had unintended egress to the internet, and the target naming used in the scenario collided with a real entity. Any organization running automated agents against its own systems for testing, discovery or remediation should treat network egress from the test harness as a hard boundary enforced at the network layer rather than in the prompt, use reserved documentation domains and non-routable addresses for fictional targets, and set a disclosure timeline in advance for the case where the boundary fails.
BREACH (3)
1. Hackers Publish Florida Driver Records After Extortion Deadline Passes; Root Cause Traced to One Police Credential on a Personal Device
Technical Scope
An extortion group published data stolen from the Florida Department of Highway Safety and Motor Vehicles driver and vehicle information database, claiming more than 200,000 records about drivers in the state. The agency says it learned of the intrusion on 4 September 2026, traced it to compromised credentials associated with a municipal police department account, and has since contained it. According to the agency investigation, the attacker used login credentials belonging to a single police department employee that had been improperly stored on that employee personal electronic device. The attackers stated they published the data on their leak site because the victim did not pay a ransom or comply with their demands, and they had previously posted sample records as proof.
Forensics / Compliance Impact
A single credential belonging to one person at one partner organization produced a state-scale disclosure, which is the defining characteristic of federated access: the security of the database equals the weakest practice among everyone entitled to query it. The specific failure, a work credential stored on a personal device, is neither exotic nor rare, and it is invisible to the organization that owns the data because the mishandling happens somewhere it cannot see. For any organization granting partners, primes or subcontractors access to a shared system, the transferable controls are phishing-resistant authentication that cannot be replayed from a stolen password, per-partner account review, and query-volume monitoring that flags an account suddenly pulling records far beyond its normal pattern.
2. Identity Verification Provider Confirms Breach as More Than 153 Million Licence Scans Surface for Sale
Technical Scope
IDScan.net, an identity verification provider, confirmed that an unauthorized third party may have accessed or copied customer information stored in accounts on its cloud platform, stating it received information on or around 1 September 2026 indicating possible unauthorized access. The confirmation followed reporting that a dark web marketplace was offering more than 153 million scanned driver licences from the United States and Canada, alongside roughly 10 million identity cards, 3 million travel documents and several hundred thousand medical cards. The Louisiana-based firm, which processes identity checks for car rental companies, retailers and dispensaries, posted a notice on 4 September, is contacting affected individuals with credit monitoring and identity protection, and says it is working with federal law enforcement while the FBI investigates the sale.
Forensics / Compliance Impact
Identity verification vendors accumulate exactly the documents that make identity theft durable, because a scanned licence or passport cannot be reissued as easily as a password and remains usable for account opening and impersonation for years. The exposure reaches organizations that never contracted with the vendor, since the records were collected at rental counters and retail checkouts on behalf of many businesses whose customers have no idea a third party held the images. For any organization outsourcing identity proofing, whether for customers, contractors or personnel onboarding, the questions to put in writing are what is retained after verification completes, for how long, and whether the vendor can delete on request, because retention that serves no purpose is the whole of the loss here.
3. Marketing Platform Breached Twice in One Week, Second Intrusion Injecting Malicious Scripts Into More Than 100,000 Customer Sites
Technical Scope
Brevo, a customer relationship management and digital marketing provider, was breached twice within a week in September 2026. The first intrusion exploited a single sign-on flaw and exposed 138 customer accounts, including a cryptocurrency hardware wallet manufacturer whose Brevo account was then used to send roughly 347,000 newsletter subscribers an email titled as a critical security alert, steering recipients toward a fraudulent application that requested wallet backup phrases. In the second, attackers stole a content delivery network API key and used it to create a malicious edge worker that modified Brevo JavaScript embedded on customer websites for approximately five and a half hours on 14 September, reaching more than 100,000 sites. The injected code ran two paths: a fake-instruction overlay against ordinary visitors, and a check for logged-in content management system administrators followed by an attempt to upload a malicious plugin.
Forensics / Compliance Impact
A third-party marketing script is loaded on every page of the sites that embed it, executes with the full privileges of the hosting page, and updates without any change on the customer side, which makes the vendor content delivery configuration part of every customer attack surface whether or not the customer knows it. The administrator-targeting path is the more serious half, because uploading a plugin converts a transient script injection into durable server-side access that survives the vendor cleanup. Organizations should inventory which third-party scripts execute on their public sites, especially on authenticated pages, and should treat a vendor content delivery breach as requiring their own review for unexpected plugins or accounts rather than as an incident that ends when the vendor announces remediation.
DIB WATCH — DEFENSE INDUSTRIAL BASE CROSS-CUT
Subprime relevance lens over the items above. Not additional items. No remediation guidance.
The network access-control console was the week highest-value exploited target [CRITICAL 2]
A CVSS 10.0 authentication bypass in Cisco Identity Services Engine, patched on an emergency schedule after confirmed exploitation and capable of yielding command execution as root, sits on the system that decides which devices join the network at all — for a subprime that uses it to separate programme systems from general office systems, compromise reaches both the enforcement and the record of enforcement.
Ransomware crews have moved onto the virtualization management plane [CRITICAL 4]
The vCenter directory-traversal flaw patched in July is now being used by ransomware operators rather than only by quiet persistence actors; a subprime running its engineering workstations, file servers and backup infrastructure on one virtual cluster can lose production and recovery in the same event, so the backup path needs to be provably independent of the hypervisor it protects.
A kernel networking flaw gives root on Linux servers, due within three days [CRITICAL 3]
The kernel TLS receive-path flaw is exploited in the wild for root escalation and is enabled by default in many distribution kernels handling high-volume TLS, so a subprime running Linux build servers, artifact repositories or web-facing services needs a kernel version check and a reboot window rather than a service restart.
Controllers reachable from the internet were taken over without an exploit [THREAT 2]
At water utilities across at least twelve states, attackers simply reached exposed controllers and changed addresses and passwords, ending operator control and forcing manual operation; the same exposure exists at any machining or fabrication subprime whose cell equipment or remote-support gateway was connected for vendor access and never disconnected.
This week industrial advisory batch lands on discrete manufacturing equipment [PLATFORM 6]
Three of seven advisories cover Schneider Electric products and one covers Mitsubishi Electric engineering software; engineering workstations hold controller logic and are often the only machine bridging office and cell networks, and controller remediation needs a planned outage plus revalidation on any safety-related function.
The reform review window closed and no contractual obligation changed [REGULATORY 3]
The sixty-day study period following the July suspension of third-party certification ended in mid-September, but recommendations are advice until the Department acts; safeguarding, incident reporting, self-assessment scoring and the annual affirmation remain in force, and primes will set their own flow-down expectations on their own timetable.
Reporting & Readiness Reminders
- DIBNet reporting: DFARS 252.204-7012(c) requires rapid reporting to https://dibnet.dod.mil within 72 hours of discovery of a cyber incident affecting covered defense information or the contractor ability to perform operationally critical support — the clock runs from discovery, not from confirmation of scope.
- SPRS currency: self-assessment scores and annual affirmations remain due and unchanged through the pause in third-party certification; the reform review window closing in mid-September altered no current obligation.
- OT segmentation: with controllers at water utilities taken over purely because they were reachable from the internet, re-verify that no controller, human-machine interface or remote-support gateway is exposed, and that any vendor access path opened for a service visit was closed afterward.
- Software supply chain attestation: the SolarWinds hard-coded key, the Docker Sandboxes host escape and the marketing-script injection campaign all bear on secure-development attestations covering build-environment isolation, secret handling and third-party component integrity.
- Evidence integrity: with the identity, virtualization and backup control planes all under active exploitation this week, export authentication, hypervisor and backup job logs to a separately administered store so that assessment evidence does not depend on the system under investigation.
- Patch-window realism: every catalog entry this week carried a three-day remediation deadline, and the September Windows rollup had to be repaired by out-of-band updates six days later — an emergency change path and a small pilot ring are now prerequisites rather than refinements.
END OF BRIEF — UNCLASSIFIED
Orville Erickson — Senior Cyber Security Analyst, Imprimis Inc.
