← All threat briefs

Cybersecurity Brief - 2026-09-15

SECURITY // 2026-09-15

Cybersecurity Brief - September 15, 2026

  • LiteSpeed Enterprise Privilege Escalation: A critical vulnerability in LiteSpeed Web Server Enterprise could allow low-privilege users on shared hosting servers to gain root access. (Source: The Hacker News)
  • Cisco Secure Email Gateway Exploitation: Attackers are actively exploiting a high-severity flaw (CVE-2026-76461, CVSS 9.8) in Cisco AsyncOS Software to achieve remote command execution. (Source: The Hacker News)
  • GRIMWEDGE Backdoor Deployment: China-linked threat actors (UTA0560) used a zero-day chain involving Google Chrome and Microsoft Windows to deploy the GRIMWEDGE JavaScript backdoor targeting NGOs. (Source: The Hacker News)
  • DDRop Hardware Attack: Researchers revealed "DDRop," a hardware-level attack capable of breaking memory protection in Intel TDX and AMD SEV-SNP confidential computing by dropping writes to server memory. (Source: The Hacker/News)
  • MeshCentral Backdoor in 3BB Network: An attacker used the legitimate MeshCentral management tool to maintain remote access and target subscriber credentials within Thailand's 3BB broadband network. (Source: The Hacker News)
  • Telegram Desktop Export Vulnerability: A flaw allowed malicious bots to embed hidden JavaScript in Telegram chat HTML exports, enabling message exfiltration when opened in a browser. (Source: The Hacker News)
  • Red Heron Gitea Campaign: The threat actor "Red Heron" exploited RCE vulnerabilities in Gitea instances to compromise organizations across multiple countries, including Taiwan. (Source: The Hacker News)
  • WordPress Automated Plugin Security: WordPress has implemented automated security reviews for all plugin updates to mitigate the risk of high-risk malicious code distribution. (Source: The Hacker News)
  • Twitch OAuth Token Leak: A malicious browser extension ("Twitch Enhanced Viewer | JeetBot") leaked OAuth tokens from approximately 31,000 Twitch users to Russian-operated proxy servers. (Source: The Hacker News)
  • Passkey Phishing for Microsoft Cloud: Threat actors used passkey-themed social engineering and fraudulent email campaigns to breach Microsoft cloud environments and steal data. (Source: The Hacker News)
  • CISA Adds New Vulnerabilities to KEV: CISA has added five actively exploited flaws, including those in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS, to its Known Exploates Vulnerabilities catalog. (Source: The Hacker News)
  • OpenAI Agents in RubyGems Attack: Researchers found that a swarm of OpenAI agents was used to execute a major malicious attack against RubyGems/RubyDoc servers in May 2026. (Source: The Hacker News)
  • GitLab High-Severity File Read: A CVSS 10.0 path traversal vulnerability (CVE-2026-85706) in GitLab's repository commits API has been observed being probed in the wild shortly after disclosure. (Source: The Hacker News)
  • Anthropic Disrupts Claude Distillation Attacks: Anthropic identified and blocked industrial-scale "knowledge distillation" attacks targeting Claude from seven Chinese-based AI laboratories. (Source: The Stacker/The Hacker News)
  • Claude Exploited for Cyberattacks: Anthropic reported that threat groups (Generative Threat Groups) have been using Claude models to automate malware development, data theft, and propaganda. (Source: The Hacker News)
  • JFrog Artifactory Exploitation Chain: Attackers chained two flaws in JFrog Artifactory to gain administrator control and plant backdoors in self-hosted environments. (Source: The Hacker News/Wiz)
  • Sogou Input Method Backdoor: A China-linked group exploited a flaw in the Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor. (Source: The Hacker News)