Cybersecurity Brief — 2026-09-16

Google Patches Pixel Modem Flaw Under Active Exploitation (CVE-2026-58704)

Google disclosed a high-severity privilege escalation flaw (CVSS 8.0) in the Pixel Cellular Modem that is under "limited, targeted exploitation" in the wild. The vulnerability (CVE-2026-58704) is a logic error allowing remote privilege escalation without user interaction. The September 2026 Pixel update addresses 110 total flaws including 46 critical-severity issues in components like BigOcean, Bootloader, IP Multimedia Subsystem, and Trusted Execution Environment. Patch level 2026-09-05 or later resolves all issues. (Source: The Hacker News)

Unauthenticated RCE in The Events Calendar WordPress Plugin Exposes 200,000+ Sites

Two critical vulnerabilities (CVE-2026-78159 and CVE-2026-78006, both CVSS 9.8) in The Events Calendar plugin (600,000+ active installs) allow unauthenticated remote code execution leading to full site takeover. CVE-2026-78159 is a code injection via insufficient validation; CVE-2026-78006 is a PHP object injection exploitable when event comments are enabled. Versions before 6.17.3.1 and 6.17.4.1 respectively are affected; approximately 240,000 sites run vulnerable versions. (Source: SecurityWeek)

Cisco FMC Flaws Exploited by Three Threat Clusters Including Qilin Ransomware

Cisco confirmed active exploitation of two Secure Firewall Management Center vulnerabilities: CVE-2026-20079 (auth bypass, CVSS 10.0) and CVE-2026-20316 (low-privilege access, CVSS 5.3). Cisco Talos identified three threat clusters: UAT-12197 (credential theft via web shells), UAT-11823 (Sandworm-linked Cyclops Blink implant deployment), and UAT-11988 (Qilin ransomware using living-off-the-land techniques). Both CVEs are in CISA's KEV catalog; hotfixes available. (Source: The Hacker News)

Microsoft Patch Tuesday Ships Record 974 Fixes Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday addresses 974 vulnerabilities — the largest single release ever — bringing the 2026 total past 2,600. Two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (both Windows privilege escalation). 113 flaws rated Critical. Notable criticals: CVE-2026-69730 (unauthenticated DNS flaw in Windows Server 2012+) and CVE-2026-69829 (Windows Shell RCE, CVSS 9.8). AI-assisted discovery driving volume; experts warn testing/deployment burden is overwhelming orgs. (Source: Krebs on Security)

Dark Web Service "Nexus" Selling 153M+ Stolen Driver's Licenses; FBI Investigating

A new identity theft service on the Exploit forum offers 153M+ U.S./Canadian driver's license scans, 10M+ ID cards, 3M+ travel documents, and 579K medical cards. Records include UV/IR scans with timestamps correlating to car rental (Hertz) and airport interactions. Data appears sourced from a major identity verification company; ~400K new licenses added daily. FBI New Orleans field office has opened an inquiry. High-profile victims include U.S. Defense Secretary Pete Hegseth. (Source: Krebs on Security)