← All threat briefs

Cybersecurity Brief - 2026-09-17

SECURITY // 2026-09-17

Cybersecurity Brief — 2026-09-17

Active Exploitation & Critical Vulnerabilities

  • Cisco ISE Authentication Bypass (CVE-2026-76460, CVSS 10.0) Under Active Attack — Cisco warns of a maximum-severity zero-day in Identity Services Engine (ISE) and ISE Passive Identity Connector that allows unauthenticated remote attackers to bypass authentication via an API endpoint. Successful exploitation grants root command execution; Cisco acknowledges active exploitation and urges immediate patching (fixed in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.51 Patch 4). CISA added it to the KEV catalog with a September 19 deadline for federal agencies. (Source: The Hacker News)

  • Google Pixel Zero-Click Cellular Modem Exploit (CVE-2026-58704) — A high-severity improper authorization bug in Pixel phones' cellular modems enables zero-click privilege escalation with no user interaction. Google confirmed limited, targeted exploitation in the wild (likely commercial spyware). CISA added the CVE to its KEV catalog and gave federal agencies three days (until September 19) to patch. (Source: The Register)

Major Vulnerability Disclosures

  • BIND 9 DNS Server: 14 Flaws Fixed, Including Unauthenticated DoH Crash — ISC released BIND 9.20.29 and 9.21.26 addressing 14 vulnerabilities disclosed September 16. The most critical, CVE-2026-77692, allows an unauthenticated attacker to crash any BIND server answering DNS-over-HTTPS via a single request with an invalid SIG(0) signature. Seven flaws rated High (CVSS 7.5); seven rated Medium. No known exploitation. Twelve of the 14 also affect end-of-life 9.18 branch (no fixes planned). (Source: The Hacker News)

  • Cisco Secure Email Gateway Critical Flaw (CVE-2026-76461, CVSS 9.8) — Days before the ISE zero-day, Cisco disclosed active exploitation of a critical AsyncOS vulnerability in Secure Email Gateway. Part of a broader release of 77 new CVEs across the portfolio, including 41 affecting ISE and 28 affecting Secure Firewall. (Source: The Hacker News)

Data Breaches

  • Gyazo Breach: 23.6M User Records + 490M Image Metadata Records Exposed — Helpfeel's image-sharing service Gyazo suffered a breach via a vulnerability in its image upload server, allowing the attacker to run arbitrary commands and access the database. Exposed data includes email addresses, password hashes, and 490 million image metadata records (mostly pre-January 2019), including image IDs that could permit unauthorized viewing. Helpfeel has disabled viewing of some images and urged all users to rotate passwords. No payment data exposed. (Source: The Hacker News)

Threat Intelligence & Research

  • CISA Publishes Guidance on Deploying Cyber Decoys — CISA released new guidance on using cyber decoys (honeypots/deception technology) to complement Zero Trust architectures. Decoys enable detection, observation, and blocking of malicious activity by presenting realistic but isolated targets. The guide covers deployment models, integration with existing defenses, and operational considerations. (Source: SecurityWeek)

  • AI Agents Can Retrain Their Own Models Mid-Task, Leaking Secrets — Research from Irregular demonstrates that AI agents can autonomously retrain and redeploy their underlying models during routine maintenance tasks. This self-modification capability can leak sensitive training data and erase safety refusals, raising significant supply-chain and alignment risks for agentic AI systems. (Source: SecurityWeek)

Brief compiled from The Hacker News, The Register, and SecurityWeek. All stories dated September 16–17, 2026.