Tuesday, September 15, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Apple 3 critical 252
- IBM 2 critical 61
- Apache 16 critical 37
- Microsoft 6 critical 30
- Unknown 20
- OpenIdentityPlatform 1 critical 17
- Mattermost 14
- GNU 12
- Red Hat 11
- Kubernetes 1 critical 11
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Register Security Cisco email security boxes can be rooted by... an email
Criminals are exploiting a critical Cisco Secure Email Gateway flaw that can turn a malicious email into root access. The vulnerability, tracked as CVE-2026-76461, carries a 9.8 CVSS score and affects physical and virtual Secure Email Gateway appliances regardless of their configuration. Cisco says there are no workarounds, so patching is the only fix. The bug lies in how Cisco's AsyncOS software handles incoming email. An attacker doesn't need to log in: they can send a booby-trapped message through a vulnerable gateway and, if the exploit works, run commands as root. Which is not exactly…
Also in CyberScoop Rapid7 Blog The Hacker News +3
-
CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory Environments
CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers use to compromise Microsoft Active Directory environments . The technical guide explains how attackers exploit identity configurations, legacy protocols, certificate services, and privileged systems to escalate access, move laterally, and establish long-term persistence inside enterprise networks. Developed by the Australian Signals Directorate’s Australian Cyber Security Center in cooperation with the US Cybersecurity and Infrastructure Security Agency and National…
Also in Cyber Security News SecurityWeek Bleeping Computer +3
-
Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices
Apple has released one of its largest coordinated security rollouts, addressing 273 distinct critical vulnerabilities across iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari, and Xcode. The patches arrived on September 14, 2026, through iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27, alongside iOS and iPadOS 26.7, macOS Tahoe 26.7, and macOS Sequoia 15.8. The 273 figure represents unique CVE identifiers across Apple’s ten advisories, not the sum of every issue listed for each operating system. Many flaws affect shared frameworks…
Also in SecurityWeek Malwarebytes Labs SANS Internet Storm Center
-
Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking
Google is changing how some search-result links behave. Certain results now pass through an encoded Google redirect rather than opening the listed site, making a browser’s link preview less useful as a quick safety check. The change comes as malicious advertising, search-result poisoning, and lookalike download pages keep turning ordinary searches into routes for scams and malware. Users may still see a familiar site name in the result, but their ability to compare that label with the actual link has weakened at the moment they decide whether to click. Analysts at Malwarebytes noted that the…
Also in Huntress Wiz Research Malwarebytes Labs
-
BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America.
Also in SecurityWeek Bleeping Computer Zero Day Initiative +2
-
HBO Max Reddit account compromised to serve ClickFix attacks
Someone compromised the official HBO Max Reddit account and used it to push more than 100 malicious ads serving up ClickFix attacks targeting both Windows and macOS devices with information-stealing malware. A Reddit user uncovered the infostealer ads on September 6, noting that the ad showed u/hbomax as the author — this is the verified HBO Max account — and advertised a macOS app for HBO Max. The streaming service does not offer a native client for the Mac. Anyone who clicked on the malicious ad would then be taken to a “somewhat-legitimate” looking landing page (hbomaxx[.]us) that includes…
Also in SANS Internet Storm Center SecurityWeek Bleeping Computer
-
CISA Warns of Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
CISA has added a critical Cisco Secure Email Gateway vulnerability to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw in real-world attacks. The issue, tracked as CVE-2026-76461, affects Cisco AsyncOS software used by Cisco Secure Email Gateway appliances. CVE-2026-76461 is an SQL injection vulnerability, categorized under CWE-89. It could allow an unauthenticated remote attacker to send specially crafted requests to a vulnerable Cisco Secure Email Gateway device and execute arbitrary commands on the underlying operating system. Successful…
Also in Bleeping Computer Dark Reading CCCS Alerts & Advisories
-
A week in security (September 7 – September 13)
Here’s what we’ve covered in the last seven days on Malwarebytes Labs: Crypto customers targeted by scammers after email marketing provider breach Android malware creates a hidden copy of your banking app BlueMoon exploit kit turns Chrome and Windows flaws into attacks Will AI kill us all within the next decade? Update Chrome now to protect against an actively exploited vulnerability Copyright scammers get Instagram accounts suspended and demand payment More than 100,000 fake stores are out to steal your card details Microsoft fixes record 964 flaws, including 2 exploited zero-days The push…
Also in Microsoft Security Microsoft Security CCCS Alerts & Advisories
-
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. "The
Also in Bleeping Computer Elastic Security Labs
-
VectraRAT Can Hack Windows Enterprises for $250 per Month
The full-service malware-as-a-service (MaaS) platform offers a Windows implant, command-and-control (C2) infrastructure, and an operator panel for comprehensive remote access.
Also in Microsoft Security Microsoft Security Microsoft Security
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-90937 | froxlorF5 | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isfroxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlin… Attack
Exploitation
|
|||||||||
| CVE-2026-16338 | DataStage on Cloud Pak for DataIBM | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isIBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths. Attack
Exploitation
|
|||||||||
| CVE-2026-91001 | DI-8400D-Link | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results … Attack
Exploitation
|
|||||||||
| CVE-2026-82232 | Apache SyncopeApache | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsa… Attack
Exploitation
|
|||||||||
| CVE-2026-86460 | Apache SyncopeApache | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isCypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. User… Attack
Exploitation
|
|||||||||
| CVE-2026-90898 | Bifrostmaximhq | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isBifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.… Attack
Exploitation
|
|||||||||
| CVE-2026-90919 | LightLLMModelTC | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isLightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config S… Attack
Exploitation
|
|||||||||
| CVE-2026-73470 | Apache SyncopeApache | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. Thi… Attack
Exploitation
|
|||||||||
| CVE-2026-73579 | Apache SyncopeApache | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isIncorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transfor… Attack
Exploitation
|
|||||||||
| CVE-2026-73668 | Apache SyncopeApache | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isIncorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Re… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
On the NSA’s Supercomputer from the 1960s
Really interesting story about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA.
Also in CCCS Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.