Thursday, September 17, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Linux 20 critical 232
- Cisco 24 critical 79
- WordPress 1 critical 35
- Microsoft 1 critical 22
- Jenkins 20
- Unknown 20
- Advantech 15
- Qualcomm 15
- ISC 14
- HP 13
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casino
A compromised Thai college website was quietly turned into a springboard for an illegal online casino, according to new findings from anti-fraud platform ADEX, which says the campaign achieved full ad cloaking without deploying a single line of cloaking code, mirroring evasion tactics seen in campaigns designed to bypass Google Ads screening . The scheme, uncovered by ADEX’s traffic-monitoring team, abused the genuine domain km.chpc.ac.th, which sits in Thailand’s .ac.th zone reserved for educational institutions. Attackers planted a casino-themed page on the hacked site, which Google indexed…
Also in The Hacker News The Register Security CCCS Alerts & Advisories +3
-
Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware
HEAVYGRAM is a Windows surveillance backdoor that turns Telegram into an operational command center for attackers. Rather than relying on a dedicated server, it uses bots, accounts and groups to receive instructions, move stolen data and keep infected devices under control. The malware has been used since fall 2023 against journalists, Iranian dissidents and people whose views oppose Iran’s government. Victims were approached through messaging apps by people posing as familiar contacts or technical support, then sent files disguised as applications or services. The campaign also relies on…
Also in Microsoft Security Microsoft Security Microsoft Security +3
-
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022.
Also in CCCS Alerts & Advisories SecurityWeek Infosecurity Magazine +3
-
A Phone Call Can Now Spread a Zero-Click Worm | Threat Wire
What if a phone call could spread a zero-click worm without you answering, tapping a link, or doing anything at all? Security researchers built WeWorm, a proof-of-concept that exploited WeChat calls on iOS and Android, revealing how a zero-click vulnerability could turn a messaging app into a self-spreading attack. ⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️ @endingwithali → Twitch: https://twitch.tv/endingwithali Twitter: https://twitter.com/endingwithali YouTube: https://youtube.com/@endingwithali Everywhere else: https://links.ali.dev Want to work with Ali? hak5@endingwithali.com [❗]…
Also in 404 Media Infosecurity Magazine CCCS Alerts & Advisories +2
-
Mythos has made 2026 patching hell. It might make 2027 a breeze
When Microsoft delivered over 970 patches last week, many saw a nightmare for beleaguered security staff. Gartner research vice president Craig Lawson thinks infosec workers might soon see sunlit uplands as their workloads ease. Lawson outlined that scenario at Gartner’s IT Symposium in Australia today and explained it by theorising that the increased volume of vulnerability discoveries made possible by Anthropic’s Mythos and other bug-hunting AI might be getting close to finding most of the flaws in established codebases. “We've never had a situation where massive codebases have been audited…
Also in Bleeping Computer Bleeping Computer Bleeping Computer +3
-
Cisco drops another exploited zero-day, this time a perfect 10
Cisco admins who have spent their week patching email gateways now face a perfect-10 Identity Services Engine flaw under active attack. Cisco disclosed CVE-2026-76460 on Wednesday, describing it as an authentication bypass affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Successful exploitation can give an unauthenticated remote attacker command execution with root privileges. Product Security Incident Response Team said it was aware of active exploitation and urged customers to install the fixes immediately. CISA has also added the vulnerability to its…
Also in Cyber Security News The Hacker News CISA Alerts & Advisories
-
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
FamousSparrow has introduced a new backdoor called SparroWocky after breaking into public-facing Microsoft Exchange servers. The campaign shows how a known espionage group can turn an exposed email system into a quiet, long-term entry point inside a government network. The impact extends beyond the first host, because email servers commonly hold sensitive messages and trusted network connections. The activity has concentrated on Latin America since mid-2025, with governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela among the observed targets…
-
The vulnpocalypse rains iBugs down on Apple with record-setting number of patches
Apple has addressed more than 260 CVEs across all of its operating systems, browsers, and other software products, marking the largest single patch cycle in Cupertino's history. While this CVE count is hardly notable compared to some vendors - hello, Microsoft’s record-breaking 974 bugs disclosed earlier this month - it does set a company record for Apple. It also reflects the new reality of AI-driven bug hunting, as models become exponentially better and faster at finding security vulnerabilities. However, the flip side of the AI coin we were promised - that models would also excel at…
Also in CCCS Alerts & Advisories SANS Internet Storm Center
-
Cisco email security boxes can be rooted by... an email
Criminals are exploiting a critical Cisco Secure Email Gateway flaw that can turn a malicious email into root access. The vulnerability, tracked as CVE-2026-76461, carries a 9.8 CVSS score and affects physical and virtual Secure Email Gateway appliances regardless of their configuration. Cisco says there are no workarounds, so patching is the only fix. The bug lies in how Cisco's AsyncOS software handles incoming email. An attacker doesn't need to log in: they can send a booby-trapped message through a vulnerable gateway and, if the exploit works, run commands as root. Which is not exactly…
Also in CyberScoop Rapid7 Blog The Hacker News +1
-
ZDI-26-703: (0Day) Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.7. The following CVEs are assigned: CVE-2026-92203.
Also in Microsoft Security
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-70416 | ObjectScaleDell | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isDell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. Attack
Exploitation
|
|||||||||
| CVE-2026-73456 | EOSArista Networks | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnder certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an a… Attack
Exploitation
|
|||||||||
| CVE-2026-20130 | Cisco Identity Services Engine SoftwareCisco | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security… Attack
Exploitation
|
|||||||||
| CVE-2026-20192 | Cisco Identity Services Engine SoftwareCisco | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security … Attack
Exploitation
|
|||||||||
| CVE-2026-76423 | Cisco Identity Services Engine SoftwareCisco | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with … Attack
Exploitation
|
|||||||||
| CVE-2026-76460 | Cisco Identity Services Engine SoftwareCisco | Critical | 10.0 | — | KEV | — | — | KEVCVSS 10.0 | |
What it isA vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker … Attack
Exploitation
|
|||||||||
| CVE-2026-20234 | Cisco Identity Services Engine SoftwareCisco | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security … Attack
Exploitation
|
|||||||||
| CVE-2026-20307 | Cisco Identity Services Engine SoftwareCisco | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the atta… Attack
Exploitation
|
|||||||||
| CVE-2026-20322 | Cisco Nexus DashboardCisco | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release th… Attack
Exploitation
|
|||||||||
| CVE-2026-20324 | Cisco Secure Firewall Management Center (FMC)Cisco | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists … Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle addresses 672 CVEs in its September 2026 Critical Security Patch Update with 673 patches, including 104 critical updates. Key Takeaways The September 2026 Critical Security Patch Update (CSPU) contains fixes for 672 unique CVEs in 673 security updates 104 issues (15.5% of all patches) were assigned a critical severity rating Oracle E-Business Suite received the highest number of patches at 159, accounting for 23.6% of all patches Background On September 15, Oracle released its Critical Security Patch Update (CSPU) for September 2026 . Beginning in May 2026, Oracle introduced CSPUs as a…
Also in CCCS Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.