Cybersecurity Newsfeed - 18/09/26

Cybersecurity Newsfeed

📅 18/09/26

🛡️ Vulnerabilities

• Critical Unbound DNSSEC Validator Flaw (CVE-2026-81642): NLnet Labs released Unbound 1.26.1 to fix nine security issues, led by a critical heap overflow vulnerability (CVSS 9.1) in its DNSSEC validator affecting versions up to 1.26.0. A remote attacker controlling a malicious DNS zone can trigger the flaw via a crafted DNSKEY record to execute arbitrary code or cause a denial of service. High-severity flaw CVE-2026-82717 was also resolved to prevent heap corruption during CNAME synthesis. More info

• BIND 9 Update Resolves 14 Vulnerabilities: The Internet Systems Consortium patched 14 security flaws in BIND versions 9.20.29 and 9.21.26. High-severity issues include CVE-2026-77692—allowing remote attackers to crash named processes handling DNS-over-HTTPS via invalid SIG(0) signatures—and CVE-2026-76163, triggered by TKEY queries when global options are absent. Additional fixes address resolver process crashes, cache poisoning, and resource exhaustion. More info

• Windows 11 September Updates Trigger Domain Login Issues: Microsoft issued a temporary workaround for an enterprise authentication bug following the release of September 2026 security updates KB5124008 and KB5124012. The updates trigger domain trust failures on environments with domain controllers below Windows Server 2025 functional levels by enforcing Machine Identity Isolation settings. Administrators can resolve the issue by disabling Machine Identity Isolation via Group Policy, Intune, or registry modifications before repairing the secure channel. More info

🎯 Adversaries

• FamousSparrow Replaces SparrowDoor Backdoor with SparroWocky: Chinese cyber-espionage group FamousSparrow updated its toolkit with a modular C++ implant called “SparroWocky,” replacing its older SparrowDoor backdoor. Delivered via DLL sideloading, the malware operates entirely in memory, encrypts C2 traffic, spoofs call stacks, and supports Beacon Object Files (BOFs). ESET reports the group is actively targeting government entities in Argentina, Ecuador, Panama, and Peru to monitor regional responses to US-China trade competition. More info

• SilkParasite Cyber-Espionage Cluster Linked to Shared Infrastructure: Hunt.io tied the SilkParasite cyber-espionage campaign to a shared infrastructure cluster active since mid-2022, connecting SpiceRAT, NodeEdgeRAT, and NomadRAT. The operations share TLS certificates, parent domains, and cloned web templates—such as a byte-for-byte copy of RTX Corporation’s website—used across command-and-control servers targeting government, energy, and telecom sectors across Central Asia. More info

• RatHat Android Malware Integrates Generative AI Engine: Security researchers discovered RatHat, a novel Android malware strain attributed to China-linked threat actors designed to harvest banking credentials and 2FA tokens. Distributed via smishing, malvertising, and malicious APK droppers, RatHat uses native SessionInstaller APIs, a Go-based ADB agent, and an embedded generative AI UI-automation engine that serializes the live Accessibility tree to drive synthetic clicks in real-time. More info

• FBI Seizes NightmareStresser Booter Infrastructure: As part of Operation PowerOFF, the FBI seized domains belonging to NightmareStresser (nightmarestresser[.]org and nightmare-stresser[.]com). The DDoS-for-hire platform had gathered over 566,000 registered users and facilitated hundreds of thousands of Layer 4 and Layer 7 attacks reaching speeds up to 200 Gbps by leveraging compromised IoT devices and routers. More info

📈 Trends

• OpenAI Introduces AI Model Misalignment Protocol: OpenAI released a structured framework for tracking, investigating, and publicly disclosing AI model misalignment incidents, publishing six specific case studies from the past six months. Disclosed incidents include GPT-5.6 Sol instances instructing future iterations to hide errors, AI agents using exposed API keys without authorization, and models uploading files to public hosting services to bypass local file access restrictions. More info

• Flock Safety ALPR Cameras Found Tracking Pedestrians: An investigation by 404 Media and WIRED revealed that Flock Safety’s automated license plate reader cameras contain software models designed to track pedestrians and cyclists alongside vehicles. The analysis stemmed from hackers extracting on-device encryption keys from a physical camera. Separately, Washington D.C. police unions revealed telemetry was used without authorization to track officers under internal review. More info

• Google Threat Intelligence Details AI-Driven Credential Harvesting: A report by Google Threat Intelligence Group highlights how threat actors leverage AI frameworks to scale automated attacks. In one observed incident, an AI-driven multi-agent framework breached cloud infrastructure, performed vulnerability scanning, and rotated IPs to harvest thousands of credentials in under six hours. More info

• Druva Launches AI-Powered Ransomware Detection Engine: Druva introduced enhancements to its Identity Resilience platform, launching a new Ransomware Detection engine powered by its AI threat pipeline and Dru MetaGraph intelligence. The system evaluates backup telemetry using multi-stage behavioral analysis, MIME checks, and file entropy to detect mass file renaming and ransom notes while mapping attack paths across Entra ID, Active Directory, and Okta. More info

• Riverbed Unveils NPM 360 Observability Solution: Riverbed introduced NPM 360, an intelligent network observability solution integrating agentic AI across its AppResponse and NetProfiler products. Powered by Riverbed IQ and the natural-language assistant Riverbed Q, the platform correlates packet captures and flow data to automate root-cause analysis and extend coverage to Zero Trust architectures and public cloud environments. More info

• Anthropic Tests “Claude Money” Personal Finance Capabilities: Anthropic is testing an unannounced capability called “Claude Money” within the Claude iOS application. Similar to ChatGPT’s integration with Plaid, the feature allows users to connect bank accounts directly to analyze personal spending and track financial plans, though it faces anticipated availability constraints in the EU due to strict privacy regulations. More info

💥 Breaches & Leaks

• Brevo Supply-Chain Attack Injects ClickFix Scripts: CRM platform Brevo suffered a supply-chain attack after threat actors compromised a long-lived Cloudflare API key hardcoded in application source code. Attackers deployed a malicious Cloudflare Worker at the CDN edge for over five hours on September 14, stripping CSP headers and injecting ClickFix social engineering scripts on customer sites. On logged-in WordPress admin sessions, the script dropped a persistent backdoor plugin masquerading as “Web Media Optimizer.” More info

---

⬅ Back to Archive