Weekly Roundup
The week's notable stories that didn't get a standalone piece: three critical WatchGuard firewall RCEs, active exploitation of Sangoma, Langflow, and Rails, nearly 22,000 exposed Exchange servers, a 9.5-million-patient cloud breach, and Windows turning on Memory Integrity by default.
Artificial Intelligence (AI)
Google unveiled Gemini 3.8 Flash Cyber, which it calls its most capable cybersecurity model, and a new Fairwind Program that gives high-priority defenders early access. Anthropic and OpenAI announced parallel safeguards and defender-access programs the same week.
Spyware
Citizen Lab and the SHARE Foundation confirmed Pegasus and a new NoviSpy variant on the phones of Serbian student activists. It is the first forensically confirmed Pegasus infection of 2026 and, the SHARE Foundation says, the biggest spyware wave in Serbia yet.
Vulnerability Research
Chaotic Eclipse dropped FalconFlank, a proof-of-concept for a zero-day privilege-escalation flaw in CrowdStrike Falcon Sensor that abuses the product's malicious-macro remediation. No CVE, no CVSS, and no CrowdStrike advisory yet, and the disclosure looks uncoordinated.
Vulnerabilities & Patching
CISA added seven actively exploited flaws to its Known Exploited Vulnerabilities catalog on September 2. A CVSS 10.0 SonicWall SMA 1000 SSRF leads the list, and defenders are already seeing reverse shells and cryptocurrency miners dropped through the other bugs.
Supply Chain Attack
Softaculous has reconstructed the 33-hour BGP hijack that rerouted its traffic in late August. Attackers used a valid TLS certificate for Softaculous domains to serve a malicious Virtualizor update, establishing persistent root access on the hosts that installed it during the window.
Law Enforcement
Authorities turned Sality's peer-to-peer design against itself, injecting sinkholes into the botnet's own peer lists to cut more than 15,000 infected machines off from their operator. The disruption stops new payloads, but already-infected Windows hosts still need cleanup.
Manifold Security disclosed eight flaws across seven command-line AI coding agents, including Claude Code, Codex, and Cursor, where a repository's own .git config names a command the agent runs automatically on the developer's machine. Four were still unpatched at publication.
SonicWall shipped emergency hotfixes for two actively exploited SMA 1000 zero-days. CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 chain into unauthenticated remote code execution on internet-facing VPN gateways, and one national SOC rates further attacks almost certain.
The Financial Stability Board told G20 finance chiefs that frontier AI has made cyber risk the financial system's most immediate concern, and urged banks and their technology providers to plan for simultaneous disruption across multiple firms and shared dependencies.
watchTowr has confirmed attackers are exploiting CVE-2026-82329, a critical (CVSS 9.8) authentication bypass in self-hosted JFrog Artifactory, to mint their own administrator tokens. JFrog patched the flaw on August 28, but internet-exposed servers should be treated as already compromised.
OpenAI says its upcoming Astra model is the first to meet the 'critical' cybersecurity tier in its Preparedness Framework, capable of finding and exploiting unknown flaws without human guidance. Select partners get early access first, so defenders can shore up defenses before a wider release.
METR, the nonprofit that stress-tests frontier AI models, says an attacker stole an API key and spent about $600,000 in model credits over three weeks. The provider had donated the credits, so no bill ever flagged the theft.
ESET disclosed GuardBreaker, a technique where Russia-aligned UAC-0099 buried a refusal-triggering prompt inside a malicious script so AI-assisted analysis would balk. The defender lesson: any sample fed to a language model is prompt-injection input, not just code to be scanned.
Sygnia says the China-nexus espionage actor Fire Ant has pushed past VMware hypervisors into the network authentication and logging plane, compromising Cisco IOS XR routers, TACACS servers, and Linux management hosts to harvest credentials and suppress the telemetry defenders rely on.
Anthropic has begun logging Claude users out of their accounts and stripping saved payment methods after infostealer malware on their own PCs and Macs let attackers replay stolen login sessions. The company says the malware is general-purpose, not tied to Claude.
McKesson has confirmed an incident and almost nothing else. The 284 million figure is ShinyHunters' claim, it counts database rows rather than people, and this same group's numbers were cut roughly in half the last time anyone checked them.
SOCRadar's threat research unit disclosed AnonyMousKIT, a credit-metered phishing-as-a-service platform that rents AI voice agents to call owners of lost and stolen Apple devices, pose as Apple Support, and coax out the passcodes and 2FA codes that strip Activation Lock.
New polling commissioned by the Center for Democracy & Technology finds two-thirds of British adults won't trust the current government, or any future one, with access to their encrypted chats, as the UK presses tech firms for backdoor access under existing surveillance law.