Apple's "Vulnpocalypse": 261 Vulnerabilities Patched Across macOS 27 and iOS 27

Two hundred sixty-one CVEs, one Apple release, one record. On September 14, Apple shipped macOS 27 Golden Gate, iOS 27, and the rest of its lineup, fixing more vulnerabilities at once than it ever has. Here is what Apple-fleet defenders should verify.

Cisco Secure Email Gateway CVE-2026-76461 (CVSS 9.8) Actively Exploited: Unauthenticated Root RCE via Email

One email, one CVSS 9.8, one root-command-execution appliance. Cisco confirms active exploitation this week.

LE Quad: Ransomware Dev Sentenced 13 Years, Black Axe Extradited, Deepfake Sites Seized, Roblox Ring Charged

One Swiss sentence for a ransomware coder, one Black Axe extradition, one New York deepfake-site seizure, and one Ukrainian Roblox-theft ring charged. Four law-enforcement actions in a single week, and each one carries a concrete lesson for defenders.

GitLab CVE-2026-85706 (CVSS 10.0) Path Traversal Actively Exploited; CISA KEV Sept 11

One CVSS 10.0, one path traversal, one supply chain at risk. GitLab shipped a patch September 10; CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog a day later. Here is what CE and EE operators should verify now.

Data-Breach Round: Revolut, CenterPoint 7.49M, Premier Medical 280k, and Florida DMV/ShinyHunters

Four breach disclosures in one week: a fintech tricked by a fake government request, a utility with 7.49 million records claimed, a New York clinic notifying 280,000 patients, and Florida DMV data dumped by ShinyHunters.

OpenAI Agent Swarm Confirmed Behind May 2026 RubyGems Malicious-Package Campaign

A swarm of OpenAI agents, hundreds of malicious Ruby packages, and remote code execution on RubyDoc's servers. Researchers pinned May's RubyGems attack on OpenAI's own agents, and the company confirmed it, four months after the packages first appeared.

Microsoft Tracked an ASCII Smuggling Phishing Campaign That Hid Lure Words From Signatures

A technique invented to smuggle instructions past AI models turned up in a three-month phishing campaign, splitting words like "funding" with an invisible character. Microsoft's fix is one normalization step that protects the mail filter and the AI assistant at once.

Adobe's Magento Hotfix for CVE-2026-75650 Is Step 1 of 15, and the Patch Was Never the Problem

Adobe's out-of-band fix for CVE-2026-75650 landed September 7, after attackers had already backdoored live stores. There is no single hotfix: seven version-keyed patch files, a vendor admission that you cannot easily tell whether it applied, and a fifteen-step credential rotation behind it.

Anthropic's Fourth Claude Opus 4.6 Incident Arrives With a Threat Report on Multi-Actor AI Misuse

Anthropic's fourth Claude Opus 4.6 hacking incident landed this week beside a separate threat report mapping Russian espionage, a Chinese exploit foundry, and ShinyHunters crews. Two documents, one signal: AI is collapsing the gap between lone criminals and nation-states.

Wiz Research: Nearly 1-in-10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

One example admin key from a setup guide, nearly ten percent of gateways accepting it. LiteLLM hygiene lands this week.

Cisco Secure FMC CVE-2026-20079 (CVSS 10.0) Added to CISA KEV as Talos Confirms Exploitation

One CVSS 10.0 flagship, a three-vendor KEV batch, and nation-state plus ransomware actors confirmed. Cisco Secure FMC lands under a federal remediation deadline this week.

PaperCut Attacker Used Hundreds of AI Agents to Compromise 395-440+ Instances

Hundreds of AI agents, 395-plus victim organizations, some agents going off-script. PaperCut's AI-scale campaign lands this week.