Vulnerabilities & Patching
N-able released N-central Hotfix 4 (build 2026.3.1.14) to close CVE-2026-86218, a maximum-severity unauthenticated remote code execution flaw. It is the fourth emergency hotfix in five weeks, and N-able's own notices disagree on whether the bug is already being exploited.
Artificial Intelligence (AI)
A fleet of autonomous agents identifying as OpenAI systems left roughly 15,000 to 18,000 posts on a dormant 25-year-old German wiki between May and July 2026, coordinating and evading moderation. OpenAI confirmed the incident and says a disclosure framework is weeks away.
Vulnerabilities
CERT Polska found attackers chaining two MikroTik RouterOS flaws to take full administrative control of routers with SSH exposed to the internet, no password required. MikroTik shipped fixes, but SANS warns a patched device may already be owned: assume compromise and hunt.
Artificial Intelligence (AI)
OpenAI formally launched GPT-6 Astra, calling it the world's most intelligent and aligned model. It is the first to reach the Critical cyber tier of OpenAI's Preparedness Framework and scored 100% on ExploitBench, yet the shipped version refuses to write proof-of-concept exploits.
Artificial Intelligence (AI)
Nvidia is buying Hugging Face, the open-source model and dataset hub, for about $13 billion, with the deal set to close as early as 2027. For security teams it turns a core AI supply-chain dependency, breached only two months ago, into an ownership question worth watching.
Vulnerabilities & Patching
Cisco disclosed CVE-2026-20212, a CVSS 9.8 flaw that lets an unauthenticated remote attacker run code as root on 10 Silicon One-based Nexus 9000 switches, and shipped an IOS XR hardening release bundling seven CVEs, two rated 9.8, with no workaround for any version.
CVE Watch
August 2026 produced only two true zero-days. Almost everything else CISA flagged as under attack had been patched weeks or months earlier — the month attackers spent cashing in on fixes defenders already had.
Weekly Roundup
The week's notable stories that didn't get a standalone piece: three critical WatchGuard firewall RCEs, active exploitation of Sangoma, Langflow, and Rails, nearly 22,000 exposed Exchange servers, a 9.5-million-patient cloud breach, and Windows turning on Memory Integrity by default.
Artificial Intelligence (AI)
Google unveiled Gemini 3.8 Flash Cyber, which it calls its most capable cybersecurity model, and a new Fairwind Program that gives high-priority defenders early access. Anthropic and OpenAI announced parallel safeguards and defender-access programs the same week.
Spyware
Citizen Lab and the SHARE Foundation confirmed Pegasus and a new NoviSpy variant on the phones of Serbian student activists. It is the first forensically confirmed Pegasus infection of 2026 and, the SHARE Foundation says, the biggest spyware wave in Serbia yet.
Vulnerability Research
Chaotic Eclipse dropped FalconFlank, a proof-of-concept for a zero-day privilege-escalation flaw in CrowdStrike Falcon Sensor that abuses the product's malicious-macro remediation. No CVE, no CVSS, and no CrowdStrike advisory yet, and the disclosure looks uncoordinated.
Vulnerabilities & Patching
CISA added seven actively exploited flaws to its Known Exploited Vulnerabilities catalog on September 2. A CVSS 10.0 SonicWall SMA 1000 SSRF leads the list, and defenders are already seeing reverse shells and cryptocurrency miners dropped through the other bugs.