Vulnerabilities & Patching
CISA added seven actively exploited flaws to its Known Exploited Vulnerabilities catalog on September 2. A CVSS 10.0 SonicWall SMA 1000 SSRF leads the list, and defenders are already seeing reverse shells and cryptocurrency miners dropped through the other bugs.
Policy & Government
The Financial Stability Board told G20 finance chiefs that frontier AI has made cyber risk the financial system's most immediate concern, and urged banks and their technology providers to plan for simultaneous disruption across multiple firms and shared dependencies.
Data Privacy
New polling commissioned by the Center for Democracy & Technology finds two-thirds of British adults won't trust the current government, or any future one, with access to their encrypted chats, as the UK presses tech firms for backdoor access under existing surveillance law.
Data Breaches
The ATF confirms a cyberattack hit a standalone system holding information on its investigation targets. The Qilin ransomware group claimed it, though the agency has not verified that. What is confirmed, what is not, and what defenders should take from the containment claim.
Policy & Government
Meta will pay $17 billion and rebuild how minors use Facebook and Instagram to settle a case brought by attorneys general from nearly every US state and territory, the largest coordinated state action yet against a platform over children's safety.
Industrial Control Systems (ICS)
CISA's red team got initial access to both a water utility and a government organization using nearly identical tradecraft. The water sector isolated and shut it down in minutes. The government sector never detected it. Detection and isolation, not prevention, decided the outcome.
Vulnerabilities & Patching
CISA added CVE-2026-21962, a maximum-severity Oracle HTTP Server and WebLogic Proxy Plug-in flaw, to its Known Exploited Vulnerabilities catalog with a three-day federal deadline. Oracle shipped the fix in January 2026, but unauthenticated HTTP exploitation has run for months. Patch and hunt now.
Artificial Intelligence (AI)
Alabama Attorney General Steve Marshall has subpoenaed OpenAI over the Hugging Face hack its own cybersecurity model caused, opening the first state-level investigation into whether the company's safety failures violated consumer-protection law.
Data Privacy
The Dutch Data Protection Authority hit Uber with an EUR 825 million fine (about USD 965 million), ruling that software deactivated driver accounts from 2018 to 2022 with no human review. Uber is appealing. Here is what platform operators should audit now.
Policy & Government
The U.S. Justice Department says TikTok and ByteDance will pay $400 million to resolve a 2024 child-privacy lawsuit alleging COPPA violations. The deal pays $300 million now and $100 million once a court vacates an earlier Musical.ly consent decree.
Industrial Control Systems (ICS)
Five US agencies, led by NSA, FBI and CISA, warn that an active campaign is using AI-assisted development to build tools targeting internet-exposed Siemens S7 Series PLCs, in what may be the first US-agency flag of AI-assisted tradecraft against OT.
Vulnerabilities & Patching
CISA added four actively exploited flaws to its KEV catalog: Apple macOS (CVE-2026-65400, CVSS 9.8), Microsoft SharePoint, VMware vCenter, and Microsoft IKE. Two are internet-facing remote code execution bugs used to plant backdoors and ransomware. Federal patch deadline: August 21.