Cybersecurity briefing, 2026-09-01

The newest malware isn't trying to hide from your scanner.

• Malicious Composer themes turned sites into iPhone spyware
• Fire Ant targets the network trust layer
• McKesson breach shifts into public leak pressure
• Claude sessions stolen to burn paid usage
• UAC-0099 uses AI guardrails against analysts
• Langflow probes spread into Rails secrets theft
• PaperCut zero-days shift from access to theft
• Mirage Kitten hides RATs in coding tests
• US seizure cuts off QTFY’s hidden traffic layer
• ServiceNow patches four flaws in AI Platform
• USCG centralizes maritime cyber policy and enforcement
• Microsoft tracks counterfeit installers to endpoint compromise
• Breeze Comet pushes fraud through payment rails
• GTIG sees AI speed up real attacks
• FSB warns frontier AI could sync financial disruption
• Claude ported a WAGO PLC exploit across models
• Texas launches Watershed 250 for water cyber support
• Tenda PoCs exploit default-state router trust

Recent editions

• Monday, August 31, 2026: McKesson breach shifts into public leak pressure · 18 stories
• Sunday, August 30, 2026: FulcrumSec turns MAG breach into leak threat · 5 stories
• Saturday, August 29, 2026: GTIG sees AI speed up real attacks · 14 stories
• Friday, August 28, 2026: PaperCut’s exploit chain splits into two CVEs · 18 stories
• Thursday, August 27, 2026: TeamPCP arrests open a forensic phase · 17 stories
• Wednesday, August 26, 2026: miniOrange SAML bugs now see PoC scanning · 16 stories
• Tuesday, August 25, 2026: Defender flaw now has a PoC and federal clock · 17 stories