Cybersecurity briefing, 2026-09-02

When the routers and authentication servers fall, your incident logs stop being yours.

• Virtualizor update hijack puts VPS hosts at risk
• Sality’s own trust model enabled the takedown
• PREY-0058 moves from vishing to extortion
• Booz Allen puts AI attack power on identity
• PaperCut zero-days shift from access to theft
• Exchange servers leave mailboxes open to hijack
• Cleo Harmony PoC shrinks the fix window
• Malicious Composer themes turned sites into iPhone spyware
• Langflow probes spread into Rails secrets theft
• Anthropic pushes Claude misuse logs into customer clouds
• Claude ported a WAGO PLC exploit across models
• Wordfence finds restore-triggered WordPress takeover bug
• Microsoft tracks counterfeit installers to endpoint compromise
• Fire Ant targets the network trust layer
• Freelance malware case reaches U.S. court
• Berlin's delay likely broadened Rhysida's haul
• USCG centralizes maritime cyber policy and enforcement

Recent editions

• Tuesday, September 1, 2026: Malicious Composer themes turned sites into iPhone spyware · 18 stories
• Monday, August 31, 2026: McKesson breach shifts into public leak pressure · 18 stories
• Sunday, August 30, 2026: FulcrumSec turns MAG breach into leak threat · 5 stories
• Saturday, August 29, 2026: GTIG sees AI speed up real attacks · 14 stories
• Friday, August 28, 2026: PaperCut’s exploit chain splits into two CVEs · 18 stories
• Thursday, August 27, 2026: TeamPCP arrests open a forensic phase · 17 stories
• Wednesday, August 26, 2026: miniOrange SAML bugs now see PoC scanning · 16 stories