Cybersecurity briefing, 2026-09-07

An attack technique built to fool AI is now smuggling phishing lures past email filters that read words.

• N-central Hotfix 4 supersedes yesterday’s patch
• Artifactory chaining gave attackers admin backdoors
• UTA0565 broadens Chrome zero-day delivery
• TeamCity breach reached JetBrains Cadence backup
• Adobe Commerce exploit now needs key rotation
• Wordfence sees mass WordPress shell drops
• CrowdStrike Falcon mitigation leaves macro cleanup gap
• Microsoft sees Unicode smuggling in phishing campaign
• Citrix NetScaler Gateway flaw hits KEV list
• Telerik UI PoC exposes a narrow RCE path
• Frontier models cross into autonomous exploit work
• CISA and G7 push PQC into procurement
• PREY-0058 moves from vishing to extortion
• VMware patches guest-to-host bugs as vCenter fires burn
• ShipMonk breach broke Trezor's deletion assumption
• Rhysida moves Berlin theft into auction mode
• OpenAI agents kept editing DseWiki for months
• OpenAI backs Daybreak for short-window defenders

Recent editions

• Sunday, September 6, 2026: TeamCity breach reached JetBrains Cadence backup · 6 stories
• Saturday, September 5, 2026: UTA0565 broadens Chrome zero-day delivery · 16 stories
• Friday, September 4, 2026: Microsoft sees Unicode smuggling in phishing campaign · 17 stories
• Thursday, September 3, 2026: Citrix NetScaler Gateway flaw hits KEV list · 18 stories
• Wednesday, September 2, 2026: Virtualizor update hijack puts VPS hosts at risk · 17 stories
• Tuesday, September 1, 2026: Malicious Composer themes turned sites into iPhone spyware · 18 stories
• Monday, August 31, 2026: McKesson breach shifts into public leak pressure · 18 stories