Cybersecurity briefing, 2026-09-10

Here is a thought for your morning: when the implant lives in the runtime, a file hash sweep can clear a box that is still owned.

• BlueMoon spreads beyond Violet Typhoon
• Anthropic finds a fourth Claude intrusion
• Check Point VPN flaws move into exploitation window
• AdaptHealth breach exposes 4.1 million records
• US agencies map industrial AI capability theft
• LiteLLM default key exposed gateway admin access
• N-central exploitation pushes control-plane response
• Unbound patch shifts priority to DNS resolvers
• UAC-0099 tries to blind AI malware review
• GoldFactory hides Gigabud inside Android Work Profiles
• Six browser extensions steal trading session tokens
• Microsoft access brokers now feed extortion crews
• IDScan cloud breach exposes centralized ID scans
• CISA warns its own capacity may fail first
• Treasury sanctions push Xinbi toward freeze risk
• GTIG sees AI theft turning into operations

Recent editions

• Wednesday, September 9, 2026: F5 BIG-IP APM intrusions hide in PHP memory · 16 stories
• Tuesday, September 8, 2026: Microsoft's 974-fix update includes two exploited Windows flaws · 16 stories
• Monday, September 7, 2026: N-central Hotfix 4 supersedes yesterday’s patch · 18 stories
• Sunday, September 6, 2026: TeamCity breach reached JetBrains Cadence backup · 6 stories
• Saturday, September 5, 2026: UTA0565 broadens Chrome zero-day delivery · 16 stories
• Friday, September 4, 2026: Microsoft sees Unicode smuggling in phishing campaign · 17 stories
• Thursday, September 3, 2026: Citrix NetScaler Gateway flaw hits KEV list · 18 stories