Cybersecurity briefing, 2026-09-11

Your eval sandbox is production the moment its test harness can quietly touch real systems.

• LiteLLM Default Key Exposed Gateway Admin Access
• N-central Exploitation Pushes Control-Plane Response
• Unit 42 Shows Node Root Can Steal SPIRE Identities
• GoldFactory Hides Gigabud Inside Android Work Profiles
• Google Play Early Access Hides Ad-Fraud Apps
• Panzer Adds ESXi to Its Extortion Kit
• PuzzleMask Makes Guardrails Trust the Wrong Text
• Check Point VPN Bugs Leave Legacy Branches Exposed
• Anthropic Finds a Fourth Claude Intrusion
• CISA Warns Its Own Capacity May Fail First
• Microsoft Access Brokers Now Feed Extortion Crews
• Lawmakers Push BellTroX Toward Export Controls