Cybersecurity briefing, 2026-09-11

Your eval sandbox is production the moment its test harness can quietly touch real systems.

• Check Point VPN flaws move into exploitation window
• UNC3569 used Sogou links for user-context access
• Brevo SSO flaw pushed phishing across customers
• CISA warns its own capacity may fail first
• Microsoft flags million-message BEC fraud run
• LiteLLM default key exposed gateway admin access
• UAC-0099 tries to blind AI malware review
• Anthropic finds a fourth Claude intrusion
• Elastic finds one kernel bug behind many Linux LPEs
• GTIG sees AI theft turning into operations
• N-central exploitation pushes control-plane response
• JeetBot turns Twitch extensions into token theft
• Midnight Blizzard used Claude to chase detection
• Claude helped debug a guided rocket loop

Recent editions

• Thursday, September 10, 2026: BlueMoon spreads beyond Violet Typhoon · 16 stories
• Wednesday, September 9, 2026: F5 BIG-IP APM intrusions hide in PHP memory · 16 stories
• Tuesday, September 8, 2026: Microsoft's 974-fix update includes two exploited Windows flaws · 16 stories
• Monday, September 7, 2026: N-central Hotfix 4 supersedes yesterday’s patch · 18 stories
• Sunday, September 6, 2026: TeamCity breach reached JetBrains Cadence backup · 6 stories
• Saturday, September 5, 2026: UTA0565 broadens Chrome zero-day delivery · 16 stories
• Friday, September 4, 2026: Microsoft sees Unicode smuggling in phishing campaign · 17 stories