Cybersecurity briefing, 2026-09-12

A Sogou link flaw gave UNC3569 user-context access and loaded GRAYRABBIT on Windows hosts.

• UNC3569 used Sogou links for user-context access
• Midnight Blizzard used Claude to chase detection
• Brevo SSO flaw pushed phishing across customers
• EU CRA starts the 24-hour reporting clock
• Check Point VPN flaws move into exploitation window
• Microsoft flags million-message BEC fraud run
• CISA warns its own capacity may fail first
• UAC-0099 tries to blind AI malware review
• IDScan cloud breach exposes centralized ID scans
• Surfshark exposes internal servers to the internet
• JeetBot turns Twitch extensions into token theft
• Florida DMV breach followed a police credential
• Rclone PoCs put unpatched S3 services at risk

Recent editions

• Friday, September 11, 2026: Check Point VPN flaws move into exploitation window · 14 stories
• Thursday, September 10, 2026: BlueMoon spreads beyond Violet Typhoon · 16 stories
• Wednesday, September 9, 2026: F5 BIG-IP APM intrusions hide in PHP memory · 16 stories
• Tuesday, September 8, 2026: Microsoft's 974-fix update includes two exploited Windows flaws · 16 stories
• Monday, September 7, 2026: N-central Hotfix 4 supersedes yesterday’s patch · 18 stories
• Sunday, September 6, 2026: TeamCity breach reached JetBrains Cadence backup · 6 stories
• Saturday, September 5, 2026: UTA0565 broadens Chrome zero-day delivery · 16 stories