Cybersecurity briefing, 2026-09-15

Marimo terminal flaw reached an SSH bastion in seconds after a notebook open, showing how fast a missed endpoint check can turn into cloud access.

• Vite exploitation is now harvesting cloud secrets
• HBO Max Reddit Ads were turned into malware
• Red Heron turned Gitea access into control-plane breach
• Acronis Backup flaw reaches host-level risk
• CISA flags Digital Watchdog Recorders for full control
• JeetBot turns Twitch extensions into token theft
• GTIG sees AI theft turning into operations
• OpenAI replays a sandbox escape at Black Hat
• BambooToken uses token software to hide on workstations
• Marimo terminal flaw reached a bastion in seconds
• Revolut data leak came through trusted email
• UNC3569 used Sogou links for user-context access
• KREMLIN forces Chrome and Edge extensions
• Chosen brick shifts infection to personal devices
• CenterPoint breach exposes fraud-ready customer data
• Hunt.io found a tailored 3BB intrusion kit
• AI adoption is outrunning agent governance

Recent editions

• Monday, September 14, 2026: Red Heron turned Gitea access into control-plane breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN flaws move into exploitation window · 4 stories
• Saturday, September 12, 2026: UNC3569 used Sogou links for user-context access · 13 stories
• Friday, September 11, 2026: Check Point VPN flaws move into exploitation window · 14 stories
• Thursday, September 10, 2026: BlueMoon spreads beyond Violet Typhoon · 16 stories
• Wednesday, September 9, 2026: F5 BIG-IP APM intrusions hide in PHP memory · 16 stories
• Tuesday, September 8, 2026: Microsoft's 974-fix update includes two exploited Windows flaws · 16 stories