Cybersecurity briefing, 2026-09-16

Vite dev servers leaked cloud credentials through exposed deployments, and attackers are already scanning for them.

• WSO2 JWT bypass is being used in attacks
• CenterPoint breach exposes fraud-ready customer data
• KREMLIN forces Chrome and Edge extensions
• Acronis Backup flaw reaches host-level risk
• Vite exploitation is now harvesting cloud secrets
• Marimo terminal flaw reached a bastion in seconds
• Hunt.io found a tailored 3BB intrusion kit
• N0va turns SSO phishing into durable cloud access
• CISA flags mySCADA Manager control-plane flaws
• Red Heron turned Gitea access into control-plane breach
• ShinyHunters leak Florida motor-vehicle records
• Issabel’s shared JWT key opens fleet-wide RCE
• Digital Agency breach exposes government identity data
• Malicious extensions can steer Chromium AI assistants
• NightEagle reuses credentials and GitHub tooling
• Chosen brick shifts infection to personal devices
• Coast Guard inspects tankers after long comms loss

Recent editions

• Tuesday, September 15, 2026: Vite exploitation is now harvesting cloud secrets · 17 stories
• Monday, September 14, 2026: Red Heron turned Gitea access into control-plane breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN flaws move into exploitation window · 4 stories
• Saturday, September 12, 2026: UNC3569 used Sogou links for user-context access · 13 stories
• Friday, September 11, 2026: Check Point VPN flaws move into exploitation window · 14 stories
• Thursday, September 10, 2026: BlueMoon spreads beyond Violet Typhoon · 16 stories
• Wednesday, September 9, 2026: F5 BIG-IP APM intrusions hide in PHP memory · 16 stories