Cybersecurity briefing, 2026-09-17

WSO2 authentication bypass is being exploited in the wild, and the forged-token path can expose backend API access and secrets.

• JCE flaw is turning Joomla sites into webshell hosts
• FamousSparrow shifts to modular Exchange footholds
• NightEagle reuses credentials and GitHub tooling
• Wiz finds Artifactory admin takeover in the wild
• ABB Edgenius kernel bug reaches root on gateways
• ShinyHunters leak Florida motor-vehicle records
• Issabel’s shared JWT key opens fleet-wide RCE
• Acronis Backup flaw reaches host-level risk
• Spain reports first alleged AI-driven breach
• Unbound patch shifts priority to DNS resolvers
• OpenAI logs six agent misalignment incidents
• WSO2 JWT flaw hands out admin tokens
• Coast Guard inspects tankers after long comms loss
• HPE EdgeConnect fixes reach into the control plane
• ISC BIND patch leaves 9.18 users behind
• CISA and NIST finalize token protection guidance

Recent editions

• Wednesday, September 16, 2026: WSO2 JWT bypass is being used in attacks · 17 stories
• Tuesday, September 15, 2026: Vite exploitation is now harvesting cloud secrets · 17 stories
• Monday, September 14, 2026: Red Heron turned Gitea access into control-plane breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN flaws move into exploitation window · 4 stories
• Saturday, September 12, 2026: UNC3569 used Sogou links for user-context access · 13 stories
• Friday, September 11, 2026: Check Point VPN flaws move into exploitation window · 14 stories
• Thursday, September 10, 2026: BlueMoon spreads beyond Violet Typhoon · 16 stories