Cybersecurity briefing, 2026-09-17

WSO2 authentication bypass is being exploited in the wild, and the forged-token path can expose backend API access and secrets.

• WSO2 JWT Bypass Is Being Used in Attacks
• NightEagle Reuses Credentials and GitHub Tooling
• Issabel’s Shared JWT Key Opens Fleet-Wide RCE
• ShinyHunters Leak Florida Motor-Vehicle Records
• Chosen Brick Shifts Infection to Personal Devices
• Acronis Backup Flaw Reaches Host-Level Risk
• KREMLIN Forces Chrome and Edge Extensions
• Coast Guard Boards Tankers After Suspected Cyber Intrusions
• GTIG Sees AI Theft Turning Into Operations
• CenterPoint Breach Exposes Fraud-Ready Customer Data
• N0va Turns SSO Phishing into Durable Cloud Access
• Browser Extensions Broke the AI Trust Boundary
• CISA and NIST Finalize Token Protection Guidance
• CISA Adds Decoys to the Detection Toolkit
• Chrome and Firefox Ship Large Security Batches

Recent editions

• Wednesday, September 16, 2026: WSO2 JWT Bypass Is Being Used in Attacks · 17 stories
• Tuesday, September 15, 2026: Vite Exploitation Is Now Harvesting Cloud Secrets · 17 stories
• Monday, September 14, 2026: Red Heron Turned Gitea Access into Control-Plane Breach · 15 stories
• Sunday, September 13, 2026: Check Point VPN Flaws Move Into Exploitation Window · 4 stories
• Saturday, September 12, 2026: UNC3569 Used Sogou Links for User-Context Access · 13 stories
• Friday, September 11, 2026: Check Point VPN Flaws Move Into Exploitation Window · 14 stories
• Thursday, September 10, 2026: BlueMoon Spreads Beyond Violet Typhoon · 16 stories