Cybersecurity briefing, 2026-09-23

The first malware that makes its own attack decisions is here, and it means incident response can no longer assume there's a human on the other end.

• Dutch arrest splits ShinyHunters leadership story
• CISA puts SharePoint and RouterOS hits in KEV
• Microsoft seizes EvilTokens as AI drives BEC fraud
• CLOSEDQUORUM moves malware decisions into LLMs
• Naceri’s BigDiskBuster keeps Defender stale
• Colorado water utilities saw quiet OT tampering
• Indexed-btree hid npm malware in runtime code
• CrowdSec leak tied to stale GitHub token
• MemTensor packages steal developer secrets on install
• GitLab issue email token exposes code and CI
• WordPress attacks now write PHP outside site directories
• D-Link DAP-1360’s RCE leaves no patch path
• Relay networks hide AI abuse at scale
• Forescout shows segmentation often hides lateral paths
• BigCommerce finds app breach reaching storefronts
• NCC Group sees ransomware shift toward industry
• DepthFirst exploit puts Ubuntu containers on alert

Recent editions

• Tuesday, September 22, 2026: GitLab flaw hits KEV under active exploitation · 19 stories
• Monday, September 21, 2026: Zyxel switch exploit kept the door open · 20 stories
• Sunday, September 20, 2026: Orkes Conductor bug turns workflows into shell access · 5 stories
• Saturday, September 19, 2026: Redis TLS bug is already being exploited · 17 stories
• Friday, September 18, 2026: NightEagle reuses credentials and GitHub tooling · 17 stories
• Thursday, September 17, 2026: JCE flaw is turning Joomla sites into webshell hosts · 16 stories
• Wednesday, September 16, 2026: WSO2 JWT bypass is being used in attacks · 17 stories