Cybersecurity briefing, 2026-09-24

When a relay owns the credentials, account identity stops telling you who is actually making the request.

• ShinyHunters Claim FBIjobs Records Theft via PeopleSoft
• WordPress Exploits Move From PoC to Takeover
• MikroTik RouterOS Chain Enabled Unauthenticated Takeover
• Proofpoint Finds TeamFiltration on Forgotten Microsoft 365 Accounts
• AI Tests Cross Into Real-World Authority
• Microsoft Seizes EvilTokens as AI Drives BEC Fraud
• CLOSEDQUORUM Moves Malware Decisions Into LLMs
• Relay Networks Hide AI Abuse at Scale
• Elsevier Redirect Hijack Reached Three Portals
• MemTensor Packages Steal Developer Secrets on Install
• Dark Sourcery Poisons AI Search Results
• D-Link DAP-1360’s RCE Leaves No Patch Path
• GitLab Issue Email Token Exposes Code and CI
• SolarWinds Fixes Two Unauthenticated RCE Flaws

Recent editions

• Wednesday, September 23, 2026: ShinyHunters Claim FBIjobs Records Theft via PeopleSoft · 17 stories
• Tuesday, September 22, 2026: GitLab Flaw Hits KEV Under Active Exploitation · 19 stories
• Monday, September 21, 2026: Zyxel Switch Exploit Kept the Door Open · 19 stories
• Sunday, September 20, 2026: Orkes Conductor Bug Turns Workflows Into Shell Access · 5 stories
• Saturday, September 19, 2026: Orkes Conductor Bug Turns Workflows Into Shell Access · 16 stories
• Friday, September 18, 2026: Redis TLS Bug Is Already Being Exploited · 17 stories
• Thursday, September 17, 2026: JCE Flaw Is Turning Joomla Sites Into Webshell Hosts · 16 stories