Cybersecurity News | Daily Recap [10 Sep 2026]

hendryadrian.com

hendryadrian.com

AI & Threat Intel

• U.S. officials and security leaders warned that AI is accelerating adversaries’ capabilities, forcing governments and CISOs to balance innovation with security while focusing on basics like patching and threat sharing – AI Security, FBI AI, CISO Risks
• Researchers said attackers are abusing stolen AI artifacts, with infostealer logs exposing replayable AI tokens that can bypass MFA, while Chinese firms were accused of extracting billions of tokens from frontier models – AI Tokens, Frontier Models

Exploits & Patching

• Cisco confirmed active exploitation of CVE-2026-20079 in Secure FMC, likely alongside CVE-2026-20316, with nation-state and ransomware actors targeting the flaws for root-level access – Cisco FMC, Exploited Bugs
• WatchGuard RCE flaws are now being used in ransomware attacks, and Android September updates patched 180 vulnerabilities across the platform – WatchGuard RCE, Android Patches
• Four spy groups were seen using the same Chrome and Windows exploit chain within a week, underscoring rapid reuse of zero-days by advanced operators – Spy Groups

Phishing & Credential Theft

• Attackers are calling employees’ personal phones to break into Microsoft 365 accounts, while new browser-only phishing pages hide entirely inside victims’ browsers to evade detection – M365 Calls, Browser Phishing
• Trezor warned users after an email provider breach triggered phishing attempts, and GitGuardian showcased a Honeytoken tool designed to catch credential theft in real time – Trezor Phishing, Honeytoken

Ransomware & Breaches

• AdaptHealth said a July cyberattack exposed data on 4.1 million people, while Veradigm disclosed a patient data breach after a ransomware gang claimed responsibility – AdaptHealth, Veradigm
• Skullcandy Dime 3 earbuds were found vulnerable to Bluetooth hijacking via CVE-2025-20701, allowing nearby rogue devices to pair and seize audio – Skullcandy Bug

Scams & Law Enforcement

• The U.S. disrupted the Xinbi Guarantee scam marketplace and froze $52.8 million in crypto tied to the cybercrime economy – Xinbi Raid, Market Disruption
• Lawmakers urged Treasury sanctions against India-linked hackers-for-hire, as the FTC rolled back a policy requiring health apps to notify users after breaches – Hack-for-Hire, FTC Policy

Security Industry & Products

• WordPress added automated security checks to block risky plugin releases, while OpenSSL released a new alpha build that speeds up post-quantum cryptography – WordPress Checks, OpenSSL Alpha
• Scytale expanded AI-powered third-party risk management, Orchid Security added drift detection and kill switches for AI agents, and HelmGuard raised $7.3 million for agentic GRC – Scytale TPRM, Orchid AI, HelmGuard

Policy & Leadership

• CISA leaders said the agency must move faster to avoid the “worst that could happen,” while the FBI cyber chief warned that the private sector is not sharing enough threat intelligence – CISA Warning, FBI Sharing
• Google warned that AI is giving lesser-resourced attackers nation-state-level reach, and a profile of hacker Vinnie Liu highlighted the human side of cybercrime – Google Warning, Hacker Conversations

Privacy & Other News

• Grindr settled a privacy lawsuit for $35 million over disclosures of users’ HIV statuses, and Microsoft fixed Windows bugs that reset mouse and desktop settings – Grindr Settlement, Mouse Bug, Desktop Bug

Cybersecurity News | Daily Recap – hendryadrian.com