Cybersecurity News | Daily Recap [23 Sep 2026]

hendryadrian.com

hendryadrian.com

AI & Policy

• AI leadership and regulation remain a top priority, with the U.K. warning attackers may benefit more than defenders while U.S. officials and lawmakers push new AI-cyber test and defense programs. – AI Mission, UK Warning, AI Test Act, Hands-Off AI
• Security teams are rapidly adopting AI for OT and agent security, but autonomy is still limited as new tools aim to control AI-driven systems more safely. – OT AI, Claude Opus, Prismor
• Researchers also disclosed AI-powered malware that can choose attack actions dynamically, underscoring how machine learning is being weaponized by threat actors. – ClosedQuorum, AI Malware

Exploited Zero-Days

• F5 rushed fixes for a BIG-IP APM zero-day used in RCE attacks, with a separate report calling the flaw critical and actively exploited. – F5 Zero-Day, BIG-IP Exploit
• Check Point warned that a management server zero-day is being exploited in targeted attacks, prompting immediate patching guidance. – CP Zero-Day, CP Patch
• Arista urged urgent updates after an exploited VCO zero-day was found in the wild. – Arista VCO
• WordPress released security patches for a critical unauthenticated path traversal flaw, and another advisory warned some servers could face code execution. – WordPress CVE, WP RCE

Threat Actors & Takedowns

• Microsoft and partners disrupted EvilTokens, a phishing and fraud service tied to access across 12,000 inboxes, while UK police arrested two suspects linked to the operation. – EvilTokens Takedown, UK Arrests, Cybercrime Service
• ShinyHunters claimed a breach of the FBI using an Oracle PeopleSoft zero-day, alleging access to data on nearly all agents and applicants. – FBI Claim, FBI Attack, PeopleSoft Breach
• LAPSUS$ resurfaced when a brief hijack redirected Elsevier domains to a “Chapter II” page, highlighting continued brand abuse and nuisance attacks. – Elsevier Hijack
• A Ryuk ransomware member was sentenced to 24 months in prison for attacks against U.S. organizations, including victims in Michigan, Texas, and Oregon. – Ryuk Sentence
• Nightmare Eclipse released a new Microsoft Defender exploit after revealing its identity, adding another publicly shared offensive tool to the mix. – Defender Exploit

Supply Chain & Malware

• A malicious npm package posing as a Twilio bug-bounty probe was found capable of stealing credentials, reinforcing ongoing supply-chain risk. – Twilio npm
• Researchers reported a new Windows malware family, ClosedQuorum, that uses AI to decide its next move and could make attacks harder to detect. – ClosedQuorum

Data Breaches & Privacy

• BigCommerce said data was stolen through a Ribon Apps compromise, adding another third-party breach to the week’s incident list. – BigCommerce Breach
• Canada opened a privacy probe into IDScan after an alleged breach, while Sweden fined Miljödata $183,000 over a breach affecting 2.2 million people. – Canada Probe, Sweden Fine
• Chinese threat actors were spotted exploiting WordPress, Zyxel, Chrome, and Microsoft flaws to steal government data, showing continued focus on public-sector targets. – China Govt Theft, Chrome/Microsoft Chain

Defensive Tools & Detection

• New tools and guidance focused on reducing visibility gaps, stopping scam attempts, and testing for bad-bot activity across the web. – Wazuh, Scamwise, Bad Bots
• External MFA providers were shown to potentially steal passwords during login flows, exposing a dangerous authentication weakness. – MFA Risk

Industry & Security Market

• Cyera raised $400 million at a valuation above $12 billion, reflecting continued investor appetite for cybersecurity platforms. – Cyera Funding

Cybersecurity News | Daily Recap – hendryadrian.com