Weekly recap · Security Now #1095
7 – 13 September 2026
A record Patch Tuesday with two zero-days, Cisco FMC and N-central exploited, a rootkit on F5 BIG-IP, and AI agents used to breach 395 organizations via PaperCut.
Top stories
- September Patch Tuesday: record patch count, 2 zero-days and a “SigRed successor”
#vulnCRITICALZERO-DAYPATCH— Another record-breaking release; Windows CVE-2026-81963 and CVE-2026-85880 were added to KEV. Why it matters: a bug compared to the wormable SigRed DNS flaw plus in-the-wild zero-days means patch fast. Help Net Security · CISA KEV - Cisco FMC bugs exploited by nation-state and ransomware actors
#vulnCRITICALEXPLOITEDKEV— CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center. Why it matters: owning the management plane means owning every firewall it manages. Help Net Security - AI agents exploited PaperCut to breach 395 organizations
#threat#ai— A threat actor wrote a working exploit, then handed the mass break-in work to AI agents. Why it matters: AI-scaled exploitation compresses the window between disclosure and mass compromise. Help Net Security - Linux rootkit on F5 BIG-IP APM hides web shell in memory
#threat— Sophos found the implant avoids disk entirely. Help Net Security
Breaches & incidents
- IDScan confirms breach after 153M driver’s licences leak
#breach— Help Net Security - Mathspace: 1M+ students and parents exposed via unpatched Metabase
#breach— Help Net Security - Trezor customers phished after shipping-partner breach
#breach— About 67,000 more customers at risk. Help Net Security
Vulnerabilities & patches
- N-able N-central zero-day (CVE-2026-86218)
CRITICALZERO-DAYKEV— RCE in the MSP RMM platform; emergency hotfix. Help Net Security - Chrome zero-day CVE-2026-87491
HIGHZERO-DAYKEV— Fixed along with 230 other bugs. Help Net Security - Citrix NetScaler auth bypass CVE-2026-19490 and Fortinet CVE-2025-25249
EXPLOITEDKEV— Both added to KEV on 9 Sep. CISA KEV - MikroTik RouterOS chain hijacks devices with SSH exposed
CRITICALEXPLOITEDKEV— CERT Polska found six flaws; CVE-2026-86060 and CVE-2026-67277 are in KEV. Help Net Security - ScreenConnect, Artifactory and GitLab flaws join KEV
EXPLOITEDKEV— Five additions on 11 Sep, incl. ScreenConnect CVE-2026-84869 abused via rogue clients. The Hacker News · Help Net Security - “Zero-click” WeChat worm via a single call
CRITICALPATCH— Found and privately reported by Calif. Help Net Security
Threat intel & red team
- Threat actors give AI agents a bigger role
#threat#ai— Google research on agents automating scanning and credential attacks. Help Net Security - Help-desk vishing and calls to personal phones to steal M365 data
#threat— Help Net Security · Help Net Security - Phishing pages that exist only inside the victim’s browser
#threat— Blob URLs routed through genuine Microsoft OAuth and Teams infrastructure. Help Net Security - Passkey-themed social engineering leads to cloud compromise
#threat— Microsoft Security · The Hacker News - OpenAI agents linked to RubyGems campaign that got RCE on RubyDoc
#threat#ai— The Hacker News
Blue team & defense
- Unmasking SCCM application execution
#defense— SpecterOps - Token Analysis and Tracking System (TATS)
#defense— SpecterOps - Post-exploitation identity misuse in SPIFFE/SPIRE
#defense— Unit 42 - WordPress.org now auto-reviews every plugin release
#defense— Help Net Security - AI-Infra-Guard: scanner for Ollama, vLLM, MCP servers
#defense— Help Net Security
Industry, policy & developments
- CISA: Chinese AI firms distil US models at scale
#industry#ai— Help Net Security - Malone Lam pleads guilty over $245M crypto theft
#industry— Help Net Security - Kevin Mandia joins Amazon’s board
#industry— Help Net Security
Worth reading
- From findings to fixes: getting value from red team results
#learning— SpecterOps - Beyond Tier Zero
#learning— SpecterOps
Security Now cross-check
SN #1095 — “AI-Driven Expertise Loss” (8 Sep)
- Nvidia to acquire Hugging Face
#industry#ai— Steve discussed what consolidation of the main open-model hub means for the ecosystem. Transcript - CISA terminating its most valuable free services
#industry— Covered above. Tech Times · Transcript - AI-driven loss of expertise
#learning— A lifelong safety engineer on what happens when people stop building skills because AI does the work. Good food for thought for students. Transcript