Daily Cybersecurity Briefing — September 7, 2026

Your daily digest of the most critical cybersecurity developments from the past 24 hours. Covering actively exploited vulnerabilities, breaches, threat intelligence, cloud security, ICS/OT, AI threats, and more.

ACTIVELY EXPLOITED VULNERABILITIES

• CVE-2026-85046 — Google Chromium V8 Type Confusion: Added to CISA KEV on September 4, 2026. Affects Chromium-based browsers. FCEB agencies required to remediate immediately.

• CVE-2026-83548 — SonicWall SMA1000 SSRF (CVSS 10.0): Server-side request forgery allowing remote unauthenticated attackers to gain unauthorized access. SonicWall confirmed real-world attacks. CISA FCEB remediation deadline was September 5, 2026.

• CVE-2026-83549 — SonicWall SMA1000 OS Command Injection: Companion vulnerability to CVE-2026-83548, added to CISA KEV catalog in September 2026. Allows OS-level command execution on affected appliances.

• CVE-2026-82329 — JFrog Artifactory Improper Authentication: Added to CISA KEV. Attackers can gain unauthorized access to software artifact repositories, posing significant supply chain risk.

• CVE-2026-59822 — BerriAI LiteLLM Improper Authentication: Added to CISA KEV. LiteLLM is a widely-used open-source LLM proxy; exploitation could expose API credentials for multiple AI providers.

• CVE-2026-48710 — Kludex Starlette HTTP Request/Response Smuggling: Added to CISA KEV. Starlette is a widely-deployed Python ASGI framework; smuggling flaws can bypass security controls.

• CVE-2026-49869 — Kestra OSS OS Command Injection: Added to CISA KEV. Kestra is an open-source orchestration platform; exploitation grants arbitrary OS command execution on pipeline servers.

• CVE-2026-9586 — Sangoma Switchvox SQL Injection: Added to CISA KEV. Affects Sangoma's Switchvox VoIP platform, allowing database exfiltration via unauthenticated SQL injection.

• ASUS Control Center Enterprise (ACC) — Maximum-severity RCE: Researchers uncovered a critical vulnerability allowing remote attackers to seize full control. ASUS has issued an urgent patch; administrators should update immediately.

• MikroTik RouterOS — Unauthenticated Remote Access Flaw: Attackers are actively exploiting an unauthenticated remote access vulnerability. Network administrators worldwide are urged to patch immediately.

• Adobe Commerce / Magento Open Source — Zero-Day RCE: A newly discovered zero-day is being actively exploited to seize full control of online stores. Merchants should apply patches immediately and review for indicators of compromise.

BR3ACHES

• NATO Unclassified Document Leak (September 3, 2026): A collection of unclassified NATO documents spanning 2009–2024 was leaked online. Scope and actor attribution are under investigation.

• Dropbox — 5,000 Accounts Compromised: Attackers gained unauthorized access to approximately 5,000 Dropbox accounts. Microsoft cloud service patches were also rolled out this week in response to related threat activity.

• OnePoint Patient Care — 800,000 Individuals Affected: The Arizona-based hospice pharmacy disclosed a data breach affecting up to 800,000 individuals. The Inc Ransomware group has claimed responsibility. A Department of Health and Human Services investigation is expected.

THREATS & POLICY

• Trump Administration Cyber Strategy: The administration's 'Cyber Strategy for America' and accompanying Executive Order on Combating Cybercrime signal greater latitude for private-sector offensive cyber operations, more aggressive deterrence postures, and increased public-private coordination.

• Congress Examines National Counterintelligence Organization: The House Intelligence Committee held an open hearing on options to establish an enterprise-wide counterintelligence organization to address modern cyber threats from nation-state actors.

• AI-Powered Threat Actor Breaches Enterprise in Under 10 Hours: A documented incident revealed a human attacker using frontier AI models to breach an enterprise network and seize root credentials in less than 10 hours, signaling the acceleration of AI-assisted intrusion timelines.

CLOUD & SAAS SECURITY

• 2026 SaaS Breach Crisis — OAuth Abuse & Token Theft: Security researchers are flagging 2026 as the worst year yet for SaaS breaches, driven by OAuth abuse, token theft, and third-party trust failures. Most organizations remain structurally unprepared as autonomous workflows outpace security controls.

• Shadow AI Risk: SaaS applications integrating AI capabilities without proper governance controls are creating new breach vectors. SecurityWeek reports shadow AI as a major enabler of large-scale SaaS breaches.

• Google Cloud H1 2026 Threat Horizons Report: Identity issues were exploited as the initial access vector in 83% of cloud/SaaS incidents reviewed in H2 2025 incident response engagements.

IDENTITY & AUTHENTICATION

• Identity as the New Perimeter: Threat actors are exploiting session tokens and OAuth grants as primary attack paths. Token management, session monitoring, and credential hygiene are now classified as survival requirements by leading analysts.

• ShinyHunters OAuth Campaign: The 2026 SaaS breach crisis has been closely associated with the ShinyHunters threat group's use of OAuth token theft and identity compromise techniques across multiple high-profile targets.

• Google Android Developer Verification Enforcement (Sept 30, 2026): Google has announced that starting September 30, 2026, it will enforce developer verification requirements for Android app distribution in the first four countries, with major device-maker app stores participating.

MOBILE SECURITY

• CVE-2025-48595 — Android Privilege Escalation (CVSS 8.4): A high-severity Android flaw enabling privilege escalation without user interaction remains under active exploitation. Patched in Google's June 2026 Android security bulletin.

• Spyware & Adware Surge: Kaspersky reports Android spyware detections up 51% year-over-year and adware up 160% in H1 2025. Google Play Protect identified over 27 million malicious sideloaded apps in 2025, up from 13 million in 2024.

• Google Cracks Down on Accessibility-Abusing Android Apps: Google has tightened enforcement policies targeting Android apps that abuse the Accessibility Services API for surveillance and credential theft purposes.

ICS/OT/IoT

• Siemens ICS Advisory — Remote Code Execution: Siemens has issued a security advisory detailing multiple RCE vulnerabilities in industrial control system products used in manufacturing and energy sectors. Administrators should apply patches immediately.

• OT-Targeting Ransomware — Manufacturing Sector: A new ransomware variant specifically designed to target OT environments in manufacturing has been identified, exploiting known vulnerabilities in legacy systems to cause operational disruption.

• Midwest Water Treatment Facility Ransomware Attack: A water treatment facility in the Midwest fell victim to a ransomware attack, temporarily disrupting operations. Critical infrastructure operators are reminded to review network segmentation and backup procedures.

• CISA Emergency Directive — Critical Infrastructure ICS: CISA issued an emergency directive for organizations operating critical infrastructure relying on specific vulnerable ICS systems, outlining immediate mitigation actions required.

RESEARCH & TOOLS

• F5 Networks Enhanced WAF — AI Anomaly Detection: F5 has introduced AI-driven anomaly detection and virtual patching capabilities to its Web Application Firewall, enabling real-time blocking of active exploits at the request level and reducing zero-day exposure.

• Guardio Valuation Reaches $1.1 Billion: Browser security startup Guardio has achieved unicorn status with a $1.1B valuation, reflecting strong investor confidence in endpoint browser protection solutions.

• Deepfake Fraud Surge — Pindrop Research: A study of 1.2 billion customer calls by Pindrop found deepfake AI-led fraud cases surged 1,300% year-over-year, underscoring the urgent need for voice authentication and anti-spoofing controls.

AI SECURITY

• GPT-5.6 Sol Jailbreak — UK AI Security Institute (July 2026): The UK AISI broke GPT-5.6 Sol's cyber guardrails within hours, discovering 'universal jailbreaks' that unlocked autonomous exploit development. OpenAI reproduced the findings and shipped mitigated models (GPT-5.6 Sol and Luna) on August 6, 2026.

• AI API Key Theft — $600K Model Credits Stolen: A threat actor obtained an exposed researcher API key and consumed approximately $600,000 in model credits over three weeks before detection, highlighting the financial and operational risks of exposed AI credentials.

• OWASP LLM Top 10 — Prompt Injection Ranked #1: Prompt injection remains the top risk in the OWASP Top 10 for LLM Applications. The most capable models are disproportionately vulnerable, scoring highest on benchmarks while showing greatest susceptibility to adversarial attacks.

• CVE-2026-59822 — BerriAI LiteLLM Improper Authentication (CISA KEV): This widely-deployed AI proxy sits between applications and LLM APIs. Exploitation could allow attackers to intercept AI traffic, steal API keys, and pivot to connected AI services.

• Autonomous AI Attack Agents: Researchers warn that autonomous agent-driven attacks are now operational, with AI systems serving as adversaries that discover, refine, and execute attack strategies with minimal human involvement. The 56% rise in AI-driven attacks documented in 2026 reflects this accelerating trend.

UPCOMING CYBERSECURITY EVENTS

• AI in Cyber ANZ Online — September 8, 2026 | Auckland, New Zealand (Virtual)

• Attack Surface Management Virtual Summit — September 16, 2026 | Virtual

• GISEC Global — September 16–18, 2026 | Dubai World Trade Centre, UAE

• National Cyber Summit — September 22–24, 2026 | Huntsville, Alabama

• Cybersecurity Conference 2026 — September 22, 2026 | New York City, NY

• Gartner Security & Risk Management Summit (EMEA) — September 22–24, 2026 | London, UK

Sources

• CISA KEV Catalog — cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog

• The Hacker News — CISA Adds Seven Exploited Flaws — thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html

• SecurityWeek — Cyber Insights 2026: ICS — securityweek.com/cyber-insights-2026-the-ongoing-fight-to-secure-industrial-control-systems/

• CybersecurityNews.com — Weekly Newsletter September 2026 — cybersecuritynews.com/weekly-cybersecurity-newsletter-bulletin-sept-2026/

• SecurityWeek — Shadow AI SaaS Breaches — securityweek.com/the-shadow-ai-problem-how-saas-apps-are-quietly-enabling-massive-breaches/

• Malwarebytes — Android Qualcomm Bug — malwarebytes.com/blog/news/2026/03/high-severity-qualcomm-bug-hits-android-devices-in-targeted-attacks

• HCL Software — AI Exploit Chains 2026 — hcl-software.com/blog/bigfix/ai-exploit-chains-jailbreaks-and-daybreak-the-2026-ai-threat-landscape

• Viakoo — Daily OT Security News September 2026 — viakoo.com/blog/daily-ot-security-news-september-02-2026-2/

• National Cyber Summit 2026 — nationalcybersummit.com

• Cyber Defense Magazine — 2026 SaaS Breaches — cyberdefensemagazine.com/why-2026-will-be-the-year-of-saas-breaches/