📰 DAILY THREAT BRIEFING
Friday, September 18, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of September 18, 2026.

  1. [Virtual Event] Cybersecurity Outlook 2027
    — Dark Reading
  2. Inside the Modern SOC: Defending the Cross-Environment Pivot
    — Unit 42

    Cross-environment attacks demand a new approach to security operations. Learn how Unit 42 Managed XSIAM helps SOC teams investigate complete…
  3. New RatHat Android malware uses AI to automate device control
    — Bleeping Computer

    A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate…
  4. CISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus
    — Dark Reading

    The move is consistent with the agency's advice on the need for organizations to prioritize the vulnerabilities that actually matter.
  5. China's FamousSparrow APT Spies on US Politics in Latin America
    — Dark Reading

    Amid the US and China's fight for eco-colonial influence in Latin America, a stealthy backdoor has taken flight.
  6. OpenAI details more cases of AI agents taking unauthorized actions
    — Bleeping Computer

    OpenAI has presented new examples of what they call "AI model misalignment" from the past six months, including unauthorized file uploads,…
  7. Brevo supply-chain attack injected ClickFix scripts on customer sites
    — Bleeping Computer

    Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript …
  8. LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)
    — SANS ISC

    At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not …
  9. Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
    — The Hacker News

    Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in …
  10. Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
    — The Hacker News

    A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actu…
  11. CISO's Expert Guide to Agentic Pentesting for Websites
    — The Hacker News

    Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to pa…
  12. ISC Stormcast For Thursday, September 17th, 2026 https://isc.sans.edu/podcastdetail/10098, (Thu, Sep 17th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14758 in last 30 days).
Critical: 11 · High: 7 · Medium: 2 · Low: 0. View full dashboard →

  1. CVE-2026-93436
    — CVSS 7.5 (HIGH)

    vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-wo…
  2. CVE-2026-93435
    — CVSS 7.5 (HIGH)

    redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers …
  3. CVE-2026-87886
    — CVSS 7.8 (HIGH)

    Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before …
  4. CVE-2026-87701
    — CVSS 9.6 (CRITICAL)

    Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
  5. CVE-2026-85917
    — CVSS 7.5 (HIGH)

    Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
  6. CVE-2026-85889
    — CVSS 10.0 (CRITICAL)

    Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
  7. CVE-2026-85885
    — CVSS 9.9 (CRITICAL)

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
  8. CVE-2026-83944
    — CVSS 10.0 (CRITICAL)

    Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
  9. CVE-2026-78501
    — CVSS 7.4 (HIGH)

    Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
  10. CVE-2026-77903
    — CVSS 9.0 (CRITICAL)

    Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
  11. CVE-2026-70200
    — CVSS 10.0 (CRITICAL)

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
  12. CVE-2026-70009
    — CVSS 9.3 (CRITICAL)

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
  13. CVE-2026-69865
    — CVSS 10.0 (CRITICAL)

    Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
  14. CVE-2026-69399
    — CVSS 10.0 (CRITICAL)

    Azure Arc Elevation of Privilege Vulnerability
  15. CVE-2026-68791
    — CVSS 8.6 (HIGH)

    Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
  16. CVE-2026-55946
    — CVSS 6.1 (MEDIUM)

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
  17. CVE-2026-93426
    — CVSS 8.5 (HIGH)

    SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks…
  18. CVE-2026-93307
    — CVSS 4.3 (MEDIUM)

    A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory alloc…
  19. CVE-2026-54767
    — CVSS 9.1 (CRITICAL)

    WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded c…
  20. CVE-2026-54734
    — CVSS 10.0 (CRITICAL)

    Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · September 18, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com