📰 DAILY THREAT BRIEFING
Sunday, September 20, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of September 20, 2026.

  1. Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
    — The Hacker News

    Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex acco…
  2. BragJack attacks hijack AI browser agents through malicious extensions
    — Bleeping Computer

    BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity C…
  3. North Korean WaterPlum hackers infected 30,000 devices worldwide
    — Bleeping Computer

    A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from Dece…
  4. ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
    — Bleeping Computer

    The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stea…
  5. Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
    — The Hacker News

    A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actu…
  6. Identity Visibility in 2026: The Foundation of Identity Security
    — The Hacker News

    Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently r…
  7. HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
    — SANS ISC

    In June 2026 the IETF published RFC 10008[1], defining a new HTTP method: "QUERY". The HTTP protocol faced already by changes (HTTP/2, HTTP/…
  8. Vectra AI Launches Ascent to Help Address New Era of AI-Driven Attacks
    — Dark Reading

    The new program expands Vectra AI's partner strategy as increasingly complex security environments and the growing use of AI create demand f…
  9. Cisco Zero-Day Highlights API Endpoint Authentication Issues
    — Dark Reading

    The authentication bypass flaw CVE-2026-76460 impacts Cisco's Identity Services Engine (ISE) and received a maximum 10 out of 10 CVSS score.
  10. EY Survey Finds Autonomous AI Implementation Outpaces Oversight
    — Dark Reading

    A new survey of senior AI execs shows that while organizations are rapidly deploying AI and autonomous systems, their process and controls a…
  11. A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
    — Unit 42

    Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure yo…
  12. ISC Stormcast For Friday, September 18th, 2026 https://isc.sans.edu/podcastdetail/10100, (Fri, Sep 18th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14228 in last 30 days).
Critical: 1 · High: 6 · Medium: 8 · Low: 5. View full dashboard →

  1. CVE-2026-94057
    — CVSS 4.0 (MEDIUM)

    Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
  2. CVE-2026-94056
    — CVSS 7.5 (HIGH)

    Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
  3. CVE-2026-94055
    — CVSS 3.7 (LOW)

    Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
  4. CVE-2026-94054
    — CVSS 7.0 (HIGH)

    Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
  5. CVE-2026-93993
    — CVSS 8.8 (HIGH)

    Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout h…
  6. CVE-2026-93992
    — CVSS 8.1 (HIGH)

    Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entri…
  7. CVE-2026-93991
    — CVSS 7.7 (HIGH)

    Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotE…
  8. CVE-2026-93990
    — CVSS 7.5 (HIGH)

    Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that co…
  9. CVE-2026-93989
    — CVSS 3.1 (LOW)

    vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt …
  10. CVE-2026-93988
    — CVSS 6.5 (MEDIUM)

    QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences…
  11. CVE-2026-93956
    — CVSS 3.5 (LOW)

    A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of t…
  12. CVE-2026-93955
    — CVSS 4.3 (MEDIUM)

    A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java…
  13. CVE-2026-93954
    — CVSS 4.3 (MEDIUM)

    A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingCo…
  14. CVE-2026-94001
    — CVSS 6.5 (MEDIUM)

    A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permiss…
  15. CVE-2026-94000
    — CVSS 6.6 (MEDIUM)

    A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrat…
  16. CVE-2026-93999
    — CVSS 4.2 (MEDIUM)

    A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences fro…
  17. CVE-2026-93987
    — CVSS 3.4 (LOW)

    rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root,…
  18. CVE-2026-93986
    — CVSS 3.1 (LOW)

    rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward s…
  19. CVE-2026-93985
    — CVSS 9.9 (CRITICAL)

    OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project w…
  20. CVE-2026-93984
    — CVSS 5.3 (MEDIUM)

    OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID …

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · September 20, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com