📰 DAILY THREAT BRIEFING
Monday, September 28, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of September 28, 2026.

  1. Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950), (Mon, Sep 28th)
    — SANS ISC

    Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerab…
  2. One Packet Can Crash OT Servers in Industrial Sectors
    — Dark Reading

    A high-severity zero-day vulnerability affects the TDengine time-series database used across industrial, IoT, energy, and automotive environ…
  3. Japan's Keio confirms ransomware attack disrupted business systems
    — Bleeping Computer

    Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrup…
  4. Times Car confirms data breach affecting 6.6 million user accounts
    — Bleeping Computer

    Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclose…
  5. Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
    — Dark Reading

    The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.
  6. Dutch police confirm arrest in ShinyHunters hacking investigation
    — Bleeping Computer

    Dutch police have confirmed that a 24-year-old Amsterdam man arrested earlier this month was detained as part of an investigation into the S…
  7. Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
    — The Hacker News

    Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploi…
  8. AI Agents Are Privileged Users; Who Is Auditing Their Access?
    — Dark Reading

    Enterprises regularly rigorously monitor human employees, while autonomous AI agents quietly operate with broad privileges that could turn t…
  9. Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
    — The Hacker News

  10. IAM for AI agents: A Practical Enterprise Framework
    — The Hacker News

    What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agen…
  11. Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
    — Krebs on Security

    Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by t…
  12. Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
    — Unit 42

    Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in …

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14258 in last 30 days).
Critical: 1 · High: 8 · Medium: 6 · Low: 5. View full dashboard →

  1. CVE-2026-97027
    — CVSS 3.6 (LOW)

    Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatp…
  2. CVE-2026-97026
    — CVSS 3.9 (LOW)

    Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary dire…
  3. CVE-2026-97025
    — CVSS 3.2 (LOW)

    Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate th…
  4. CVE-2026-18416
    — CVSS 3.7 (LOW)

    The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inne…
  5. CVE-2026-18415
    — CVSS 6.3 (MEDIUM)

    ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IEEE802154_MTU). In builds with CONFIG_NET_L2_IEEE802154_FRAGME…
  6. CVE-2026-18414
    — CVSS 7.8 (HIGH)

    The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure th…
  7. CVE-2026-18413
    — CVSS 7.8 (HIGH)

    The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure th…
  8. CVE-2026-16513
    — CVSS 7.8 (HIGH)

    The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-pa…
  9. CVE-2026-102279
    — CVSS 3.1 (LOW)

    Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-ba…
  10. CVE-2026-102278
    — CVSS 7.5 (HIGH)

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at co…
  11. CVE-2026-102277
    — CVSS 5.3 (MEDIUM)

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing cl…
  12. CVE-2026-102276
    — CVSS 7.5 (HIGH)

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because par…
  13. CVE-2026-102275
    — CVSS 6.5 (MEDIUM)

    PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived…
  14. CVE-2026-102274
    — CVSS 5.9 (MEDIUM)

    PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. Thi…
  15. CVE-2026-102273
    — CVSS 7.4 (HIGH)

    PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container r…
  16. CVE-2026-102272
    — CVSS 7.4 (HIGH)

    PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order m…
  17. CVE-2026-102271
    — CVSS 7.4 (HIGH)

    PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding.…
  18. CVE-2026-102270
    — CVSS 4.4 (MEDIUM)

    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contain…
  19. CVE-2026-102269
    — CVSS 4.8 (MEDIUM)

    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. Thi…
  20. CVE-2026-102268
    — CVSS 9.1 (CRITICAL)

    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography load…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · September 28, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com