Daily brief · 2026-09-20 · updated 2026-10-12

13 Critical Security Fixes You Need Today

▶

Cisco Identity Services Engine

CVE-2026-76460 is an actively exploited authentication-bypass vulnerability in Cisco Identity Services Engine, and Cisco states there is no workaround. The Cisco PSIRT is aware of active exploitation of this vulnerability, and Cisco strongly recommends that customers upgrade to a fixed software release to remediate it. The issue permits an unauthenticated remote attacker to bypass authentication, and Cisco states that no workaround addresses the vulnerability. CISA added CVE-2026-76460 to KEV.

Why it matters: Attackers can bypass Cisco ISE authentication protections.

What to do: Upgrade to Cisco’s fixed release immediately because Cisco provides no workaround.

CVEs: CVE-2026-76460

Gyazo / Helpfeel

On Gyazo / Helpfeel, Helpfeel confirmed that unauthorized access to Gyazo systems resulted in disclosure of user and image-metadata records. On September 11, 2026, a third party exploited a vulnerability in Gyazo’s image upload server to gain unauthorized access to those systems and execute arbitrary commands. Helpfeel confirmed disclosure of approximately 23.62 million Gyazo user-related records and approximately 490 million image-related metadata records. Helpfeel stated that payment information was not disclosed.

Why it matters: Gyazo user-related and image-metadata records were disclosed without authorization.

What to do: Affected users should follow Helpfeel’s breach-notice instructions, rotate reused credentials, and remain alert for identity-targeted phishing.

3BB / FortiGate 60F SSL-VPN

Hunt.io reported evidence consistent with an intrusion targeting a 3BB / FortiGate 60F SSL-VPN through CVE-2024-21762 and persistence through MeshCentral. The threat actor used CVE-2024-21762 to target a FortiGate 60F SSL-VPN at mail.3bb.co[.]th. Hunt.io reported MeshCentral persistence after host compromise. Hunt.io assessed that the intrusion targeted persistent access to 3BB’s internal network and RADIUS-related data.

Why it matters: The activity reportedly sought access to 3BB internal systems and subscriber authentication data.

What to do: Ensure FortiGate appliances are remediated for CVE-2024-21762. Investigate MeshCentral agents, unexpected outbound management traffic, and RADIUS-access anomalies.

CVEs: CVE-2024-21762

Cisco AsyncOS Software for Cisco Secure Email Gateway

CVE-2026-76461 is an actively exploited SQL-injection vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that can permit root-level command execution. In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. The flaw can allow unauthenticated remote root-level command execution. CISA added CVE-2026-76461 to KEV.

Why it matters: An attacker can execute arbitrary commands with root privileges on the underlying operating system.

What to do: Upgrade affected Cisco Secure Email Gateway deployments to Cisco’s fixed software release on an emergency basis.

CVEs: CVE-2026-76461

Google Pixel

CVE-2026-58704 affects Google Pixel devices, is under limited targeted exploitation, and was added to CISA KEV. CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CISA added CVE-2026-58704, a Google Pixel improper authorization vulnerability, to KEV. Google reported indications of limited, targeted exploitation.

Why it matters: CISA considers the vulnerability actively exploited.

What to do: Apply Google’s applicable September 2026 Pixel security update and follow the CISA KEV remediation timeline.

CVEs: CVE-2026-58704

Hacking Cat / Russian organizations

On Hacking Cat / Russian organizations, Kaspersky assessed that Hacking Cat shifted from defacement-oriented activity to campaigns involving Gorilla RAT and Monkey Ransomware that encrypt or destroy data. Later the group changed its profile and began conducting campaigns aimed at encrypting and destroying data. Kaspersky described Hacking Cat as a hacktivist group attacking organizations in the Russian Federation. Kaspersky attributed Gorilla RAT and Monkey Ransomware to Hacking Cat with high confidence.

Why it matters: The group’s reported campaigns involve encryption and destruction of victim data.

What to do: Use Kaspersky’s malware indicators to hunt for Gorilla RAT and Monkey Ransomware, then isolate affected systems and validate recoverable backups.

Russian manufacturing and construction organizations

Kaspersky reported a NightEagle cyberespionage campaign targeting Russian manufacturing and construction organizations using GhostContainer on Exchange servers. Kaspersky’s Global Emergency Response Team identified a cyberespionage campaign by the NightEagle group targeting manufacturing and construction organizations in Russia. Kaspersky reported use of compromised VPN credentials, a backdoor on Exchange servers, and developer tools to reach core identity infrastructure. Kaspersky named the custom Exchange-server backdoor GhostContainer.

Why it matters: The campaign sought to navigate victim networks and compromise core identity infrastructure.

What to do: Review VPN authentication and Exchange-server telemetry, rotate exposed credentials, and investigate suspicious developer-tool activity on identity-adjacent systems.

Toy Ghouls / Russian organizations

Kaspersky reported that Toy Ghouls used custom backdoors whose command-and-control used HiveMQ MQTT or Element. Two versions of this backdoor were identified: one uses the HiveMQ MQTT broker as its C2 server, while the other relies on the Element messenger. Kaspersky describes Toy Ghouls as financially motivated and targeting Russian organizations since 2025, identified here as Toy Ghouls / Russian organizations. Kaspersky first observed the group using a custom backdoor in early July 2026.

Why it matters: The group can maintain remote command-and-control through services that may blend into legitimate traffic.

What to do: Hunt for unauthorized MQTT and Element-related communications, validate endpoint persistence, and block confirmed malicious indicators from Kaspersky’s report.

Linux Kernel

CISA added three Linux Kernel vulnerabilities to KEV on 18 September 2026 based on evidence of active exploitation. CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation. CISA added CVE-2025-39964 and CVE-2026-53266 to KEV. CISA added CVE-2025-39682 to KEV.

Why it matters: CISA’s KEV listings confirm active exploitation evidence for all three vulnerabilities.

What to do: Identify affected kernel packages and apply vendor-distributed kernel fixes according to the CISA KEV remediation deadlines.

CVEs: CVE-2025-39964, CVE-2026-53266, CVE-2025-39682

OpenAI Codex

Accomplish AI researchers reported two OpenAI Codex sandbox escapes and stated that OpenAI fixed both after disclosure. They found two ways out of the OpenAI Codex sandbox and reported both to OpenAI on August 12, 2026, and both were fixed inside of eight days. The researchers reported two Codex sandbox escapes and stated that both were fixed within eight days. One reported issue could provide unsandboxed command execution from a cloned repository in read-only sandbox mode.

Why it matters: A malicious repository author could potentially obtain command execution outside Codex’s intended sandbox boundary.

What to do: Update Codex clients to currently supported releases and treat untrusted repositories as potentially hostile until the deployed version is confirmed remediated.

Revolut customers

Revolut told TechCrunch that an impersonation scam using a legitimate government-agency email domain led to unauthorized disclosure of customer information. Revolut recently identified a sophisticated external impersonation scam where an unauthorized third party used a legitimate government agency domain email to submit fraudulent requests for information. TechCrunch reported that a Revolut spokesperson said a limited number of Revolut customers were affected. Revolut told TechCrunch that its systems and customer funds were unaffected.

Why it matters: Revolut disclosed customer information to an unauthorized third party.

What to do: Affected customers should monitor for targeted phishing and identity fraud, secure exposed identity documents where feasible, and follow Revolut’s direct notification guidance.

North Korean WaterPlum / IT professionals and cryptocurrency users

A joint government advisory states that North Korean WaterPlum infected at least 30,000 devices and transferred cryptocurrency equivalent to about $10.71 million to North Korea. WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets. The advisory states that WaterPlum transferred cryptocurrency equivalent to $10.71 million to the DPRK. The advisory says WaterPlum targets IT professionals through fake employment opportunities.

Why it matters: For North Korean WaterPlum / IT professionals and cryptocurrency users, victims can lose cryptocurrency, credentials, and sensitive data, while compromised systems may provide a foothold into employers.

What to do: Do not execute recruiter-supplied code or projects without review. Use VS Code Restricted Mode for unknown projects and inspect .vscode/tasks.json before trusting a folder.

Also today

Acronis Backup

CISA added CVE-2026-87886, an Acronis Backup incorrect-default-permissions vulnerability, to KEV based on active-exploitation evidence.

What to do: Apply the vendor remediation in Acronis advisory SEC-10986 and meet the CISA KEV remediation deadline.

CVEs: CVE-2026-87886

Tags: cisco-identity-services-engine, gyazo, 3bb, cisco-asyncos-software-for-cisco-secure-email-gateway, google-pixel, hacking-cat, russian-manufacturing-and-construction-organizations, toy-ghouls, linux-kernel, openai-codex, revolut-customers, north-korean-waterplum, acronis-backup