|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🖥️ Windows 11 update breaks business logins 🔌 Brevo hack infects 100,000 WordPress sites 🚨 Cisco patches exploited login-bypass flaw 🦠 Extension can hijack AI browser assistants ☎️ Attackers can hijack PBX servers Plus: 💡 4 strategies & tactics, 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
What’s still sitting on your to-do list?
You don’t need an AI team to build an AI agent. With Skydive, the person who knows the work can create the agent to do it.
Start an agent off with a role, teach them how your team operates, connect your tools, and put them to work.
|
🖥️ Windows 11 update breaks business logins
LINK
|
- A Windows 11 security update, KB5124008, released on September 8, 2026, is breaking Active Directory domain trust on some enterprise machines, leaving users unable to sign in even with valid credentials on versions 25H2 and 24H2.
- The problem is tied to Machine Identity Isolation, a Credential Guard feature in enforcement mode that moves the machine secret into Credential Guard; if it cannot complete machine authentication after a restart, the secure channel breaks and interactive logon fails.
- Microsoft has not confirmed the cause or issued an official fix, but administrators stopped the failures by disabling Machine Identity Isolation and forcing its registry value to 0, then resetting the machine password, though some systems still required a full domain rejoin.
|
🔌 Brevo hack infects 100,000 WordPress sites
LINK
|
- A breach of Brevo's infrastructure on September 14 pushed malicious JavaScript through the company's hosted widgets and scripts to more than 100,000 websites, including operators embedding its tracking SDK or chat components without changing anything themselves.
- Modified copies of Brevo's sdk-loader.js and brevo-conversations.js loaded attacker code from subdomains under sendibt1.com; for logged-in WordPress admins it used their active session to upload a plugin from cdn10.sendibt1.com/p/wm.zip, suspected to plant persistent backdoor access.
- Unauthenticated visitors got a full-screen ClickFix "verify you are human" prompt tricking them into pasting and running a malicious command; the malicious hosts stopped resolving September 15, Brevo restored the files, and admins should review September 14 plugin-upload logs.
|
🚨 Cisco patches exploited login-bypass flaw
LINK
|
- Cisco has issued emergency patches for a login-bypass flaw in its Identity Services Engine (ISE) that attackers have already been exploiting in the wild before any fix was available.
- The maximum-severity bug (CVE-2026-76460, CVSS 10/10) lets an attacker send crafted requests to an API endpoint that fails to enforce authentication, bypassing the web management interface to reach the device with no login needed.
- Successful exploitation runs commands with root privileges, letting attackers hide or delete traces; Cisco says to upgrade ISE or ISE-PIC to fixed patches, check 'access.log' for suspicious usernames, and re-image compromised nodes.
|
🦠 Extension can hijack AI browser assistants
LINK
|
- A proof-of-concept attack called BragJack lets a malicious browser extension hijack the communication channel to built-in AI agents in five agentic browsers, Chrome with Gemini, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome, and force them to obey attacker commands.
- Rather than hiding instructions in content, the attack abuses a shared design flaw letting an untrusted extension cross the boundary meant to isolate it from the privileged AI agent, so attackers can repeatedly push prompts until the agent takes screenshots, reads local files, or activates the camera and microphone without user clicks.
- Researcher Gal Weizman of Forever Security reported it to all five vendors, who resolved the issues; Google and Microsoft issued CVE-2026-0628 and CVE-2026-55945 for Chrome and Edge, and he advises keeping Chromium-based browsers updated and removing unvetted extensions.
|
☎️ Attackers can hijack PBX servers
LINK
|
- Attackers are actively hijacking internet-facing Issabel PBX servers by exploiting a critical flaw (CVE-2026-89026, CVSS 9.3) in the Issabel Framework that lets unauthenticated remote attackers run operating-system commands on vulnerable phone systems.
- The bug exists because the framework shipped a hard-coded JWT signing key, so an attacker with no account or password can forge a legitimate-looking bearer token and hit the originate API endpoint to make Asterisk run arbitrary commands.
- Shadowserver first saw exploitation on September 9, 2026; administrators should update to the version containing the fix (commit b97dbaf0), confirm the shared key is gone, restrict PBX and API access, and review logs for suspicious originate requests.
|
|
Product teams aren’t short on ideas. They’re missing a system.
Jira Product Discovery gives teams one place to capture customer feedback, prioritize ideas with consistent frameworks, and build living roadmaps everyone can align on. And when it’s time to build, those decisions connect directly to delivery in Jira, so everyone can see how the roadmap turns into real work.
Other
news & articles you might like
-
GhostCode abuses Microsoft Entra device enrollment to maintain access after token revocation
LINK
-
Cisco warns of active exploitation of critical ISE flaw
LINK
-
NightEagle targets Russian companies
LINK
-
RatHat abuses Android wireless debugging to gain shell access and steal banking PINs
LINK
-
US takes down NightmareStresser DDoS-for-hire platform
LINK
-
FamousSparrow deploys new SparroWocky backdoor against Latin American governments
LINK
|
|
🛠️ Trending tools
|
Halo: an API-first platform that detects deepfakes and synthetic media across text, image, and audio, helping fraud and trust teams block attacks
LINK
|
|
MonoCloud for Startups: manages authentication and Cedar-based authorization across users, APIs, and AI agents, letting you control, audit, and revoke access, free for a year
LINK
|
|
Execlave: enforces runtime policies, kill switches, and audit logs on autonomous AI agents in under 20ms, mapping to SOC 2, EU AI Act, and ISO 27001 compliance
LINK
|
|
Aegisora: an open-source proxy that secures LLM agents with least-privilege API access, PII masking, prompt-injection blocking, and audit logging for production deployments.
LINK
|
|
Agent Beacon is the world's first open-source telemetry layer for AI agents wherever they run: locally, in CI, in the browser, or in the cloud.
LINK
|
|
Linux Doctor: read-only diagnostic tool that runs system health checks and explains detected problems without making changes to the machine.
LINK
|
|
|
|
📚 Trending research papers
|
Personalized security chatbots tailored to a user's ongoing conversation make people rate cybersecurity advice as more helpful and more likely to be followed, based on a 7-day test with 57 participants and over 1,000 questions.
LINK
|
|
Onboard drone security spots cyberattacks and malfunctions in real time by watching a drone's sensor and command data as it flies, running directly on the drone despite its limited battery and computing power.
LINK
|
|
Encrypted-traffic leakage accounting breaks down exactly how much a website visit leaks through packet size, direction, and timing, showing that popular defenses like FRONT cut direction leaks ~63% but leave timing exposed.
LINK
|
|
Reliable learners are a training method that lets prediction systems flag when they might be wrong under hostile inputs or shifted data, giving provably correct answers in messy real-world conditions where accuracy guarantees usually break down.
LINK
|
|
Automated bug-hunting hints use AI to write the expert guidance that helps security testing tools find software flaws faster, matching human experts and removing the need for scarce specialists, though the speed gains proved inconsistent.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
