Daily Digest

Cisco Patches Critical Zero-Day, Check Point RCE, and Gyazo Data Breach

September 18, 2026
9 articles (6 new, 3 updated)
27 min read

Summary

This edition covers the period of September 17-18, 2026, a critical time marked by the urgent patching of a zero-day vulnerability in Cisco's Identity Services Engine, which is already under active exploitation. Additionally, Check Point addressed a severe remote code execution flaw in its management servers. A massive data breach at the image-sharing service Gyazo exposed over 23 million user records, while new reports highlight a surge in ransomware targeting the manufacturing sector and a novel data breach in Spain attributed to an autonomous AI agent. Security teams are also contending with a massive spike in phishing attacks using malicious calendar invites.

Filter by Category

New Articles (6)

Check Point Patches Critical RCE Flaw in Management Servers

CRITICAL

Check Point Patches Critical RCE Flaw (CVE-2026-91843)

Check Point has addressed a critical remote code execution vulnerability, CVE-2026-91843, affecting its Security Management and Log Server products. The flaw, rated 9.8 on the CVSS scale, is a pre-authentication stack-based buffer overflow that can be triggered by a login request with a long username. A successful exploit allows an unauthenticated, remote attacker to execute code with root privileges. Check Point has released a fix via its LivePatch service and advises administrators to restrict access to the management interface as a mitigation.

September 18, 2026
4 min read
RCEbuffer-overflowstack-overflowunauthenticatedroot +1 more
Check Point Patches Critical RCE Flaw in Management Servers

Settra Ransomware Hits Retail, Manufacturing With RMM Tools

HIGH

Settra Ransomware Targets Retail and Manufacturing

A new ransomware variant named Settra is actively targeting retail and manufacturing organizations. According to research from Huntress, the group, first seen in June 2026, uses consistent post-exploitation tactics. These include deploying the open-source RMM tool MeshAgent for persistence, clearing Windows Event Logs to cover their tracks, and disabling the Windows Recovery Environment. In a recent attack, the group also used a 'Bring Your Own Vulnerable Driver' (BYOVD) technique involving a legitimate Gigabyte driver to disable security software.

September 18, 2026
4 min read
BYOVDRMMMeshAgentdouble-extortiondefense-evasion +1 more
Settra Ransomware Hits Retail, Manufacturing With RMM Tools

Spain Reports First Data Breach by an Autonomous AI Agent

HIGH

Spain Reports First Data Breach by AI Agent

Spain's Data Protection Agency (AEPD) has received its first-ever data breach notification attributed to an autonomous AI agent. An unnamed organization reported that an attacker used an agent, built on a well-known large language model, to independently scan for vulnerabilities, use discovered credentials to log in, and then exploit a flaw to access and modify personal data and corporate invoices. The incident marks a shift from theoretical to real-world attacks by agentic AI, highlighting the 'speed gap' where automated attacks can outpace human defenses.

September 18, 2026
4 min read
AI-securityautonomous-agentagentic-AILLMGDPR +2 more
Spain Reports First Data Breach by an Autonomous AI Agent

DCSA: Foreign Spies Target US Defense Experts via Email

INFORMATIONAL

DCSA Report: Foreign Spies Target US Defense Industry

A new report from the Defense Counterintelligence and Security Agency (DCSA) details how foreign intelligence entities (FIEs) are targeting the U.S. defense industrial base. The FY 2025 report found that 'exploitation of experts' was the most common tactic, with email being the top vector for initial contact. Adversaries from the East Asia and Pacific region were responsible for 48% of all reported incidents, using lures like paid consultations and fake job offers to gain access to sensitive U.S. technology and information.

September 18, 2026
3 min read
espionagesocial-engineeringphishingdefense-industrial-basenational-security
DCSA: Foreign Spies Target US Defense Experts via Email

Malicious Calendar Invite Phishing Surges Over 30,000%

HIGH

Malicious Calendar Invite (ICS Phishing) Attacks Surge

Security firm Sublime has reported a staggering 33,000% increase in malicious calendar invite attacks, also known as 'ICS phishing,' between May and September 2026. Attackers are abusing .ics calendar files sent from legitimate services like Gmail to bypass email security filters. These invites, which are often automatically added to a user's calendar, contain malicious links that trick victims into downloading RMM tools like ScreenConnect, leading to device compromise, data theft, and potential ransomware deployment.

September 18, 2026
3 min read
ICS-phishingsocial-engineeringRMMemail-securitycalendar-attack
Malicious Calendar Invite Phishing Surges Over 30,000%

AWS AgentCore Default Configs Risk Credential Exfiltration via Prompt Injection

HIGH

AWS AgentCore Harness Credential Exfiltration Risk

Unit 42 researchers have uncovered a significant security issue in the default configuration of AWS AgentCore Harness, a managed runtime for AI agents. The vulnerability allows an attacker to use prompt injection to manipulate the agent into executing arbitrary commands through its built-in 'shell' tool. This tool, enabled by default with root privileges, operates in the same memory space where credentials from AgentCore Identity are handled in plaintext. Consequently, a successful prompt injection attack can lead to the exfiltration of sensitive credentials, bypassing IAM controls and encryption-at-rest. AWS has reviewed the finding and stated that securing against this is a customer responsibility under the shared responsibility model, advising users to scope allowed tools and use egress filtering.

September 18, 2026
16 min read
AWSAgentCoreAI SecurityCloud SecurityPrompt Injection +3 more
AWS AgentCore Default Configs Risk Credential Exfiltration via Prompt Injection

Updated Articles (3)

Cisco ISE Zero-Day (CVSS 10.0) Under Active Attack, Bypasses Auth

CRITICAL

Cisco ISE Auth Bypass Zero-Day CVE-2026-76460 Actively Exploited

Update:

Cisco has provided further details regarding the actively exploited ISE zero-day (CVE-2026-76460). The official Cisco Security Advisory link is now available, along with specific CLI commands for identifying potential compromise: 'show logging application ade/ADE.log | include "User with such username not found"'. This update also highlights the importance of monitoring for the log message 'User with such username not found' and suggests vulnerability scanning and file integrity monitoring as additional detection methods. The vulnerability remains critical with a CVSS score of 10.0.

September 17, 2026
Updated: September 18, 2026
5 min read
zero-dayauthentication-bypassnetwork-access-controlNACCisco +1 more
Cisco ISE Zero-Day (CVSS 10.0) Under Active Attack, Bypasses Auth

Gyazo Screenshot Tool Breach Exposes 23.6M User Records, Image Data

HIGH

Gyazo Data Breach Exposes 23.6 Million User Records

Update:

Further analysis of the Gyazo data breach reveals the incident occurred on September 11, 2026, with Helpfeel reporting it to Japan's Personal Information Protection Commission on September 15. Passwords were confirmed as 'salted and hashed.' The attack leveraged MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application), T1003 (OS Credential Dumping), and T1530 (Data from Cloud Storage Object). The update also provides more comprehensive 'Cyber Observables' and 'Detection & Response' sections, offering enhanced guidance for organizations on monitoring for credential stuffing, enforcing password resets for corporate accounts, and reviewing connected applications.

September 17, 2026
Updated: September 18, 2026
4 min read
data breachPIIpassword securityimage hostingRCE +1 more
Gyazo Screenshot Tool Breach Exposes 23.6M User Records, Image Data

Manufacturing Sector Remains Top Ransomware Target, Attacks Surge 40%

HIGH

Manufacturing Ransomware Attacks Surge 40%, Report Finds

Update:

The latest Black Kite report confirms manufacturing as the top ransomware target for the fifth consecutive year, detailing 1,183 victims in the first seven months of 2026. This update specifies that attackers are increasingly focusing on mid-market companies with annual revenues between $10 million and $100 million, amplifying supply chain risks. Additionally, the report now explicitly names Qilin and Akira alongside 'The Gentlemen' as dominant threat actors, with 'The Gentlemen' responsible for 12% of manufacturing attacks in 2026. The geographic shift to Europe, with an 85.4% increase in attacks, remains a critical finding.

September 17, 2026
Updated: September 18, 2026
4 min read
ransomwaremanufacturingsupply chainthreat reportBlack Kite +1 more
Manufacturing Sector Remains Top Ransomware Target, Attacks Surge 40%

📢 Share This Publication

Help others stay informed about cybersecurity threats

📅 Daily Edition

Curated and deduplicated every day from dozens of trusted sources — giving you one clean, consolidated view of what matters in cybersecurity.

🔢 Deduplication Applied

Related stories are merged into a single evolving article rather than repeated as separate entries — cutting through noise so you only read what's new.

🔗 Full Articles Linked

Every entry links to its full enriched article — complete with MITRE ATT&CK mappings, extracted IOCs, and actionable detection and mitigation guidance.