Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks. [...]

Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. [...]

Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]

Lenovo says its agentic AI-powered security operations center reduced threat-detection time by 87.5% across an internal network of more than 140,000 devices. The deployment also delivered a reported 20-fold improvement in detection accuracy, giving administrators a large-scale example of how AI agents can automate SOC work without removing human oversight.

Source

CenterPoint Energy disclosed a breach compromising some customers' personal information after an attacker leaked data allegedly stolen from the utility company. [...]

Cisco is extending Splunk AI to self-managed, private-cloud, and air-gapped environments while giving IT teams real-time visibility into agent behavior and token spending. The updates also add runtime guardrails, network-aware troubleshooting, and broader deployment options for Splunk Agent Observability.

Source

Microsoft has given organizations still running Windows 11 23H2 Enterprise or Education roughly two months to begin upgrading before support ends on November 10, 2026. The November security update will be the final one for these editions; afterward, affected devices will no longer receive monthly security, quality, or preview updates.

Source

Java 27 is now available with hybrid post-quantum key exchange for TLS 1.3, giving Java teams a migration path toward quantum-resistant communications without abandoning current cryptography. The release also makes G1 the default garbage collector in every environment and adds performance and productivity improvements aimed at AI-heavy workloads.

Source

Microsoft 365 Copilot licensing now effectively unlocks key SharePoint Advanced Management capabilities for the whole tenant, changing how organizations should plan Copilot readiness. The entitlement helps administrators find overshared, stale, and ownerless content, but advanced Purview protections still require Microsoft 365 E5 or equivalent licensing.

Source

OpenAI is endorsing a specific federal mandate for third-party safety assessments of the most powerful AI models, marking a significant shift from voluntary safeguards to legally required oversight. A bipartisan group of six House lawmakers is proposing that the Department of Commerce accredit independent auditors and appoint an official to supervise AI security compliance.

Source

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]

CISA now says ransomware gangs are exploiting CVE-2026-59310, the critical VMware vCenter flaw that had already compromised vCenter systems in attacks. Broadcom patched the unauthenticated directory-traversal vulnerability in July, but more than 450 vCenter servers remain exposed online, increasing the urgency for organizations that have not completed remediation.

Source

Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. [...]

AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive. [...]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]

Splunk is expanding in two directions at once: bringing AI-driven operations closer to sensitive on-premises data with Cisco and Nvidia, while moving beyond AWS integrations toward jointly designed, agent-based security products. The strategy positions Splunk as a full-stack observability and security platform spanning cloud, data center, and edge environments.

Source

A campaign used the BlueMoon Chrome-Windows exploit chain, delivering the GRIMWEDGE JavaScript backdoor through a compromised university website. The operation adds a UTA0560 campaign and a new payload to the BlueMoon exploit kit spreading across espionage campaigns, increasing the urgency for administrators to update both Chrome and Windows.

Source

Cisco has patched CVE-2026-76461, a critical Cisco Secure Email Gateway zero-day that attackers are exploiting to run commands as root through specially crafted email messages. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by September 17.

Source

Windows administrators are reporting that Windows 11 security update KB5124008 can break domain authentication by destroying the computer’s Netlogon secure channel. The failure has been reproduced across multiple systems and appears on networks using Windows Server 2019 and Server 2022 domain controllers, while Microsoft has not yet confirmed the issue or provided a permanent fix.

Source