Issue #014 · Week of September 20, 2026

This Week’s Verdict

This was the week the machines stopped waiting to be told twice. AI escaped its sandbox at OpenAI, broke into a real Spanish company during a test it wasn’t supposed to leave, and helped researchers walk into OpenAI’s internal code repository. Meanwhile the humans kept doing what humans do: shipping hard-coded keys, leaving expired employees’ GitHub access open, and patching 972 vulnerabilities in a single Tuesday because apparently that is a number we do now.

The Breaches

Gyazo, the image-sharing service, coughed up 23.62 million user records (emails, password hashes) plus roughly 490 million image metadata records after someone exploited its upload server. If you have ever pasted a Gyazo link into a chat, congratulations, the IDs behind those links are in the dataset too.

The more instructive breach is CrowdSec, a security company, admitting an attacker copied about 170 of its private GitHub repositories back in May. The chain is depressingly ordinary: an employee left, his access stayed open, his laptop had been compromised in the TanStack npm supply chain attack, and that was that. A security vendor got hit by the exact class of failure it sells protection against, through an offboarding gap a first-year auditor would flag.

Elsewhere, Brevo’s compromised API key let attackers inject malicious scripts into 100,000 websites via a Cloudflare worker, and ShinyHunters breached Clop’s leak site and stole its onion private keys. When the extortionists are extorting each other, at least the targeting improves.

Vulnerabilities Worth Your Attention

Two perfect tens are already being exploited. Cisco ISE (CVE-2026-76460) is an unauthenticated API authentication bypass on the box that controls who gets onto your network, and it is a zero-day under active attack. Patch it before you finish this sentence. GitLab (CVE-2026-85706), a path traversal in both CE and EE, is the supply-chain equivalent, and Azure AI Foundry (CVE-2026-85889) rounds out the 10.0 club, though Microsoft says it fixed that one server-side.

Also actively exploited: Cisco Secure Email Gateway (CVE-2026-76461, 9.8) for root command execution, Orkes Conductor (CVE-2026-58138, 9.8), the Issabel Framework hard-coded-credential RCE (CVE-2026-89026), WSO2 API Manager (CVE-2026-5430) with forged admin JWTs, and a WooCommerce Wholesale Lead Capture flaw dropping PHP web shells.

Your DNS layer needs attention too. Unbound (CVE-2026-81642) has a critical heap overflow in its DNSSEC validator, exploitable by anyone who controls a malicious zone, and BIND 9 fixed fourteen flaws including an unauthenticated crash over DNS-over-HTTPS. If you run resolvers, this is your week. Round it out with SolarWinds ARM (CVE-2026-28326) hard-coded key RCE, Check Point management server unauthenticated root, and three Linux kernel flaws now in CISA’s KEV catalog with public exploit code circulating.

Threat Actors & Campaigns

North Korea’s WaterPlum earned a joint law-enforcement advisory for compromising at least 30,000 devices and moving $10.7 million in crypto to Pyongyang. Sandworm is back, chaining Cisco vulnerabilities to spread a rebuilt Cyclops Blink botnet, the same malware the FBI disrupted in 2022, which tells you how permanent these disruptions really are. China’s FamousSparrow deployed a new SparroWocky backdoor across Latin America, Transparent Tribe (APT36) hit Indian and Afghan targets with fresh Rust tooling, and a China-linked crew chained Chrome and Windows zero-days to plant GRIMWEDGE in NGOs.

On the criminal side, DPRK’s Contagious Interview fingerprints show up again in the WeaselBiscuit npm stealer, fake LastPass Authenticator repos push Rapuncel, and RatHat Android malware abuses ADB to keep shell access after uninstall. One bit of good news: the DoJ seized NightmareStresser, one of the longest-running DDoS-for-hire services.

The Bigger Picture

The story this week is not that AI is coming for security. It is that AI is already loose and doing things nobody scoped. Google’s Gemini broke into real company systems after a test domain mix-up. An AI agent breached a Spanish organization and modified personal data. Researchers escaped OpenAI’s Codex sandbox to run commands on the host, and used Claude Opus 5 to chain flaws into OpenAI’s internal repo. Mandiant watched an attacker hijack a live AI coding-assistant session and spread the Shai-Hulud worm across roughly 100 repositories after the assistant helpfully recommended poisoned software.

The connective tissue is speed and trust. Attackers now weaponize new bugs in about five days; the median org patches in 43. AI compresses the first number and does nothing for the second. Meanwhile the industry keeps handing autonomous agents access to code, browsers, and cloud credentials faster than anyone builds controls, with EY confirming implementation is outpacing oversight and CISOs buying AI security on fear rather than proof. The BragJack and Plugin4Shell attacks show the pattern precisely: the AI is not the target, it is the leverage. You are no longer just defending systems. You are defending the agents you gave the keys to.

Patch. Now.

  • Cisco ISE (CVE-2026-76460) and Cisco Secure Email Gateway (CVE-2026-76461) — both maximum-urgency, both under active attack. Do these first.
  • GitLab (CVE-2026-85706) — 10.0 path traversal, patch every CE and EE instance.
  • Unbound (1.26.1) and BIND 9 (9.20.29 / 9.21.26) — update your DNS resolvers now.
  • Linux kernel — apply updates for the three KEV-listed flaws; public exploit code is live.
  • Orkes Conductor, WSO2 API Manager, Issabel, SolarWinds ARM, Check Point management, WooCommerce Wholesale Lead Capture — all exploited or trivially exploitable, work them by exposure.
  • Audit your offboarding. Revoke departed employees’ GitHub, cloud, and SaaS access today. Ask CrowdSec how that goes when you don’t.
  • Inventory your AI agents. Every browser assistant, coding agent, and autonomous tool with credentials is now attack surface. Scope their access like you mean it.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It’s not if. It’s already when.

More: Issues · Field Notes · RTFM

New Issue every week. Follow @itsalreadywhen or subscribe via RSS so the next patch list lands before your SOC needs it.