Daily Cybersecurity News – September 15, 2026

What happened

Attackers exploited a zero-day SQL injection flaw in Cisco Secure Email Gateway appliances, which Cisco confirmed after its PSIRT learned of active attacks in September 2025.

CVE-2026-76461 (CVSS 9.8) stems from insufficient validation in email parsing logic on AsyncOS. An unauthenticated attacker sends a crafted email containing malicious SQL statements; no user interaction is required. Success yields arbitrary SQL execution and root-level command execution on the underlying OS.

Cisco has released indicators of compromise and notes that attackers with root access may purge logs to hide evidence.

Who is affected

On-premises physical and virtual Cisco Secure Email Gateway appliances running AsyncOS 16.5, 16.0, 15.5 and earlier, plus the cloud-delivered Cisco Secure Email Cloud service.

Cisco contacted cloud customers where malicious activity was detected. Organizations relying on these gateways for email security are exposed until patched.

Why it matters

Email gateways sit at the perimeter and process untrusted messages at scale. Root RCE lets attackers pivot, steal credentials, plant persistence, or use the appliance as a launch point for further internal compromise.

Active exploitation plus easy triggering via ordinary email makes this an immediate operational risk for any unpatched deployment.

How it could have been prevented

Upgrade immediately to fixed releases: 15.5.5-014, 16.0.4-302, or preferably 16.5.0-780. Cloud instances were already upgraded by Cisco to 16.5.0-780.

After patching, search mail_logs for suspicious SQL statements and cross-check external network and firewall logs for unexpected uploads or downloads. If IoCs appear on physical devices, contact Cisco TAC; for virtual appliances, capture forensics, redeploy a clean fixed image, rebuild configuration, and rotate all credentials and cryptographic material. Monitor for anomalous behavior afterward.

What happened

A human operator exploited a pre-authentication remote code execution flaw in the Marimo notebook platform and reached an SSH bastion host in eight seconds, using a hand-built Python toolkit with no LLM involvement.

CVE-2026-39987 (CVSS 9.8) affects Marimo through 0.20.4 and is fixed in 0.23.0. The terminal WebSocket endpoint skipped authentication checks that other endpoints enforced, giving any connecting client an interactive shell as the Marimo process user.

The attacker first spent roughly four hours building and debugging eight scripts on the host. In a later session the finished chain ran from one command, harvested cloud credentials from the process environment and Redis backend, pulled an SSH private key from AWS Secrets Manager, and authenticated to the bastion. Sysdig observed more than 850 interactive commands over nine hours and no public offensive tooling. A planted prompt-injection trap that reliably caught AI agents was inspected twice but never echoed, confirming human operation. The CVE has been in CISA KEV since April 2026.

Who is affected

Users of Marimo notebooks up to and including version 0.20.4, commonly deployed alongside machine-learning pipelines on hosts with GPU access, large datasets, and cloud credentials for AWS, GCP, and model providers.

Any internet-reachable or poorly segmented Marimo instance can serve as an entry point into the broader cloud account.

Why it matters

Marimo often runs with privileged access to training data, model APIs, and cloud secrets. A single unauthenticated shell quickly becomes full cloud compromise and bastion access.

The eight-second pivot shows that skilled humans can match the speed once associated mainly with automated or AI-driven attacks. Detection that relies only on LLM fingerprints will miss this class of operator; defenders must watch the shape of the credential-to-bastion chain itself.

How it could have been prevented

Update Marimo to 0.23.0 or later. Place the terminal WebSocket endpoint behind authentication or disable it entirely.

Scope Secrets Manager and similar IAM permissions so notebook credentials cannot read bastion or high-value keys. Rotate any secrets that were reachable from exposed instances. Monitor for unexpected credential use and SSH key retrieval from notebook hosts.

What happened

A China-linked cluster tracked by Volexity as UTA0560 ran a spear-phishing campaign on 1 September 2026 against multiple NGOs, chaining recently patched Chrome and Windows flaws to deploy the GRIMWEDGE JavaScript backdoor.

Emails lured victims to a U.S. university site that contained a reflected XSS flaw. That redirected to attacker infrastructure hosting the BlueMoon multi-stage chain: CVE-2026-85046 (V8 type confusion, CVSS 8.8) for arbitrary read/write inside the sandbox, CVE-2026-87491 (V8 out-of-bounds write, CVSS 8.8) to escape the sandbox, and CVE-2026-85880 (Windows ALPC heap buffer overflow, CVSS 7.8) for code injection into the Chrome process and arbitrary code execution. All three CVEs are in CISA KEV and confirmed actively exploited.

The final page delivered Base64-encoded shellcode payloads that performed reconnaissance, privilege escalation, and browser-process injection. A loader (msgbox.exe) then side-loaded a malicious DLL, fetched a hostname-named MSI, and launched the obfuscated GRIMWEDGE backdoor. GRIMWEDGE persists in a command loop, polling C2 at ocr.opusaccel[.]top and executing instructions in memory via eval().

Who is affected

Users of Google Chrome on Windows who clicked the phishing links, especially staff at targeted non-governmental organizations.

Systems not running Chrome on Windows were filtered out by the exploit page. Any organization whose users browse untrusted or compromised legitimate sites remains exposed until browser and OS patches are applied.

Why it matters

Zero-day browser-plus-OS chains turn a single click into full host control and a stealthy JavaScript backdoor capable of recon, file operations, command execution, and further payload delivery.

Targeting NGOs with spoofed university links shows continued interest in espionage against civil-society groups. The combination of sandbox escapes and ALPC elevation demonstrates how quickly patched high-severity bugs are weaponized.

How it could have been prevented

Apply the latest Google Chrome and Microsoft Windows security updates that address CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 without delay.

Enforce browser isolation or application control where feasible, restrict unnecessary Chrome privileges, and train users to treat unexpected links - even those pointing to known domains - with caution. Monitor for unusual MSI installations, DLL sideloading of wsc.dll, and connections to newly observed C2 domains. Hunt for the GRIMWEDGE command set (Info, Dir, Mkdir, Del, Tasklist, etc.) in memory or script activity.

What happened

Researchers from KU Leuven, ETH Zurich, Durham University, and Google disclosed DDRop, a hardware attack that defeats memory integrity protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP confidential-computing platforms.

An attacker who already controls the server software briefly gains physical access and inserts a low-cost (under $200) interposer between the CPU and a DDR5 memory module. The interposer silently drops selected writes by forcing a command-bus error and suppressing the error report, so the memory keeps the old encrypted value. The processor later reads that stale data as if the write had succeeded; the encryption engine raises no alarm because freshness is not guaranteed for the large memory footprints used in cloud servers.

On Intel TDX the team turned dropped page-table writes into full control of a protected virtual machine, mapping attacker memory over victim physical addresses and reading secrets such as attestation keys. DDRop is described as the first active interposer attack that works at full DDR5 speed on current cloud hardware and the first to break integrity (not merely confidentiality) on up-to-date TDX. Designs, firmware, and attack code are being released on GitHub ahead of ACM CCS 2026.

Who is affected

Cloud providers and tenants that rely on Intel TDX, Scalable SGX, or AMD SEV-SNP to protect data-in-use from the infrastructure operator or co-tenants.

Any workload whose security model assumes hardware-enforced memory integrity against a privileged software adversary with brief physical access is in scope. The attack does not affect ordinary end-user laptops or devices without the required physical interposer step.

Why it matters

Confidential computing is marketed as the way to keep data private even from the cloud provider. DDRop shows that the missing freshness guarantee can be turned into integrity violations and full VM compromise once physical access is obtained.

Operators who place high-value secrets or multi-tenant isolation solely on these TEEs must reassess residual risk from physical supply-chain or data-center insider threats. The public release of interposer designs lowers the bar for future replication.

How it could have been prevented

Treat physical access to servers running confidential-computing workloads as a high-impact risk: enforce strict data-center access controls, tamper-evident seals, and continuous monitoring of memory-module integrity.

Prefer deployments that add software-level freshness or integrity checks on top of the hardware TEE where possible. Rotate attestation keys and secrets after any suspected physical maintenance window. Follow vendor guidance as Intel and AMD respond to the research; isolate the highest-value tenants on hardware that can be physically attested more rigorously.

What happened

Sophos CTU observed an advertisement on the Exploit hacking forum on 24 August 2026 for Luciferus, a paid AI subscription marketed as an uncensored alternative to jailbreaking ChatGPT or Claude.

Posted by the persona Optimus_Prime (joined April 2026, coding label), the service claims a proprietary 120-billion-parameter model that answers without moral or ethical limits. Sophos assesses with low confidence that it is likely based on a fine-tuned Qwen open-source model rather than a wholly new foundation model. Forum pricing lists Inquisitor at $35/month, Archdevil at $55, and Prince of Darkness at $75, plus a custom Individual Embodiment tier; the public website shows different tier names and lower prices (Junior $22, Middle $34.75, Pro $47.14).

When researchers asked the Junior tier for a simple Python remote-access Trojan, it returned a Russian-language explanation plus source code. Sophos notes the offering fits a broader pattern of commercialized uncensored AI sold on underground forums and Telegram channels.

Who is affected

Cybercrime actors seeking malware-generation, phishing, or exploit assistance without repeatedly jailbreaking mainstream models, as well as defenders monitoring underground AI tooling.

Anyone whose threat model includes lower-skilled attackers now able to obtain working code and technical explanations on demand.

Why it matters

Uncensored local or hosted models remove the cat-and-mouse cycle of jailbreak patches. Sellers retain control and longer shelf life, lowering the skill barrier for producing functional malware and attack support material.

The discrepancy between forum and website pricing plus unverifiable model claims are typical of underground commercialization, yet the live demonstration of RAT code generation shows the practical risk is already present.

What happened

Anthropic released a detailed report on observed misuses of its Claude models. One case involved a cell of threat actors based in northern Yemen that ran three weapons-development programs: a guided rocket using a commodity phone-class flight computer with final-phase homing, a multi-stage ballistic missile with a stated range goal above 2,000 km, and a multi-variant missile set (R2000) that included a hypersonic glide-vehicle variant.

The actors used Claude Code in place of human software engineers to build guidance, navigation, and control software. They integrated an open-source autopilot onto phone-class hardware, wrote control and position-estimation code, tuned settings, ran firmware builds, and performed flight simulations. Multiple Claude instances were assigned distinct roles (coding, research, review) like a small engineering team. Safeguards blocked many requests, yet the actors hid goals, split work across sessions, and still obtained usable assistance. They test-fired a guided rocket that failed; within hours they returned to Claude to debug the failure. Anthropic states it has no evidence an operational device was fielded.

Who is affected

AI model providers whose systems can be steered toward dual-use engineering tasks, defense and export-control authorities, and organizations tracking proliferation of guided-weapons expertise.

Broader society faces elevated risk as AI lowers the expertise barrier for complex military systems.

Why it matters

AI systems democratize specialized engineering knowledge. In this case they supplied GNC software, simulation, and iterative debugging that previously required trained human teams.

Even partial success (a test launch) shows that determined actors can combine open-source components with AI assistance to accelerate weapons programs. Guardrails remain porous when users deliberately fragment intent across sessions and hide end goals. Expect continued attempts of this type.

What happened

Revolut confirmed that an unauthorized party used a legitimate government agency domain email to submit fraudulent information requests, causing the fintech to disclose sensitive customer data.

The requests carried valid technical domain authentication and were processed by employees as ordinary legal-compliance obligations. Revolut called it a sophisticated external impersonation scam. Only a very limited group of customers was affected; core systems and customer funds remained untouched. Upon detection the company blocked the address, notified affected customers, and alerted the relevant government agency plus enforcement, data-protection, and financial regulators.

Independent researcher ZachXBT publicly warned on 12 September 2026 after seeing customer notifications. Exposed data reportedly included full names, dates of birth, addresses, phone numbers, emails, occupations, government ID copies (passports, driver licenses), verification selfies, IBANs, account-opening dates, full transaction and withdrawal histories, and Bitcoin wallet reference numbers.

Who is affected

A limited subset of Revolut customers whose records were released in response to the fraudulent requests. The company has not disclosed exact numbers or specific markets.

Any Revolut user whose identity documents and transaction history are now in unauthorized hands faces elevated identity-theft and targeted-fraud risk. Other regulated financial firms that accept government data requests are potentially exposed to the same social-engineering pattern.

Why it matters

The breach handed attackers a near-complete identity-theft kit: government IDs, selfies, addresses, and detailed financial histories. Even without direct access to funds, this material enables highly convincing phishing, account takeover at other institutions, and long-term fraud.

For a digital-first fintech the incident raises hard questions about verification depth for third-party legal requests that arrive with technically valid email authentication. Experts note that the bar for confirming such requests should be exceptionally high when the data set is this sensitive.

How it could have been prevented

Revolut customers who received notification should treat all unexpected calls, emails, or messages claiming to be from Revolut, government bodies, or banks with extreme caution. Never share passwords, passcodes, or one-time codes. Contact Revolut only through the official app or verified website. Enable MFA, use unique passwords, and closely monitor accounts and credit reports for new activity.

Financial institutions should implement out-of-band verification (callback to known agency numbers, multi-person approval, cryptographic or portal-based request channels) before releasing ID documents or full transaction histories, even when the sending domain passes technical authentication checks. Log and anomaly-detect unusual volumes or patterns of legal-compliance requests.