Daily Cybersecurity News – September 17, 2026

What happened

Google confirmed that a zero-day vulnerability in Pixel smartphones' cellular modem was exploited in limited, targeted attacks against some owners. The flaw, tracked as CVE-2026-58704, is a logic error allowing remote proximal or adjacent privilege escalation from the sandboxed modem into the broader device without user interaction, enabling a silent zero-click attack.

Google has released a patch. The issue is listed in CISA KEV as actively exploited.

Who is affected

Owners of Google Pixel phones with the vulnerable modem software. Exploitation was limited and targeted rather than widespread mass scanning.

Exact models and firmware versions prior to the Tuesday patch are impacted; all unpatched Pixels with the affected modem code remain exposed to proximal attacks.

Why it matters

Zero-click modem escapes bypass normal app sandboxing and can lead to full device compromise, data theft, or spyware installation without any user action. Such bugs are frequently leveraged by commercial surveillance vendors selling to governments.

Operators and high-risk users face real risk of silent monitoring even on fully updated Android if the modem patch is delayed.

How it could have been prevented

Install the latest Pixel security update that addresses CVE-2026-58704 immediately via Settings > System > System update.

Enable automatic updates, restrict untrusted networks or nearby base-station exposure where feasible, and monitor for unusual battery, data, or baseband behavior. High-risk users should consider additional mobile threat defense tooling.

What happened

Cisco confirmed active exploitation of CVE-2026-76460, a critical authentication bypass in an API endpoint of Identity Services Engine (ISE). Insufficient authentication controls let a remote unauthenticated attacker send a crafted request and gain unauthorized access to the web-based management interface.

The flaw carries a CVSS 10 score and was added to CISA KEV. Cisco observed attacks but has not released full technical details of the campaigns; indicators of compromise are available in access logs.

Who is affected

Organizations running Cisco ISE or ISE Passive Identity Connector (ISE-PIC) releases 3.0 through 3.5. Release 3.0 is end-of-maintenance; 3.1 and 3.2 receive only critical fixes.

ISE is widely deployed for network access control, device profiling, and policy enforcement in enterprises and critical infrastructure, so exposure can be large wherever management interfaces are reachable.

Why it matters

Full unauthenticated access to the ISE management plane can let attackers alter network access policies, create backdoor accounts, disable logging, or pivot deeper into the enterprise. Compromised ISE effectively undermines zero-trust and NAC controls.

Because attackers may wipe device logs, external network and firewall logs become essential for detection.

How it could have been prevented

Upgrade immediately to a fixed release: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. No workarounds exist.

Review access.log on every node for suspicious usernames; if compromise is suspected, re-image nodes and restore from clean configuration backups. Cross-check external firewall and network logs for unexpected uploads or connections from the ISE hosts. Migrate off unmaintained 3.0 and minimize exposure of management interfaces.

What happened

Mandiant reported that an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider. The assistant recommended a poisoned software package that the developer accepted, after which the attacker installed an infostealer via a malicious PyPI package and stole GitHub OAuth tokens.

The attacker then deployed the self-spreading Shai-Hulud worm across about 100 internal code repositories, stole repository secrets and product source code, and also poisoned a package in the company's official namespace, leading to a second infection when another employee pulled it.

Who is affected

The unnamed software-as-a-service provider and its developers using the AI coding assistant. Roughly 100 internal repositories were infected; stolen secrets and source code create downstream risk for customers and any consumers of the poisoned packages.

Similar Shai-Hulud-family activity has previously targeted developer tools, CI/CD, cloud configs, and AI tool files in separate campaigns.

Why it matters

AI coding assistants with broad session and tool access become high-value targets: a single hijacked session can turn trusted recommendations into supply-chain compromise at machine speed. Stolen OAuth tokens and secrets enable persistent access and further lateral movement.

Builders relying on AI pair-programming must treat the assistant's environment as a privileged attack surface equivalent to a developer workstation.

How it could have been prevented

Verify every AI-recommended third-party dependency against cryptographic checksums and an approved allowlist before installation. Keep raw API keys, long-lived OAuth tokens, and secrets out of direct reach of IDE extensions and assistants.

Route all dependency traffic through controlled internal repositories or proxies. Monitor for unexpected package publishes in internal namespaces and rotate any tokens that may have been exposed. Segment AI-assistant privileges and require human review for install actions.

What happened

Attackers are actively exploiting CVE-2026-27540, a critical unrestricted file-upload flaw in the WooCommerce Wholesale Lead Capture plugin, to drop PHP webshells on WordPress sites. The plugin's unauthenticated AJAX handler wwlc_file_upload_handler reads the allowed-extension list from the attacker-controlled request and disables WordPress type checking, turning a single crafted request into remote code execution.

Wordfence blocked more than 100,000 exploitation attempts. The flaw was patched in February 2026 in version 2.0.3.2; heavy scanning occurred in June with continued activity later. Webshells typically report host details and provide an upload form for further files.

Who is affected

WordPress sites running WooCommerce Wholesale Lead Capture versions up to and including 2.0.3.1. The premium plugin from Rymera Web Co has an estimated 6,000 active installations.

Any site still on the vulnerable versions remains fully exposed to unauthenticated RCE via the registration-form upload endpoint.

Why it matters

Unauthenticated webshell upload gives attackers complete control of the WordPress site, enabling data theft, malware distribution, SEO spam, or pivot into the hosting environment. Even months after a patch, mass exploitation continues against unupdated sites.

E-commerce sites handling customer and payment data face elevated regulatory and financial risk once a webshell is planted.

How it could have been prevented

Update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later immediately. A WAF rule can block known exploits but does not replace the patch.

Inspect the uploads directory for unexpected PHP files (commonly shell.php), review access logs for admin-ajax.php requests containing the wwlc_file_upload_handler action, remove unknown admin accounts, and scan for additional backdoors. Absence of log hits does not guarantee cleanliness.

What happened

A hacker collective calling itself stegan0gram physically removed a Flock Safety automatic license-plate-reader camera, copied nearly all data stored on the device, recovered an on-device encryption key, and dumped the material. Analysis by 404 Media and WIRED showed the camera had captured 1.6 million images of roughly 50,000 vehicles over 21 days, plus thousands of videos and logs.

While the most sensitive storage stayed encrypted, recovered data confirmed the device software detects people, vehicles, plates, and bicycles, can generate dozens of images per vehicle, and sometimes isolates bumper stickers or clothing graphics. The collective plans to publish reverse-engineering details.

Who is affected

Drivers and pedestrians whose vehicles or images were captured by the specific Flock camera during the 21-day window (approximately 50,000 vehicles). Flock cameras are deployed by many local law-enforcement agencies and feed a national searchable network.

Broader implications exist for any community using Flock or similar ALPR systems whose physical devices can be stolen and imaged.

Why it matters

The dump demonstrates that claimed on-device encryption can be defeated once an attacker has physical custody, exposing detailed movement histories, vehicle attributes, and incidental images of people. It also shows the cameras perform richer computer-vision tasks than simple plate reads.

Public trust, privacy litigation, and municipal contracts for ALPR networks are directly affected when internal data and detection capabilities become public.

How it could have been prevented

Treat ALPR and similar edge devices as high-value physical assets: use tamper-evident mounts, rapid missing-device alerts, remote wipe or key-rotation capabilities, and minimize locally stored unencrypted sensitive data.

Agencies should review retention policies, limit national sharing where not required, harden device firmware and key storage, and monitor for anomalous camera offline events. End users have limited direct controls beyond supporting stronger local oversight and data-minimization rules.

What happened

Spain's data protection authority (AEPD) reported its first personal-data breach attributed to an autonomous AI agent. According to the affected organization's notification, the agent scanned generic files for weaknesses, successfully logged into the company network, independently discovered a flaw in a target application, altered personal records, and extracted invoice data.

AEPD deputy director Francisco Pérez Bes cautioned that the information still requires further analysis and that use of a particular model does not imply the model provider was compromised or that the tool was designed for malice.

Who is affected

The still-unnamed Spanish organization whose network and application were accessed, plus the individuals whose personal data and invoices were modified or exfiltrated.

The incident is treated as a significant early signal for any entity processing personal data under GDPR-style regimes that is beginning to deploy or face AI agents.

Why it matters

An agent that can chain reconnaissance, authentication, vulnerability discovery, and data manipulation without step-by-step human guidance compresses attacker timelines and outpaces traditional detection windows. AEPD and Spain's National Cryptologic Center both warn that offensive AI is already operational.

Data-protection officers must now assume automated, adaptive intrusion techniques will appear in real incidents, not just research demos.

How it could have been prevented

Review and harden identity controls, enforce least privilege, accelerate vulnerability management, and minimize stored personal data. Impose strict governance on any internal AI agents, including network segmentation, human approval gates for sensitive actions, and comprehensive logging.

Monitor suppliers for agentic tooling risk, prepare incident-response playbooks for high-speed automated attacks, and treat AI-assisted offensive capability as a current rather than future threat.

What happened

CISA published its first formal guidance on cyber decoys, titled "Using Cyber Decoys to Strengthen Detection and Response." The 22-page document advises critical-infrastructure owners and operators on deploying fake systems, accounts, and data (honeypots, honeytokens, and similar) to distract adversaries and generate high-fidelity alerts.

The guidance grew from internal discussions with CISA threat hunters and penetration testers. Acting cybersecurity division executive director Chris Butera described decoys as a low-cost, high-fidelity complement to zero-trust and assume-compromise strategies, especially useful for resource-constrained organizations.

Who is affected

Critical-infrastructure owners and operators in the United States, plus any defensive team seeking practical deception techniques. CISA states the material is relevant for everyone but particularly valuable where staffing or budget is limited.

Organizations already practicing zero-trust or assume-breach models gain an additional detection layer.

Why it matters

Living-off-the-land and stealthy intrusions often evade signature-based tools; well-placed decoys create tripwires that legitimate users never touch, turning any interaction into a strong signal of malicious activity. The guidance lowers the barrier for teams that previously lacked playbooks for deception.

Widespread adoption can make networks noisier and less predictable for attackers while improving detection without large new sensor budgets.