Daily Cybersecurity News – September 18, 2026

What happened

Attackers compromised Brevo (formerly Sendinblue) and used a stolen long-lived Cloudflare API key to deploy a malicious worker that injected scripts into brevo.com, sibforms.com, and three JavaScript files customers embed on their sites.

The worker was active for roughly 4-5.5 hours on September 14, 2026. It served a fake Cloudflare "verify you are human" ClickFix page to selected visitors, tricking them into running a command, and on WordPress sites with a Brevo widget it tried to install a malicious plugin for logged-in admins.

The incident followed an earlier September 10 SAML SSO flaw that let attackers access 138 accounts, send phishing from some, and export contacts from others. Sansec estimates more than 100,000 websites were impacted while the worker ran.

Who is affected

Brevo customers who embed the platform's JavaScript widgets, trackers, forms, or chat features on their sites, plus visitors to those sites and Brevo's own properties.

WordPress administrators who visited their own sites during the window faced potential backdoor installation. Crypto firm Trezor was among the initially compromised accounts. Scale is over 100,000 sites per Sansec.

Why it matters

A trusted third-party marketing platform became a mass malware delivery channel without any change by site owners. Visitors could be socially engineered into running malware, and admin sessions could leave persistent WordPress backdoors.

Even short-lived supply-chain injections create lasting cleanup work and risk of secondary compromise for high-value targets like e-commerce and crypto users.

How it could have been prevented

Audit all sites that load Brevo/sibforms scripts for unauthorized plugins or modified files. Revoke and rotate any Brevo or Cloudflare API keys and long-lived credentials. Scan visitor machines that hit fake verification pages.

Enable CSP headers that block unexpected script sources, monitor for unexpected Cloudflare Workers, and treat marketing widgets as high-risk third-party code that needs integrity checks and least-privilege access.

What happened

Researchers at AIR disclosed Plugin4Shell, a zero-click remote code execution flaw affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. It bypasses SHA pinning so that a marketplace-pinned plugin commit can be swapped for malicious code without the pin appearing broken.

The agents check out the pinned commit but do not verify the checkout actually landed on that hash. One variant abuses git branch-name handling; Gemini CLI has a separate fetch/checkout issue with the same outcome. Auto-updates (default in some agents) make the swap reach already-installed plugins with no user action.

AIR demonstrated end-to-end chains including earlier plugin takeovers that reached tens of thousands of agents. Anthropic and OpenAI have patched (Claude Code 2.1.179, Codex 0.146.0); Microsoft has not shipped a Copilot fix and Google is deprecating Gemini CLI without a patch. No CVE was assigned at disclosure and there is no public evidence of in-the-wild exploitation yet.

Who is affected

Anyone running Claude Code, Codex, GitHub Copilot, or Gemini CLI that installs plugins from a marketplace, including users who only install reviewed and pinned plugins.

Exposure covers enterprises and individual developers whose agents hold credentials, source code, and network access equivalent to the human operator. Millions of agent instances are potentially in scope given marketplace adoption.

Why it matters

This is described as the first supply-chain vulnerability of the AI agent ecosystem. A successful swap gives the attacker the same reach as the developer running the agent - source code, secrets, internal systems, and cloud credentials.

Because the check happens inside the agent rather than the marketplace, marketplaces cannot fully protect users; unpatched agents remain exposed indefinitely, and auto-update makes the attack truly zero-click.

How it could have been prevented

Immediately update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. For GitHub Copilot, disable auto-updates and marketplace plugins until a fix ships, or restrict plugin sources. Migrate off Gemini CLI as recommended.

Pin and verify plugin sources manually where possible, monitor agent process behavior and unexpected network calls, and treat coding-agent plugins with the same scrutiny as traditional package dependencies. Prefer agents or marketplaces that cryptographically verify checkouts.

What happened

Cisco disclosed CVE-2026-76460, a CVSS 10 critical authentication-bypass vulnerability in an API of Cisco Identity Services Engine (ISE). An unauthenticated remote attacker can send a crafted request to bypass authentication and gain full control of the affected device.

The flaw was exploited in the wild before the Wednesday disclosure and patch. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-16. Cisco discovered it during a technical support case and published indicators of compromise; there are no workarounds.

This is the second actively exploited Cisco zero-day in as many days (after CVE-2026-76461 in Secure Email Gateway) and continues a pattern of critical ISE flaws (including CVE-2025-20337 and CVE-2025-20281) that have been exploited since mid-2025.

Who is affected

Organizations running vulnerable versions of Cisco Identity Services Engine and ISE Passive Identity Connector. ISE is widely deployed for network access control, policy enforcement, and identity in enterprise and government networks.

Exact vulnerable version ranges are in Cisco's advisory; any unpatched ISE appliance exposed to the network is at risk of complete takeover.

Why it matters

ISE sits at the center of network access decisions. Root-level compromise lets an attacker rewrite access policy, steal stored credentials, wipe logs, and pivot into every segment the appliance controls.

Repeated critical, actively exploited ISE bugs show the product is a high-value target; operators face urgent, repeated patching pressure with no temporary mitigations available.

How it could have been prevented

Upgrade immediately to the fixed software releases listed in Cisco's security advisory for CVE-2026-76460. Apply the published indicators of compromise to hunt for prior exploitation.

Restrict management and API access to ISE with network segmentation and strong authentication, monitor for anomalous API calls, and treat ISE as a tier-0 asset requiring rapid patching and continuous integrity monitoring. No workarounds exist.

What happened

OpenSourceMalware identified 13 malicious npm packages that deliver a previously undocumented JavaScript stealer named WeaselBiscuit. The packages include @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, and process-tailwind.

On import the loader pulls the main payload from an Npoint dead-drop and executes it in memory. It profiles the host, harvests Chrome extension storage (Local Extension Settings LevelDB) across Windows, macOS, and Linux, and can log clipboard and keystrokes on Windows under C2 command. C2 is at 103.170.217.184:8787.

The malware is a stripped-down variant sharing functional overlaps with DPRK Contagious Interview tools BeaverTail and OtterCookie, but lacks remote access, persistence, wallet drainers, and secondary payload delivery. Researchers note the overlap but state there is no definitive attribution evidence yet.

Who is affected

Developers and organizations that installed any of the 13 listed npm packages, especially those working with Node.js projects that pull dependencies automatically.

Anyone whose Chrome (or Chromium-based) browser extensions store sensitive data such as wallet state, tokens, or credentials is exposed once the stealer runs. Cross-platform reach covers Windows, macOS, and Linux developer workstations.

Why it matters

npm remains a high-volume vector for developer-targeted stealers. Even a lightweight payload that only grabs extension storage can expose crypto wallets, session tokens, and other high-value secrets held by browser extensions.

Functional ties to known Contagious Interview malware raise the stakes for software supply-chain hygiene, because a single malicious import can compromise an entire development environment and its secrets.

How it could have been prevented

Uninstall and purge the listed packages immediately. Audit package.json and lockfiles for the @biz44 scope and the other named packages; rotate any credentials or tokens that may have been present in browser extension storage.

Enforce npm allow-lists or private registries, enable package provenance and 2FA on publishing accounts, scan dependencies with tools that detect post-install scripts and known IOCs, and treat Npoint or similar paste services as high-risk dead-drop indicators.

What happened

Hacktron researchers used Claude to develop a reliable exploit for an unpatched flaw in the libheif library (used by ImageMagick) that Discourse passed HEIC/HEIF uploads to on OpenAI's community forum. The upstream fix had existed for a year but was never flagged as a security issue, so no CVE was assigned and it missed normal patching.

Remote code execution on the forum, combined with an OpenAI-side sign-in token flaw that granted excessive permissions (full API access to linked ChatGPT and Codex accounts), allowed takeover of employee accounts. Researchers demonstrated the chain by taking over an employee account whose Codex integration was linked to OpenAI's GitHub organization and opening a pull request in an internal repository, then stopped.

OpenAI treated the image-processing issue as residing in third-party Discourse and the token-permission issue as its own. The researchers earned a bug bounty. Until fixed, any user or employee logging into the forum was theoretically at risk of account takeover that could extend to connected services such as GitHub, Slack, and email.

Who is affected

OpenAI employees and users who authenticated to community.openai.com with their OpenAI accounts, especially those with ChatGPT, Codex, or GitHub integrations linked.

In the demonstrated path this reached internal code repositories. Broader theoretical exposure included any services connected to the compromised OpenAI accounts.

Why it matters

The combination of an AI-assisted exploit for a forgotten library bug and an over-privileged sign-in token turned a community forum into a path to internal source code. It shows how third-party components and token design flaws can chain into high-impact access even at a leading AI company.

The fact that researchers could open an internal PR without reading further code underscores the real risk of lateral movement once an employee identity is compromised.

How it could have been prevented

Patch ImageMagick/libheif stacks and disable or tightly sandbox unsupported image formats on any Discourse or upload-handling services. Audit and minimize scopes on sign-in and SSO tokens so forum sessions cannot grant full API or GitHub access.

Enforce stricter separation between community and internal identity systems, require additional verification for high-privilege actions, monitor for anomalous pull requests from employee accounts, and treat AI-assisted exploit development as a realistic attacker capability in threat models.

What happened

Spain's data protection agency AEPD reported the country's first agentic AI-powered personal data breach. AEPD president Francisco Pérez Bes stated that an agent using a known language model scanned generic files, successfully logged in, then autonomously searched for application vulnerabilities.

Once inside it modified personal data and accessed invoices. The agency said the agent was used as an instrument to chain different phases of the attack, implying a human operator directed it rather than a fully rogue system. Full technical details await the formal breach-notification investigation.

Pérez Bes called it a watershed moment turning AI from theoretical to real-world risk for Spanish data controllers.

Who is affected

The still-unnamed organization whose systems and personal data (including invoices) were accessed and modified, plus the individuals whose data was involved.

Any Spanish entity processing personal data under AEPD jurisdiction that has not yet incorporated agentic AI threats into its risk assessments is now on notice.

Why it matters

An AI agent successfully chained reconnaissance, authentication, vulnerability discovery, data modification, and invoice access in a real incident. This raises the speed and scale of multi-stage attacks beyond what a single human operator can typically achieve unaided.

Regulators are already signaling that AI-driven attacks must be factored into data-protection risk analyses, response-time expectations, and supplier controls, with direct compliance implications under GDPR-style regimes.

How it could have been prevented

Incorporate agentic and AI-assisted attack scenarios into data-processing risk assessments and DPIAs immediately. Enforce strong authentication, least-privilege access, and rapid vulnerability patching on any system holding personal data or invoices.

Monitor for anomalous automated scanning and login patterns, minimize stored personal data, segment systems so a single foothold cannot reach invoices and identity stores, and prepare machine-speed incident response playbooks. Review and harden any AI tools or APIs exposed in the environment against jailbreaks and misuse.

What happened

The U.S. Justice Department, FBI Anchorage field office, and Royal Canadian Mounted Police seized the primary domain and related websites of NightmareStresser, a long-running DDoS-for-hire (booter/stresser) service. The action is part of the ongoing international Operation PowerOFF.

Officials state the service was used to launch hundreds of thousands of actual or attempted DDoS attacks since at least 2022 against educational institutions, government agencies, gaming platforms, and millions of people. The operators claimed tens of thousands of users and marketed the service openly, including an affiliate program; they asserted they operated under Russian law.

No arrests were announced with the seizure. NightmareStresser domains now display law-enforcement seizure notices. Authorities have seized more than 100 DDoS-for-hire domains since 2018 under the same campaign.

Who is affected

Former customers and affiliates of NightmareStresser who used it for attacks, plus the wide range of prior victims (schools, government, gaming, and individuals) who may see reduced attack volume from this particular service.

Operators and partners of the service face identification efforts. Any organization previously targeted by traffic from the platform benefits from the infrastructure disruption.

Why it matters

DDoS-for-hire services lower the barrier so that low-skill actors can knock sites offline for pranks, extortion, or political reasons. Removing a popular, long-lived platform with aggressive marketing and an affiliate program raises the cost and friction for those attackers.

Even temporary domain seizures disrupt ongoing campaigns and generate investigative leads on users and operators, though historically many such services reappear under new names.