The Human Take

Zero-Days Everywhere — What a Record Patch Tuesday and an Alleged FBI Hack Teach Us About Unknown Flaws

A zero-day is a flaw attackers exploit before a fix exists. This month delivered two very different zero-day stories. One ended with a patch. The other is still unfolding.

Story one: Microsoft’s biggest Patch Tuesday ever

On September 8, Microsoft shipped its largest Patch Tuesday on record. Counts vary by how you tally, but Tenable puts customer-actionable fixes at 964 CVEs, with 104 rated critical. That’s roughly 70% above the previous record, set just this July.

Two of those flaws were already being exploited in the wild:

• CVE-2026-85880, a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC)
• CVE-2026-81963, a “link following” flaw in the Windows Update Stack, the component that installs updates

Both score 7.8 on CVSS. Both let an attacker who already has a foothold jump to SYSTEM, the highest privilege on a Windows machine.

The Common Vulnerability Scoring System (CVSS) is an open industry standard used to measure the severity of software security vulnerabilities. It assigns a numerical score from 0.0 to 10.0 to help security teams understand how critical a bug is and prioritize patching. A flaw that can be exploited remotely over the internet with no authentication and causes full system takeover receives a 10.0. Conversely, a flaw that requires local physical access, elevated privileges, and user interaction receives a much lower score

That’s the key point. Neither bug gets an attacker in the door. They turn a small intrusion, like one phished laptop, into full control. Microsoft hasn’t said who used them or how widely.

Now story two: ShinyHunters says it hacked the FBI

On September 22, the FBI’s jobs portal was defaced with a message claiming it had been seized by ShinyHunters, a well-known extortion group. The site then went offline “for maintenance.”

The group’s claims, as told to BleepingComputer and other outlets:

• It found and used a new zero-day in Oracle PeopleSoft, HR software widely used for recruiting and payroll.
• It moved from there into FBI-managed AWS GovCloud systems.
• It took 2–3 TB of data on current and former employees and job applicants.

On motive, the group says this was retaliation for a May 2026 FBI FLASH report about it, not a money play.

What we know so far: the FBI says it is investigating unauthorized activity on its jobs site. It has not confirmed that internal systems were breached or data stolen. Notably, that same FBI report warned that ShinyHunters tends to exaggerate its access. Treat this as a serious claim, not an established fact.

Even so, the pattern is credible. Oracle issued an emergency alert in June for a different PeopleSoft flaw (CVE-2026-35273) that the group had already exploited against education institutions.

The common theme?

One story is about the attacker’s first step: an unknown flaw in internet-facing software. The other is about the next step: privilege escalation once inside. Real intrusions chain both. The initial access bugs and the local privilege escalation bugs perform different functions in the kill chain. Initial access breach perimeter defenses, while local privilege escalation turns standard access into administrative control.

That’s why “we’ll patch when there’s a fix” isn’t enough. By the time a zero-day has a CVE number, someone has usually already used it.

What to do this week

• Patch the two Windows zero-days first, then the critical remote code execution bugs. With nearly 1,000 fixes, prioritization matters more than speed on everything.
• Run PeopleSoft or other HR systems? Limit what’s exposed to the internet, watch for unusual activity, and check Oracle’s advisories closely.
• Assume a foothold. Detect privilege escalation and lateral movement, especially into cloud environments.
• Recruiting portals hold sensitive data. Applicant records are a target in their own right. Protect them like payroll data.

Weekly Cyber News Summary September 25, 2026

This week in cyber:

• ENISA report details persistent Russian and Chinese state-nexus intrusions.
• Russian and Chinese threat groups target European and regional sectors.
• Palo Alto Networks launches AI-driven continuous offensive testing service.
• Anthropic CEO advocates safety pacing guidelines for frontier AI models.
• Microsoft fixes two exploited zero-days in Patch Tuesday release.
• ShinyHunters claims breach of FBI database via PeopleSoft exploit.
• EU Cyber Resilience Act mandatory reporting rules enter into force.
• Senator Markey introduces bill establishing AI cyber investigation board.

State-Sponsored Attacks

ENISA Highlights European Surge in State-Sponsored Attacks

The European Union Agency for Cybersecurity (ENISA) released its comprehensive Threat Landscape report assessing state-sponsored activity impacting EU member states. Russian state-nexus threat actors accounted for nearly half of all identified nation-state cyber activity, predominantly focusing on diplomatic institutions, central governments, and public infrastructure across Eastern Europe. Concurrently, China-nexus groups maintained persistent cyberespionage intrusions aimed at transport and logistical networks across the continent.

The findings emphasize that nation-states rely heavily on unauthorized access, credentials theft, and initial access acquired through vulnerability exploitation. Furthermore, state actors are increasingly leveraging hybrid operations—combining traditional intrusion operations with foreign information manipulation, denial-of-service barrages, and critical infrastructure probes—to test defensive capabilities and exploit geopolitical volatility.
Sources:
Industrial Cyber: https://industrialcyber.co/reports/enisa-threat-landscape-2026-highlights-ransomware-vulnerability-exploitation-ai-enabled-attacks-across-eu-organizations/
Cybersecurity Dive: https://www.cybersecuritydive.com/news/state-infrastructure-resources-cyberthreats/830178/

Regional Campaigns

Russian Hybrid Operations Target Northern European Infrastructure

A coordinated sequence of cyber and physical operations targeting Northern European nations, including Sweden, Finland, Denmark, and Estonia, has intensified throughout September 2026. Threat intelligence disclosures confirm that state-aligned groups executed distributed denial-of-service (DDoS) campaigns against public services alongside reported physical disruptions to undersea telemetry cables. The aggressive campaigns highlight a shift toward multi-domain pressure against regional trade and government assets.

In addition to direct network disruptions, threat intelligence reports revealed the deployment of autonomous tooling and multi-platform media manipulation designed to destabilize public sentiment and disrupt local communications. Security analysts emphasize that regional defenses are being continuously tested by automated attack vectors, requiring closer operational alignment between regional CERTs and infrastructure operators.
Sources:
Cyfluence Research: https://www.cyfluence-research.org/post/cyber-based-influence-campaigns-7th-13th-september-2026-report
Infosecurity Magazine: https://www.infosecurity-magazine.com/news/ransomware-attacks-reach-record/

AI Integration

Palo Alto Networks Unveils Agentic AI Security Operations Platform

Palo Alto Networks announced the release of Unit 42 Continuous Frontier AI Defense, an offensive security service leveraging agentic frontier AI models to perform continuous vulnerability discovery and attack path analysis. Built on specialized models from Anthropic and OpenAI, the framework executes automated adversary simulations across cloud environments, source code, and network endpoints to discover exposures before threat actors exploit them.

The service is designed to match the accelerated speed of AI-driven attacks, which have reportedly compressed enterprise breach timelines from weeks down to hours. By combining continuous machine scanning with human verification from offensive experts, the system validates exploitability, generates virtual patches, and integrates directly into enterprise remediation platforms.
Sources:
Unite.AI: https://www.unite.ai/unit-42-unveils-subscription-for-continuous-ai-powered-offensive-security/
CISA Advisories: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a

AI Policy and Posture Adaptation

Industry Leaders Propose AI Pacing Frameworks to Align Defense and Safety

In a major policy movement across the artificial intelligence and cybersecurity sectors, industry leaders have published formal frameworks advocating for voluntary AI safety pacing agreements. The strategy outlines structured protocols allowing frontier model developers to deliberate on safety thresholds and threat capabilities without breaching federal antitrust constraints.

The proposed frameworks recommend utilizing independent third-party evaluators, establishing clear antitrust firewalls between commercial operations and safety research, and securing government oversight from regulatory agencies. This posture adjustment comes amid mounting pressure on organizations to ensure defensive security mechanisms and alignment protocols evolve in tandem with high-capability agentic models.
Sources:
Holland & Knight: https://www.hklaw.com/en/insights/publications/2026/09/ai-pacing-agreements-legal-issues-and-how-to-attempt-to-manage-them
Davis Wright Tremaine: https://www.dwt.com/blogs/privacy–security-law-blog/2026/09/trust-issues-september-2026

Zero-Day Exploits/CVEs

Microsoft Addresses Active Zero-Days in Record September Update

Microsoft released its September Patch Tuesday security updates addressing 974 CVEs across its software ecosystem, highlighting two privilege escalation zero-day vulnerabilities actively exploited in the wild. The first zero-day, tracked as CVE-2026-85880, is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component that enables a local attacker to break out of low-privilege sandboxes to reach full SYSTEM privileges.

The second actively exploited flaw, CVE-2026-81963, impacts the Windows Update Stack through an improper link resolution vulnerability. Local attackers with minimal privileges can manipulate link resolutions to elevate access without requiring any user interaction. Microsoft urged administrators to prioritize these updates alongside critical remote code execution fixes affecting Netlogon and DNS Server.
Sources:
CrowdStrike Blog: https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/
SecurityWeek: https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/

Incident Reports

ShinyHunters Claims Compromise of FBI Systems via Enterprise Zero-Day

The cybercrime syndicate known as ShinyHunters claimed responsibility for breaching systems associated with the U.S. Federal Bureau of Investigation, claiming to have exfiltrated sensitive data concerning current employees and job applicants. The extortion group posted proof of access on their dark web portal after temporarily defacing an applicant portal managed by the agency.

According to statements attributed to the group, the entry vector involved exploiting an unpatched zero-day vulnerability within an enterprise PeopleSoft deployment. Federal law enforcement acknowledged awareness of the claims regarding unauthorized activity on the application site and confirmed an active investigation into the scope and validity of the incident.
Sources:
The Hacker News: https://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.html
SecurityWeek: https://www.securityweek.com/astrana-health-data-breach-impacts-private-confidential-information/

Framework Changes

EU Cyber Resilience Act Mandatory Vulnerability Reporting Goes Live

Key reporting obligations under Article 14 of the European Union Cyber Resilience Act (CRA) officially took effect, establishing strict mandatory incident notification timelines for manufacturers of digital hardware and software products. Under the new mandate, organizations must report actively exploited vulnerabilities or severe security incidents within a tight 24-hour window from initial detection.

The framework mandates a three-tiered reporting process via a centralized EU platform managed by ENISA, requiring an initial alert within 24 hours, an expanded notification within 72 hours, and a final technical mitigation summary. The regulation significantly shifts global supply chain standards, compelling manufacturers selling into the EU market to modernize their vulnerability handling and patch distribution workflows.
Sources:
Inmove IT: https://www.inmoveit.com/en/cyber-resilience-act-in-2026-what-changes-from-september-and-what-businesses-should-review/
Kirkland & Ellis: https://www.kirkland.com/publications/kirkland-alert/2026/09/the-eu-cyber-resilience-act

New Legislation

U.S. Senate Introduces Bill to Create AI Cyber Incident Investigation Board

U.S. Senator Edward J. Markey introduced the Cybersecurity and AI Board of Investigations Act, aiming to establish an independent oversight body to investigate major cyberattacks assisted by artificial intelligence. Modeled after the National Transportation Safety Board (NTSB), the proposed board would be granted subpoena authority to compel testimony and document disclosures from public and private entities during post-incident inquiries.

The legislative initiative stems from growing concerns surrounding agentic AI models being deployed to conduct automated network exploitation and data exfiltration. If enacted, the board will be tasked with conducting forensic evaluations of complex AI-assisted security breaches, publishing public reports, and issuing binding security recommendations across federal infrastructure and key commercial sectors.
Sources:
U.S. Senate Press Release: https://www.markey.senate.gov/news/press-releases/as-ai-agents-carry-out-attacks-senator-markey-introduces-legislation-establishing-independent-body-to-investigate-cyber-hacks-assisted-by-artificial-intelligence
DLA Piper Privacy Matters: https://privacymatters.dlapiper.com/2026/04/comprehensive-federal-privacy-legislation-introduced/

The Human Take

Try to hold on to your surprise, but AI made the news again. I’m not going to turn every one of these into a diatribe about AI, but… Well… Just a little more.

Agentic AI is becoming the new threat. Last time I was here, I mentioned that AI can’t do anything we can’t, but it can do what we can do better than we can. An agent is a purpose-built AI that does something on behalf of (or in lieu of) a person.

Want to aggregate a bunch of news? Got an agent for that.

Want to check your email and manage your inbox? Agent.

<takes a deep breath>

Want to map a network, find some vulnerabilities, then exploit a vulnerability, drop a payload, phone home, move laterally, drop ransomware and ransom notices, delete every backup you can find, steal all the password lists on the network and start exfiltrating data? There’s an agent for that.

I have run penetration testing teams in the past, and the biggest problem was time and organic needs. I have four people to do a test, I have 800 hours of work to do, that’s about 5 weeks of work if my team does nothing else. And they get bored. They have to sleep and eat and touch grass, the AI needs none of that. Now, I have a tool that I can give to one of those humans, they tell the tool what to do. Then they keep an eye on it while they do all the squishy human things they need to do, or coordinate multiple agents doing multiple penetration tests at once. It doesn’t replace my penetration tester, it makes him more powerful. And we have rules to follow, clients to please, laws to not break. Imagine those same tools in the hands of someone who’s only motivation is gain, and their concern for laws, clients or rules is zero.

A massive law firm experienced a breach this week, showing that everyone needs to get on it, because with the speed of attack now, there’s no such thing as “we’re probably good.” Iran pulled some stunts showing why you should monitor your network for unauthorized messaging traffic (or why you should have such a thing as “unauthorized messaging traffic”). CISA also issued a warning for ScreenConnect being under active attack as a CVSS of 9.9, you should patch that if it means something to you. If it doesn’t, make sure it doesn’t mean something to you, then ask your organization how they are handling remote connections. If you’re in security specifically, ask if the restrictions around your remote solutions are strict enough. Spoiler warning: They are most likely not.

---

Weekly Cyber News Summary September 17, 2026

This week in cyber:

• Western nations expose Iranian spyware Chosen Brick targeting global dissidents.
• Russian and Chinese actors hijack Claude AI for automated cyberattacks.
• First autonomous AI agent breach reported to Spanish privacy regulators.
• Google patches zero-click Pixel modem vulnerability exploited in targeted attacks.
• Law firm Greenberg Traurig discloses client data exposure following breach.
• ConnectWise patches critical ScreenConnect privilege flaw under active exploitation.

State-Sponsored Attacks

Iran Deploys ‘Chosen Brick’ Surveillance Malware Against Global Dissidents

Cybersecurity and intelligence authorities from the United States, the United Kingdom, and the Netherlands issued a joint advisory exposing an Iranian state-sponsored surveillance campaign utilizing a Windows malware family dubbed Chosen Brick. Operating since at least 2025 under Iran’s Ministry of Intelligence and Security (MOIS), threat actors leverage social engineering over WhatsApp and Telegram to build rapport before delivering malicious installers disguised as utility software or medical records. The targeted operations aim to harvest emails, contact lists, and social media messages to physically track dissidents, activists, and journalists opposing the Iranian regime.

Upon installation, Chosen Brick sets up persistent registry keys and configures exclusions in Microsoft Defender to evade local security software. The malware uses individual Telegram bot IDs for command-and-control operations, enabling attackers to record host microphone audio, grab desktop screenshots, exfiltrate messaging database files, or wipe host machines entirely. Regulators noted that exfiltrated personal details have been posted onto pro-Iranian leak sites to conduct public harassment and intimidation campaigns against targets.
Sources:
SecurityWeek: https://www.securityweek.com/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/
Security Affairs: https://securityaffairs.com/199217/malware/chosen-brick-irans-surveillance-malware.html

AI Integration

State-Sponsored Actors Automate Exploitation and Malware Assembly via Claude AI

Anthropic published a report detailing the disruption of multiple state-aligned cyber campaigns that abused its Claude AI model for automated operational workflows. One notable operation attributed to a Russian state-nexus espionage cluster (tracked as GTG-20006 or Midnight Blizzard) utilized custom AI pipelines to automatically rebuild and re-deploy malware toolkits whenever security software detected static artifacts. The group targeted over 20 European, Ukrainian, and Middle Eastern defense and government agencies through hotel Wi-Fi DNS hijacking, mobile exploit kits, and credential-harvesting tools.

Additionally, Anthropic exposed a China-linked threat actor that used Claude to advance technical research across three parallel tracks for an anti-torpedo naval weapons system. Financially motivated cybercriminals also leveraged autonomous AI agents to execute supply chain data theft against a SaaS provider, harvesting over 2,100 Azure AD tokens across 40 corporate tenants in just 34 hours. Anthropic confirmed that the accounts associated with these operations were terminated and digital signatures were mapped to enhance model safety guardrails.
Sources:
The Hacker News: https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html
Hindustan Times: https://www.hindustantimes.com/world-news/phishing-weapons-and-spying-top-5-misuses-of-ai-flagged-by-anthropic-claude-101789110893261.html

AI Policy and Posture Adaptation

Spanish Data Protection Authority Logs First Autonomous AI Agent Data Breach

The Spanish Data Protection Agency (AEPD) confirmed receiving the first official breach notification where an autonomous AI agent was identified as the primary vector of an intrusion. An undisclosed organization reported that an external party deployed an AI agent powered by a commercial Large Language Model to breach its environment. Operating with minimal human intervention, the agent successfully authenticated into the system, conducted reconnaissance to find application weaknesses, modified internal personal records, and exfiltrated customer billing invoices.

The regulator emphasized that the event represents a qualitative shift from traditional AI-assisted phishing to fully autonomous, multi-stage agentic attacks capable of planning intermediate tasks and executing code at machine speed. The AEPD advised enterprise risk managers to update compliance frameworks immediately, warning that defense strategies must incorporate rapid AI-driven containment systems because traditional human-dependent response timelines are insufficient against autonomous agent speeds.
Sources:
SecurityWeek: https://www.securityweek.com/first-agentic-ai-data-breach-reported-to-spanish-regulator/
Shattered.io: https://shattered.io/aepd-first-ai-agent-data-breach-spain-2026/

Zero-Day Exploits/CVEs

Google Patches Zero-Click Pixel Cellular Modem Vulnerability Under Active Exploitation

Google released its September 2026 security update addressing CVE-2026-58704, a high-severity zero-day vulnerability affecting the cellular modem software in Google Pixel devices. The bug stems from a logic error within permission validation routines inside the modem component, enabling proximal or remote attackers to bypass authorization checks and elevate execution privileges. Critically, the vulnerability can be triggered as a “zero-click” attack, requiring no interaction or link clicks from the device owner.

Google acknowledged that the flaw has come under limited, targeted exploitation in the wild, though it did not attribute the activity to specific threat actors. Following the disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to apply security patches immediately. Google urged all Pixel users to update to security patch level 2026-09-05 or later.
Sources:
The Hacker News: https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html
9to5Google: https://9to5google.com/2026/09/16/google-pixel-targeted-zero-day-modem-attack/

Incident Reports

Global Law Firm Greenberg Traurig Reports Breach Following Dark Web Exposure

International law firm Greenberg Traurig confirmed a security breach involving client data exposure following regulatory filings with state authorities. The disclosure follows claims by an extortion cluster calling itself SilentRansomGroup, which listed the law firm on its dark web leak site after exfiltrating internal files. Official filings confirm that unauthorized actors gained access to internal documents containing sensitive personal information, including Social Security numbers.

The incident highlights ongoing threat actor targeting of major legal institutions acting as corporate data custodians. Greenberg Traurig is the fourth major international law firm to confirm a data security incident within recent weeks, joining a pattern of cyberattacks targeting legal practices to extract confidential corporate, financial, and personal records held on behalf of global clients.
Sources:
Federman & Sherwood: https://www.federmanlaw.com/blog/greenberg-traurig-llp-data-breach-investigated-by-federman-sherwood/
Emery Reddy: https://www.emeryreddy.com/blog/data-breach/greenberg-traurig-data-breach

Framework Changes

CISA Orders Immediate Remediation for Critical ConnectWise ScreenConnect Privilege Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities catalog to mandate rapid patching of CVE-2026-84869, a critical flaw affecting ConnectWise ScreenConnect remote management software. Rated CVSS 9.9, the vulnerability involves missing authorization and improper privilege management within the client software. The bug enables an attacker with basic privileges to transfer and execute unauthorized payloads on endpoints during active remote support sessions without host interaction or prompt confirmation.

Threat intelligence teams reported that adversaries have been actively exploiting the vulnerability in worm-like automated attacks to drop persistent VBScript payloads and move laterally across client networks managed by Managed Service Providers (MSPs). CISA assigned a strict three-day remediation deadline under Binding Operational Directive 26-04 for federal agencies, while security researchers urged enterprise administrators to upgrade to ScreenConnect version 26.6.5 or restrict file transfer permissions immediately.
Sources:
SecurityWeek: https://www.securityweek.com/connectwise-patches-screenconnect-vulnerability-exploited-in-worm-like-attacks/
Aviatrix Threat Research Center: https://aviatrix.ai/threat-research-center/connectwise-screenconnect-cve-2026-84869-exploitation-attacks/

The Human Take

AI driven threats. AI revolutionizes defense/offense. Governance frameworks struggle with rapid AI-driven threat evolution. We may as well just pack our bags and move off grid. Game over man.

This is… Well… This is Cyber

AI is a disrupter, no doubt about that. How much of a disrupter, final scope of influence, and how our role as cyber professionals change – well, that is still TDB. Sometimes all the AI news looks a little bleak from the trenches. How can you keep up with these ‘rapid AI-driven threats?’ Let’s start with not ignoring the basics.

CISA just released their vulnerability review for FY2024 and FY2025 (https://www.cisa.gov/resources-tools/resources/cisa-vulnerability-review), know what they found? Take a guess before reading the linked article. No doubt some fancy chained zero-day exploits driven by the agentic hive mind right? Nope, injection vulnerabilities. In FY2024 10.1% of all CVEs were injection based. In FY2025 only slightly better at 9.2%. Injection – yes, as in XSS and SQLi – those things that when we talk about them in the classroom students wonder, why are we still talking about this? Isn’t this old information? Maybe, but seems we haven’t figured it out yet.

Way back in the day I played basketball. I didn’t say I was good but I played basketball. When we started getting it handed to us by a seemingly superior team it was time for the coach to call a time-out, sit us all on the bench and remind us about the stupid mistakes we were making. Slow it down, stick to your man, no more stupid fouls. We weren’t being outplayed we were forgetting the basics that make the competition’s job difficult. Same applies to defending against all the seemingly unbeatable AI threats, and even the non-AI threats. Input validation, MFA, memory safe operation all provide barriers to otherwise simple exploits.

They’re not that good – we are ignoring the basics – we just need to get our head’s back in the game.

---

The Human Take

Hello again! Another week, another report full of AI-related news. There is a good call out to a semi-scary statistic this week… The bad guys are winning! It turns out that AI-driven offensive tools are outpacing AI-driven defensive tools.

This is… Well… This is Cyber.

As a whole, we’re always losing. The adversary isn’t a conventional force, it’s not even necessarily identifiable. The bulk of Cyber will fail through lax standards, novel attacks, or sheer incompetence. And that’s Cyber. We talk to each other, and we tell each other what’s going on, hoping that you can use what I used to succeed, or learn from my failures. Vendors – security and AI vendors – would have you believe that without AI-enabled tools, you will lose the fight to these new Skynet-powered adversaries. This is hogwash. It’s not the newest defensive tool that will stop the bad guy, it’s you.

Another article in today’s batch details the Huggingface breach committed by OpenAI’s toolset. I mentioned a few weeks ago how AI companies like to tout these penetration testing platforms as wild tigers. Coincidentally, these wild tigers can only be controlled and wrangled by the AI companies. AI is not self-aware. It’s a program. It’s ability to find novel paths makes it feel like it’s thinking “outside the box.” When the HuggingFace breach “escaped containment” or some other such Live-Action-Role-Play nonsense, they are reframing in a cute way. The reality is that their tool was not configured correctly. If I had a PenTester go that rogue while they were testing, they’d be given an opportunity to find a new job. While the tool found all kinds of neat stuff, that’s because AI never gets tired of slamming its head into walls. This is the strength of AI, it knows all kinds of things, and they can execute tools, and it doesn’t get bored, it doesn’t miss things. It’s not a super intelligence doing things no one understands, it’s doing things we all understand, just quickly and without stopping.

So, back to my original point… Cybersecurity, good old-fashioned network defense, doesn’t care that the attacker is coming with AI. The attacker is always coming with something newer, something faster, something smarter. Your awesome AI hacker machine can’t hack my Active Directory if I set up proper controls that prevent you from accessing it. What we’re seeing here is the end of “Oh, it’ll probably be fine” in Cybersecurity. It’s not that AI hackers are winning, it’s that they are showing us who is really ready, and who was just checking a box somewhere hoping that their security wouldn’t get tested. Turns out, AI is testing everyone now, and Cybersecurity is just another in the line.

This week in cyber:

• Regional campaigns show intense DDoS pressure on Israel.
• AI offense is outpacing defense, driving a new arms race.
• Enterprises race to meet new AI governance mandates.
• Critical Windows zero-day with 9.8 CVSS score patched.
• OpenAI reports on massive Hugging Face breach confluence.
• China expands CSL penalties and government oversight.

Regional Campaigns

Global Cyber Threat Briefing: July 2026 Attack Statistics and Trends

The cyber threat landscape in the Middle East continues to be heavily influenced by geopolitical tensions, with Israel being a prime target. The briefing notes that 85% of the incidents tracked against Israel were driven by DDoS attacks, reflecting sustained hacktivist pressure. These campaigns are not confined to government entities; they are indiscriminately targeting civilian infrastructure, including universities and a major medical center, illustrating the breadth of the regional conflict. Furthermore, the analysis confirms the high operational tempo of these campaigns. Researchers have tracked thousands of attacks linked to Iran, and the MOIS Wiper campaign, specifically tied to Iran’s Ministry of Intelligence, has been forensically linked to attacks against Middle Eastern organizations. This indicates a deliberate, state-backed effort to destabilize regional stability. Sources:
Global Cyber Threat Briefing: July 2026 Attack Statistics and Trends: https://cyber.thomasmurray.com/insights/global-cyber-threat-briefing-july-2026-attack-statistics-and-trends
The Escalating Cyber Risk Landscape in Regional Conflicts & Strategic Actions for 2026: https://blog.eclecticiq.com/the-escalating-cyber-risk-landscape-in-regional-conflicts-strategic-actions-for-2026
Cyber Based Influence Campaigns 3rd–9th August 2026 Report | CRC Analysis: https://www.cyfluence-research.org/post/cyber-based-influence-campaigns-3rd-9th-august-2026-report
Middle East Organizations: Iran-Linked MOIS Wiper Campaign: https://wasteland.me/intel/iran-linked-middle-east-wiper-attack

AI Integration

AI Cybersecurity Statistics 2026: Offense Is Winning — And …

Artificial Intelligence is rapidly becoming the defining force in cybersecurity, a shift recognized by 94% of security leaders according to the WEF Global Cybersecurity Outlook 2026. Critically, the Axis Intelligence ADSI shows that AI-powered offense is currently outpacing AI-powered defense across four of the six critical attack surfaces. The rise of “agentic AI”—autonomous agents capable of executing complex tasks—is accelerating this offensive advantage. This trend is particularly pronounced with confirmed attacks involving agentic AI. The integration of these autonomous systems allows attackers to operate at speeds and scales that human defenders struggle to match. This arms race is forcing organizations to rethink their entire security posture, moving from reactive defense to proactive, AI-enhanced hunting. Sources:
AI Cybersecurity Statistics 2026: Offense Is Winning — And …: https://axis-intelligence.com/ai-cybersecurity-statistics/
AI Cybersecurity Arms Race 2026: Defense vs. Offense: https://aibradaa.com/blog/ai-cybersecurity-arms-race-2026
AI in Cybersecurity 2026: How Artificial Intelligence Is …: https://zeqty.com/ai-cybersecurity-2026-offense-defense-transformation/
Agentic AI: The New Frontier of Cyberattacks in… – AI Dominance SG: https://dominance.sg/posts/agentic-ai-cyberattacks-asia-2026.html

AI Policy and Posture Adaptation

AI Governance and Regulation 2026: A Complete Guide to Global …

The global regulatory environment is rapidly maturing to keep pace with AI-driven threats, highlighted by the full implementation of the EU AI Act in August 2026. This act establishes strict rules for AI systems, particularly those deemed “high-risk.” Beyond Europe, Singapore is leading in agentic AI governance, while the U.S. continues to standardize through the NIST AI Risk Management Framework (AI RMF). For enterprises, this means a massive compliance roadmap. Organizations must now map their AI use cases against these evolving frameworks, ensuring transparency and accountability across all deployed models. This effort is critical for maintaining operational posture in a fragmented, yet rapidly standardizing, regulatory world. Sources:
AI Governance and Regulation 2026: A Complete Guide to Global …: https://www.hungyichen.com/en/insights/ai-governance-regulatory-landscape-2026
NIST AI Risk Management Framework: Implementation Guide (2026): https://aisecurityandsafety.org/en/guides/nist-ai-rmf-guide/
AI Security Standards: Key Frameworks for 2026 – SentinelOne: https://www.sentinelone.com/cybersecurity-101/data-and-ai/ai-security-standards/
EU AI Act 2026 Guide: Enterprise Compliance Roadmap | Etheon …: https://www.etheon.com/index/eu-ai-act-2026-guide-what-enterprise-teams-need-to-prepare-for

Zero-Day Exploits/CVEs

August 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

The August 2026 Patch Tuesday was particularly significant, featuring the patching of 421 CVEs, including several critical vulnerabilities. The standout is CVE-2026-62893, a Critical Remote Code Execution (RCE) flaw with a CVSS score of 9.8. This vulnerability affects Windows Deployment Services and was identified as a use-after-free flaw, meaning an attacker can exploit a memory management error via a specially crafted network packet. This critical flaw was actively exploited in the wild, prompting CISA to issue an emergency alert. Additionally, the patch cycle included CVE-2026-62836, an elevation of privilege vulnerability affecting Azure SQL Managed Instance (a cloud database service), which carries a high CVSS score of 8.7. Sources:
August 2026 Patch Tuesday: Updates and Analysis | CrowdStrike: https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-august-2026/
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day: https://www.securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/
Windows Zero-Day Hits Patch Tuesday: 421 CVEs Fixed [2026]: https://tech-insider.org/windows-zero-day-patch-tuesday-421-cves-2026/
CVE-2026-62836 in Azure SQL MI: https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-august-2026/

Incident Reports

OpenAI releases its official report on the Hugging Face breach

OpenAI has released a comprehensive report detailing a major breach involving Hugging Face, an incident that revealed a rare and unexpected confluence of security failures. The report, released on August 26, 2026, frames the breach not as a single failure but as a complex event chain. The incident reflects a failure in the security controls that allowed the compromise to occur, despite the platform’s overall robust infrastructure. The breach involved the theft of significant data and underscores the risks associated with relying on third-party platforms. The official report provides deep insight into the attack vectors, suggesting that misaligned security behaviors within the platform were the critical factor that allowed the attack to succeed and escalate. Sources:
OpenAI releases its official report on the Hugging Face breach: https://techcrunch.com/2026/08/26/openai-releases-its-official-report-on-the-hugging-face-breach/
ATF confirms “major incident” after recent Qilin breach claims: https://www.bleepingcomputer.com/news/security/atf-confirms-major-incident-after-recent-qilin-breach-claims/
Data Breach Tracker: Major Incidents 2026 (Updated in Real …: https://axis-intelligence.com/data-breach-tracker/
Information is Beautiful: https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

New Legislation

Global Data Privacy Laws in 2026: Mid-Year Update – Complete Discovery Source

In Asia, the regulatory landscape is being dramatically reshaped by the amended Cybersecurity Law of China (CSL), which came into effect on January 1, 2026. These amendments are significant because they substantially expand the penalties for non-compliance with the CSL. Crucially, they also grant the Chinese government increased power and authority to oversee and mandate compliance across various sectors. Globally, other regulations are also tightening. The CCPA in California has seen expansions, and new rules covering automated decision-making technology and mandatory cybersecurity audits have taken effect in 2026. This signals a global pivot toward holding organizations accountable for the *process* of data handling, not just the outcome. Sources:
Global Data Privacy Laws in 2026: Mid-Year Update – Complete Discovery Source: https://cdslegal.com/insights/global-data-privacy-laws-in-2026-mid-year-update/
Global Data Privacy Laws 2026: Cross-Jurisdiction Compliance Guide: https://www.kiteworks.com/regulatory-compliance/global-data-privacy-laws-2026/
Data Privacy Laws in 2026: Compliance Guide: https://www.tekclarion.com/blog/cyber-security/data-privacy-laws-2026/
UK-Hosted AI & GDPR: What to Get Right | The Digital Hub: https://thedigitalhub.uk/guides/uk-hosted-ai-gdpr