The Human Take

Zero-Days Everywhere — What a Record Patch Tuesday and an Alleged FBI Hack Teach Us About Unknown Flaws

A zero-day is a flaw attackers exploit before a fix exists. This month delivered two very different zero-day stories. One ended with a patch. The other is still unfolding.

Story one: Microsoft’s biggest Patch Tuesday ever

On September 8, Microsoft shipped its largest Patch Tuesday on record. Counts vary by how you tally, but Tenable puts customer-actionable fixes at 964 CVEs, with 104 rated critical. That’s roughly 70% above the previous record, set just this July.

Two of those flaws were already being exploited in the wild:

• CVE-2026-85880, a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC)
• CVE-2026-81963, a “link following” flaw in the Windows Update Stack, the component that installs updates

Both score 7.8 on CVSS. Both let an attacker who already has a foothold jump to SYSTEM, the highest privilege on a Windows machine.

The Common Vulnerability Scoring System (CVSS) is an open industry standard used to measure the severity of software security vulnerabilities. It assigns a numerical score from 0.0 to 10.0 to help security teams understand how critical a bug is and prioritize patching. A flaw that can be exploited remotely over the internet with no authentication and causes full system takeover receives a 10.0. Conversely, a flaw that requires local physical access, elevated privileges, and user interaction receives a much lower score

That’s the key point. Neither bug gets an attacker in the door. They turn a small intrusion, like one phished laptop, into full control. Microsoft hasn’t said who used them or how widely.

Now story two: ShinyHunters says it hacked the FBI

On September 22, the FBI’s jobs portal was defaced with a message claiming it had been seized by ShinyHunters, a well-known extortion group. The site then went offline “for maintenance.”

The group’s claims, as told to BleepingComputer and other outlets:

• It found and used a new zero-day in Oracle PeopleSoft, HR software widely used for recruiting and payroll.
• It moved from there into FBI-managed AWS GovCloud systems.
• It took 2–3 TB of data on current and former employees and job applicants.

On motive, the group says this was retaliation for a May 2026 FBI FLASH report about it, not a money play.

What we know so far: the FBI says it is investigating unauthorized activity on its jobs site. It has not confirmed that internal systems were breached or data stolen. Notably, that same FBI report warned that ShinyHunters tends to exaggerate its access. Treat this as a serious claim, not an established fact.

Even so, the pattern is credible. Oracle issued an emergency alert in June for a different PeopleSoft flaw (CVE-2026-35273) that the group had already exploited against education institutions.

The common theme?

One story is about the attacker’s first step: an unknown flaw in internet-facing software. The other is about the next step: privilege escalation once inside. Real intrusions chain both. The initial access bugs and the local privilege escalation bugs perform different functions in the kill chain. Initial access breach perimeter defenses, while local privilege escalation turns standard access into administrative control.

That’s why “we’ll patch when there’s a fix” isn’t enough. By the time a zero-day has a CVE number, someone has usually already used it.

What to do this week

• Patch the two Windows zero-days first, then the critical remote code execution bugs. With nearly 1,000 fixes, prioritization matters more than speed on everything.
• Run PeopleSoft or other HR systems? Limit what’s exposed to the internet, watch for unusual activity, and check Oracle’s advisories closely.
• Assume a foothold. Detect privilege escalation and lateral movement, especially into cloud environments.
• Recruiting portals hold sensitive data. Applicant records are a target in their own right. Protect them like payroll data.

Weekly Cyber News Summary September 25, 2026

This week in cyber:

• ENISA report details persistent Russian and Chinese state-nexus intrusions.
• Russian and Chinese threat groups target European and regional sectors.
• Palo Alto Networks launches AI-driven continuous offensive testing service.
• Anthropic CEO advocates safety pacing guidelines for frontier AI models.
• Microsoft fixes two exploited zero-days in Patch Tuesday release.
• ShinyHunters claims breach of FBI database via PeopleSoft exploit.
• EU Cyber Resilience Act mandatory reporting rules enter into force.
• Senator Markey introduces bill establishing AI cyber investigation board.

State-Sponsored Attacks

ENISA Highlights European Surge in State-Sponsored Attacks

The European Union Agency for Cybersecurity (ENISA) released its comprehensive Threat Landscape report assessing state-sponsored activity impacting EU member states. Russian state-nexus threat actors accounted for nearly half of all identified nation-state cyber activity, predominantly focusing on diplomatic institutions, central governments, and public infrastructure across Eastern Europe. Concurrently, China-nexus groups maintained persistent cyberespionage intrusions aimed at transport and logistical networks across the continent.

The findings emphasize that nation-states rely heavily on unauthorized access, credentials theft, and initial access acquired through vulnerability exploitation. Furthermore, state actors are increasingly leveraging hybrid operations—combining traditional intrusion operations with foreign information manipulation, denial-of-service barrages, and critical infrastructure probes—to test defensive capabilities and exploit geopolitical volatility.
Sources:
Industrial Cyber: https://industrialcyber.co/reports/enisa-threat-landscape-2026-highlights-ransomware-vulnerability-exploitation-ai-enabled-attacks-across-eu-organizations/
Cybersecurity Dive: https://www.cybersecuritydive.com/news/state-infrastructure-resources-cyberthreats/830178/

Regional Campaigns

Russian Hybrid Operations Target Northern European Infrastructure

A coordinated sequence of cyber and physical operations targeting Northern European nations, including Sweden, Finland, Denmark, and Estonia, has intensified throughout September 2026. Threat intelligence disclosures confirm that state-aligned groups executed distributed denial-of-service (DDoS) campaigns against public services alongside reported physical disruptions to undersea telemetry cables. The aggressive campaigns highlight a shift toward multi-domain pressure against regional trade and government assets.

In addition to direct network disruptions, threat intelligence reports revealed the deployment of autonomous tooling and multi-platform media manipulation designed to destabilize public sentiment and disrupt local communications. Security analysts emphasize that regional defenses are being continuously tested by automated attack vectors, requiring closer operational alignment between regional CERTs and infrastructure operators.
Sources:
Cyfluence Research: https://www.cyfluence-research.org/post/cyber-based-influence-campaigns-7th-13th-september-2026-report
Infosecurity Magazine: https://www.infosecurity-magazine.com/news/ransomware-attacks-reach-record/

AI Integration

Palo Alto Networks Unveils Agentic AI Security Operations Platform

Palo Alto Networks announced the release of Unit 42 Continuous Frontier AI Defense, an offensive security service leveraging agentic frontier AI models to perform continuous vulnerability discovery and attack path analysis. Built on specialized models from Anthropic and OpenAI, the framework executes automated adversary simulations across cloud environments, source code, and network endpoints to discover exposures before threat actors exploit them.

The service is designed to match the accelerated speed of AI-driven attacks, which have reportedly compressed enterprise breach timelines from weeks down to hours. By combining continuous machine scanning with human verification from offensive experts, the system validates exploitability, generates virtual patches, and integrates directly into enterprise remediation platforms.
Sources:
Unite.AI: https://www.unite.ai/unit-42-unveils-subscription-for-continuous-ai-powered-offensive-security/
CISA Advisories: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a

AI Policy and Posture Adaptation

Industry Leaders Propose AI Pacing Frameworks to Align Defense and Safety

In a major policy movement across the artificial intelligence and cybersecurity sectors, industry leaders have published formal frameworks advocating for voluntary AI safety pacing agreements. The strategy outlines structured protocols allowing frontier model developers to deliberate on safety thresholds and threat capabilities without breaching federal antitrust constraints.

The proposed frameworks recommend utilizing independent third-party evaluators, establishing clear antitrust firewalls between commercial operations and safety research, and securing government oversight from regulatory agencies. This posture adjustment comes amid mounting pressure on organizations to ensure defensive security mechanisms and alignment protocols evolve in tandem with high-capability agentic models.
Sources:
Holland & Knight: https://www.hklaw.com/en/insights/publications/2026/09/ai-pacing-agreements-legal-issues-and-how-to-attempt-to-manage-them
Davis Wright Tremaine: https://www.dwt.com/blogs/privacy–security-law-blog/2026/09/trust-issues-september-2026

Zero-Day Exploits/CVEs

Microsoft Addresses Active Zero-Days in Record September Update

Microsoft released its September Patch Tuesday security updates addressing 974 CVEs across its software ecosystem, highlighting two privilege escalation zero-day vulnerabilities actively exploited in the wild. The first zero-day, tracked as CVE-2026-85880, is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component that enables a local attacker to break out of low-privilege sandboxes to reach full SYSTEM privileges.

The second actively exploited flaw, CVE-2026-81963, impacts the Windows Update Stack through an improper link resolution vulnerability. Local attackers with minimal privileges can manipulate link resolutions to elevate access without requiring any user interaction. Microsoft urged administrators to prioritize these updates alongside critical remote code execution fixes affecting Netlogon and DNS Server.
Sources:
CrowdStrike Blog: https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/
SecurityWeek: https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/

Incident Reports

ShinyHunters Claims Compromise of FBI Systems via Enterprise Zero-Day

The cybercrime syndicate known as ShinyHunters claimed responsibility for breaching systems associated with the U.S. Federal Bureau of Investigation, claiming to have exfiltrated sensitive data concerning current employees and job applicants. The extortion group posted proof of access on their dark web portal after temporarily defacing an applicant portal managed by the agency.

According to statements attributed to the group, the entry vector involved exploiting an unpatched zero-day vulnerability within an enterprise PeopleSoft deployment. Federal law enforcement acknowledged awareness of the claims regarding unauthorized activity on the application site and confirmed an active investigation into the scope and validity of the incident.
Sources:
The Hacker News: https://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.html
SecurityWeek: https://www.securityweek.com/astrana-health-data-breach-impacts-private-confidential-information/

Framework Changes

EU Cyber Resilience Act Mandatory Vulnerability Reporting Goes Live

Key reporting obligations under Article 14 of the European Union Cyber Resilience Act (CRA) officially took effect, establishing strict mandatory incident notification timelines for manufacturers of digital hardware and software products. Under the new mandate, organizations must report actively exploited vulnerabilities or severe security incidents within a tight 24-hour window from initial detection.

The framework mandates a three-tiered reporting process via a centralized EU platform managed by ENISA, requiring an initial alert within 24 hours, an expanded notification within 72 hours, and a final technical mitigation summary. The regulation significantly shifts global supply chain standards, compelling manufacturers selling into the EU market to modernize their vulnerability handling and patch distribution workflows.
Sources:
Inmove IT: https://www.inmoveit.com/en/cyber-resilience-act-in-2026-what-changes-from-september-and-what-businesses-should-review/
Kirkland & Ellis: https://www.kirkland.com/publications/kirkland-alert/2026/09/the-eu-cyber-resilience-act

New Legislation

U.S. Senate Introduces Bill to Create AI Cyber Incident Investigation Board

U.S. Senator Edward J. Markey introduced the Cybersecurity and AI Board of Investigations Act, aiming to establish an independent oversight body to investigate major cyberattacks assisted by artificial intelligence. Modeled after the National Transportation Safety Board (NTSB), the proposed board would be granted subpoena authority to compel testimony and document disclosures from public and private entities during post-incident inquiries.

The legislative initiative stems from growing concerns surrounding agentic AI models being deployed to conduct automated network exploitation and data exfiltration. If enacted, the board will be tasked with conducting forensic evaluations of complex AI-assisted security breaches, publishing public reports, and issuing binding security recommendations across federal infrastructure and key commercial sectors.
Sources:
U.S. Senate Press Release: https://www.markey.senate.gov/news/press-releases/as-ai-agents-carry-out-attacks-senator-markey-introduces-legislation-establishing-independent-body-to-investigate-cyber-hacks-assisted-by-artificial-intelligence
DLA Piper Privacy Matters: https://privacymatters.dlapiper.com/2026/04/comprehensive-federal-privacy-legislation-introduced/