This concise portal edition highlights the morning exploitation delta. GavinLujan.com maintains the authoritative full brief, provenance record, archive and AI/HPC analysis. STIX 2.1 and TAXII 2.1 are standards/transport; MISP and OpenCTI are aggregation and correlation platforms, not original evidence.
Published: 12 Sep 2026, 6:00 AM MDT Status: CISA KEV / fixes available · Confidence: High
CISA added CVE-2026-42016 and CVE-2026-42018 on September 11. JFrog documents token-scope privilege escalation and anonymous-token exposure. Ransomware use is unknown. ATT&CK: T1190, T1078, T1068.
Proposed guidance—requires environment-specific validation: Patch affected Artifactory releases, restrict exposure, review privileged and anonymous tokens, audit repository writes and package promotion, rotate exposed credentials and verify artifact provenance.
Published: 12 Sep 2026, 6:00 AM MDT Status: CISA KEV / 26.6.5 available · Confidence: High
CVE-2026-84869 can permit transfer and execution through an active remote session without authorization or host confirmation in certain circumstances. ConnectWise says servers are not affected. Ransomware use is unknown. ATT&CK: T1219, T1105.
Proposed guidance—requires environment-specific validation: Upgrade to 26.6.5, refresh clients and agents, temporarily remove TransferFiles permission if patching is delayed, review sessions and technicians, enforce MFA and investigate suspicious execution.
Anthropic reported disrupting Russian and Chinese campaigns targeting Claude and alleged model extraction. Independent incident telemetry is limited. ATT&CK: T1588.006, T1059.
Proposed guidance—requires environment-specific validation: Enforce model/API least privilege, rate limits, behavioral monitoring, human approval for consequential actions, and token rotation.
Greenberg Traurig said limited data was posted to the dark web amid mounting attacks. Actor and complete scope remain unresolved; no unsupported attribution is made.
Proposed guidance—requires environment-specific validation: Isolate affected systems, preserve evidence, rotate credentials, assess client-notification duties, monitor misuse, and test clean restoration.
Confirmed reporting: Reuters reports the UAE is considering distributing its planned 5-GW AI campus and adding hardened construction, backup power and cooling. G42 says work is progressing and details remain under review. Assessment: this is planned—not commissioned, independently benchmarked or TOP500-verified—capacity.
ATT&CK: No direct enterprise-technique mapping is assigned to physical attack risk; cyber compromise of BMS/OT requires separate evidence.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Model geographic concentration, substations, carrier routes, cooling, fuel and BMS/OT dependencies together; require commissioning evidence and tested failover before counting capacity as operational.
SEV 4 GUARDED · GREENCONFIDENCE · HIGH ON PUBLIC EVENT / MEDIUM ON OUTLOOKSTATUS · CONFIRMED IPO / FORWARD-LOOKING CAPACITY
Confirmed: Reuters reported Tencent-backed Enflame’s Shanghai market debut and planned investment in next-generation AI chips and computing systems. Assessment: financing is not evidence of delivered accelerators, secure firmware, benchmark performance or operating cluster capacity.
ATT&CK: No incident-specific mapping. T1195 is a governance scenario only.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Require secure-boot and signing evidence, disclosure and patch SLAs, component provenance, lifecycle support and reproducible workload tests. Keep investment separate from installed capacity.
Semi-autonomous operation harvests and re-serves poorly secured LLM access.
SEV 2 HIGH · ORANGECONFIDENCE · HIGH ON HONEYPOT TELEMETRY / MEDIUM ON SCOPESTATUS · OBSERVED / ACTOR AND PREVALENCE UNCONFIRMED
Confirmed: SANS ISC observed a semi-autonomous coding agent harvesting weakly protected LLM-gateway access, validating inference capacity and consolidating it behind another API. This public edition excludes captured secrets and offensive details. Assessment: the pattern is evidenced; a named actor and broad prevalence are not.
ATT&CK: T1190, T1078, T1552 and T1583.006; analyst mappings.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Disable open enrollment and defaults; enforce server-side authorization and least privilege; cap trial spend and request rates; rotate exposed keys; require phishing-resistant admin MFA; log account, token, model-call and routing activity; alert on rapid validation and cross-account aggregation.
GitLab CVE-2026-85706 reaches its CISA KEV deadline.
SEV 1 CRITICAL · REDCONFIDENCE · HIGHSTATUS · KEV / ACTIVE EXPLOITATION / TRIAGE REQUIRED
Confirmed: CISA lists the unauthenticated GitLab CE/EE repository-commits API path-traversal flaw in KEV, added September 11 and due September 14. Ransomware use is unknown. GitLab fixed it in 19.1.8, 19.2.6 and 19.3.2. Assessment: exposed files can compromise repository, pipeline and compute-control-plane trust.
ATT&CK: T1190, T1552 and T1555; T1195 is a downstream risk scenario, not confirmed behavior.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Remove vulnerable instances from public exposure; upgrade immediately; preserve and review API/audit/runner logs; follow CISA forensic triage; rotate potentially exposed deploy tokens, CI/CD variables, SSH keys and cloud credentials; validate runners, pipelines and artifacts before restoring trust.