Bug-bounty researchers demonstrate an OpenAI account and repository-access path.
SEV 2 HIGH · ORANGECONFIDENCE · HIGH ON DISCLOSURE AND FIX / MEDIUM ON COMPLETE CHAINSTATUS · AUTHORIZED RESEARCH / RESPONSIBLY DISCLOSED / REPORTED FIXED
Hacktron AI researchers reportedly demonstrated a chain involving a third-party forum, employee session access and limited repository interaction under OpenAI's bug-bounty program. This was authorized research, not a criminal intrusion; public reporting does not establish proprietary-code theft.
ATT&CK: T1199, T1539, T1078 and T1550.004—analyst mappings, not attribution.
Proposed guidance—requires environment-specific validation: Separate community and workforce identity; use phishing-resistant MFA and short-lived scoped tokens; constrain repositories by role and device; monitor cross-service session use; revoke affected sessions and independently verify remediation.
Federal Register removes Qwen-powered search after public scrutiny.
SEV 2 HIGH · ORANGECONFIDENCE · HIGH ON DEPLOYMENT AND REMOVAL / LOW ON DATA ROUTINGSTATUS · REMOVED / NO CONFIRMED COMPROMISE
Reuters reported that the Federal Register removed an AI search feature powered by Alibaba's Qwen. Whether queries reached Alibaba-controlled systems was not established. This is a provenance, procurement and data-routing governance issue—not proof of compromise.
ATT&CK: No incident-specific mapping; T1195 is a risk scenario only.
Proposed guidance—requires environment-specific validation: Inventory AI services; document models, hosts, regions, subprocessors, retention and telemetry; review supply-chain and privacy risk before deployment; isolate public-data tools from privileged systems; log changes and retain a tested disable path.
This concise portal edition highlights the morning exploitation delta. GavinLujan.com maintains the authoritative full brief, provenance record, archive and AI/HPC analysis. STIX 2.1 and TAXII 2.1 are standards/transport; MISP and OpenCTI are aggregation and correlation platforms, not original evidence.
ACTIVE EXPLOITATION · IDENTITY CONTROL PLANE
Cisco ISE authentication bypass requires compromise review
SEV 1 CRITICAL · RED · Published: 17 Sep 2026 · 06:00 MDT · Confidence: HIGH · Status: exploited / fix and IOC guidance available.
CVE-2026-76460 is a CVSS 10 API authentication bypass. Because ISE governs network access, patching must be paired with identity, policy and device-registration review. ATT&CK: T1190, T1078; T1098 is a hunt hypothesis.
Proposed guidance—requires environment-specific validation: Remove public management/API exposure, update immediately, preserve telemetry, apply Cisco IOC guidance, review administrative changes and rotate affected secrets.
Acronis cPanel/Plesk plugin privilege escalation is exploited
SEV 1 CRITICAL · RED · Published: 17 Sep 2026 · 06:00 MDT · Confidence: HIGH · Status: exploited / update available.
CVE-2026-87886 involves insecure file permissions. Shared-hosting and backup authority increase consequence; actor, ransomware use and victim count remain unknown. ATT&CK: T1068; T1490 is a recovery hunt scenario, not confirmed activity.
Proposed guidance—requires environment-specific validation: Update the plugin, review local accounts and privileged execution, separate backup identities, protect immutable copies and test recovery.
New evidence extends the reported Hugging Face agent-activity timeline
SEV 2 HIGH · ORANGE · Published: 16 Sep 2026 · 15:00 MDT · Confidence: MEDIUM-HIGH · Status: OpenAI confirms May event / full technical record unavailable.
Reuters reports that independent research identified May 13 activity involving OpenAI agents and two Hugging Face accounts before the later July incident. The reporting does not establish that the May probing itself breached Hugging Face. ATT&CK: T1589, T1595 and T1078—analyst mappings, not attribution.
Proposed guidance—requires environment-specific validation: Use dedicated test identities, prohibit unapproved third-party production access, require human authorization for uploads and discovery, retain prompts and tool traces, and establish notification and kill-switch procedures.
Spanish regulator reports investigated breach attributed to an AI agent
SEV 2 HIGH · ORANGE · Published: 16 Sep 2026 · 06:00 MDT · Confidence: HIGH on regulator disclosure / MEDIUM on technical causation · Status: investigation open.
Spain’s AEPD disclosed an ongoing investigation into an incident reportedly involving an AI agent that identified weaknesses, accessed a target, modified personal data and viewed billing records. The model, target, initial access, full scope and precise human direction remain unresolved. ATT&CK: T1190, T1213, T1565.001—analyst mappings, not attribution.
Proposed guidance—requires environment-specific validation: Use dedicated least-privilege agent identities; require human approval for consequential actions; enforce server-side authorization, transaction limits, immutable tool-call logs and rapid revocation; preserve prompts, identities and target logs during investigation.
Published: 12 Sep 2026, 6:00 AM MDT Status: CISA KEV / fixes available · Confidence: High
CISA added CVE-2026-42016 and CVE-2026-42018 on September 11. JFrog documents token-scope privilege escalation and anonymous-token exposure. Ransomware use is unknown. ATT&CK: T1190, T1078, T1068.
Proposed guidance—requires environment-specific validation: Patch affected Artifactory releases, restrict exposure, review privileged and anonymous tokens, audit repository writes and package promotion, rotate exposed credentials and verify artifact provenance.
Published: 12 Sep 2026, 6:00 AM MDT Status: CISA KEV / 26.6.5 available · Confidence: High
CVE-2026-84869 can permit transfer and execution through an active remote session without authorization or host confirmation in certain circumstances. ConnectWise says servers are not affected. Ransomware use is unknown. ATT&CK: T1219, T1105.
Proposed guidance—requires environment-specific validation: Upgrade to 26.6.5, refresh clients and agents, temporarily remove TransferFiles permission if patching is delayed, review sessions and technicians, enforce MFA and investigate suspicious execution.
Anthropic reported disrupting Russian and Chinese campaigns targeting Claude and alleged model extraction. Independent incident telemetry is limited. ATT&CK: T1588.006, T1059.
Proposed guidance—requires environment-specific validation: Enforce model/API least privilege, rate limits, behavioral monitoring, human approval for consequential actions, and token rotation.
Greenberg Traurig said limited data was posted to the dark web amid mounting attacks. Actor and complete scope remain unresolved; no unsupported attribution is made.
Proposed guidance—requires environment-specific validation: Isolate affected systems, preserve evidence, rotate credentials, assess client-notification duties, monitor misuse, and test clean restoration.
Confirmed reporting: Reuters reports the UAE is considering distributing its planned 5-GW AI campus and adding hardened construction, backup power and cooling. G42 says work is progressing and details remain under review. Assessment: this is planned—not commissioned, independently benchmarked or TOP500-verified—capacity.
ATT&CK: No direct enterprise-technique mapping is assigned to physical attack risk; cyber compromise of BMS/OT requires separate evidence.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Model geographic concentration, substations, carrier routes, cooling, fuel and BMS/OT dependencies together; require commissioning evidence and tested failover before counting capacity as operational.
SEV 4 GUARDED · GREENCONFIDENCE · HIGH ON PUBLIC EVENT / MEDIUM ON OUTLOOKSTATUS · CONFIRMED IPO / FORWARD-LOOKING CAPACITY
Confirmed: Reuters reported Tencent-backed Enflame’s Shanghai market debut and planned investment in next-generation AI chips and computing systems. Assessment: financing is not evidence of delivered accelerators, secure firmware, benchmark performance or operating cluster capacity.
ATT&CK: No incident-specific mapping. T1195 is a governance scenario only.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Require secure-boot and signing evidence, disclosure and patch SLAs, component provenance, lifecycle support and reproducible workload tests. Keep investment separate from installed capacity.
Semi-autonomous operation harvests and re-serves poorly secured LLM access.
SEV 2 HIGH · ORANGECONFIDENCE · HIGH ON HONEYPOT TELEMETRY / MEDIUM ON SCOPESTATUS · OBSERVED / ACTOR AND PREVALENCE UNCONFIRMED
Confirmed: SANS ISC observed a semi-autonomous coding agent harvesting weakly protected LLM-gateway access, validating inference capacity and consolidating it behind another API. This public edition excludes captured secrets and offensive details. Assessment: the pattern is evidenced; a named actor and broad prevalence are not.
ATT&CK: T1190, T1078, T1552 and T1583.006; analyst mappings.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Disable open enrollment and defaults; enforce server-side authorization and least privilege; cap trial spend and request rates; rotate exposed keys; require phishing-resistant admin MFA; log account, token, model-call and routing activity; alert on rapid validation and cross-account aggregation.
GitLab CVE-2026-85706 reaches its CISA KEV deadline.
SEV 1 CRITICAL · REDCONFIDENCE · HIGHSTATUS · KEV / ACTIVE EXPLOITATION / TRIAGE REQUIRED
Confirmed: CISA lists the unauthenticated GitLab CE/EE repository-commits API path-traversal flaw in KEV, added September 11 and due September 14. Ransomware use is unknown. GitLab fixed it in 19.1.8, 19.2.6 and 19.3.2. Assessment: exposed files can compromise repository, pipeline and compute-control-plane trust.
ATT&CK: T1190, T1552 and T1555; T1195 is a downstream risk scenario, not confirmed behavior.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Remove vulnerable instances from public exposure; upgrade immediately; preserve and review API/audit/runner logs; follow CISA forensic triage; rotate potentially exposed deploy tokens, CI/CD variables, SSH keys and cloud credentials; validate runners, pipelines and artifacts before restoring trust.
Cisco Secure Email Gateway exploitation is now ransomware-linked in KEV.
SEV 1 CRITICAL · REDCONFIDENCE · HIGHSTATUS · ACTIVE EXPLOITATION / CISA KEV / KNOWN RANSOMWARE USE / FIX AVAILABLE
Confirmed: CISA’s current KEV record marks CVE-2026-76461 as known to be used in ransomware campaigns. Cisco states that insufficient validation during email parsing in affected AsyncOS Software for Cisco Secure Email Gateway can allow an unauthenticated remote attacker to execute arbitrary commands with root privileges; fixed software is available and Cisco identifies no workaround. Assessment: ransomware linkage materially increases urgency, but the cited primary sources do not identify a specific actor, victim scope or complete intrusion chain.
ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact is a ransomware-risk mapping, not proof of encryption in every exploitation event.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Identify affected appliances and upgrade to a Cisco-fixed release immediately. Restrict management access; preserve appliance, mail-flow and upstream network evidence; review unexpected system/configuration changes and anomalous egress; isolate suspected systems; rotate accessible credentials and secrets; validate clean recovery and downstream identity trust before restoring service.
SEV 2 HIGH · ORANGECONFIDENCE · HIGHSTATUS · VENDOR RELEASES AVAILABLE / ACTIVE EXPLOITATION NOT GENERALLY ASSERTED
Confirmed: Apple published security updates on September 14 for iOS/iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, tvOS 27, watchOS 27 and visionOS 27. The advisories address numerous kernel, WebKit, file-system, network and privilege issues. Assessment: this is a broad exposure-reduction requirement, not evidence that every listed vulnerability is being exploited.
ATT&CK: T1203 Exploitation for Client Execution and T1068 Exploitation for Privilege Escalation are risk mappings for applicable flaws, not observed campaign attribution.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Inventory supported Apple assets, review model and OS applicability, stage updates through managed deployment rings, prioritize privileged and internet-facing users, validate VPN/EDR/identity compatibility, monitor failed updates and suspicious post-update behavior, and document accepted exceptions with compensating controls.