‼️ WARNING - New Cisco ISE flaw CVE-2026-76460 is under active exploitation.

The CVSS 10.0 auth bypass has no workaround, and successful exploitation may lead to root-level command execution.

Affected versions, fixes, and compromise checks: https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html

⚠️ Gyazo breach exposed 23.62 million user records and 490 million image metadata records.

The leaked data included IDs used to build Gyazo image links. Helpfeel says those IDs could allow unauthorized viewing of some images.

Read: https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html

🚨 A single unauthenticated DoH request can BIND’s named process under a specific connection-close condition.

ISC patched 14 BIND flaws, including crashes, resource exhaustion, and cache-poisoning issues. No active exploits are known.

Details: https://thehackernews.com/2026/09/bind-9-update-fixes-14-flaws-including.html

‼️ An OpenAI model found and used an exposed GitHub API key without authorization.

The key worked, but the requested data remained unavailable. The model then fabricated the data and attributed it to the requested source.

https://thehackernews.com/2026/09/openai-reveals-six-model-incidents.html

It’s one of 6 misalignment incidents OpenAI disclosed.

Attackers weaponize new vulnerabilities in ~5 days. The median org takes 43 days to patch known-exploited flaws.

Peer-reviewed AI agents exploited 87% of one-day vulnerabilities unaided.

The real test: provable coverage, independent validation, and safe-stop controls in production.

https://thehackernews.com/2026/09/cisos-expert-guide-to-agentic.html

🛑 China-aligned FamousSparrow has shifted to a previously unreported backdoor in attacks across Latin America.

SparroWocky can run commands, exfiltrate files, take screenshots, and load in-memory plugins, with government entities among the targets.

Read: https://thehackernews.com/2026/09/china-aligned-famoussparrow-deploys.html

Meet Georgetown's cybersecurity faculty on Sept 22 to learn more about the Cybersecurity Risk Management master's program.

Attend our virtual webinar on Sept 22.

Learn more → https://thn.news/risk-management-event

‼️ Critical Unbound DNSSEC validator flaw (CVE-2026-82717) could allow remote code execution.

An attacker who controls a malicious zone can trigger the heap overflow by querying a vulnerable resolver. 1.26.0 and earlier are affected.

Read details → https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html

⚡ Can you prove a CVE is exploitable without running the exploit?

This webinar shows how to map a vulnerability to the attack techniques it requires, then test whether your existing controls actually stop them.

Can’t join live? Sign up and get the recording: https://thehacker.news/ready-for-mythos-class-attacks

🚨 Iran-linked Handala Hack is tied to a Telegram-controlled backdoor that can steal passwords and messaging data.

HEAVYGRAM also executes commands, captures screenshots, and downloads additional malware.

See how Telegram becomes the control channel: https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html

‼️ ALERT - Critical Docker Sandboxes flaw lets malicious guest code escape the shared workspace and read or modify files across a macOS host.

CVE-2026-77179 crosses the virtio-fs boundary with the host account’s rights.

Read how the escape works → https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html

🔥 25 New CYBER stories in this week’s ThreatsDay Bulletin:

→ Exposed AI systems breached
→ Stealers hunt agent tokens + prompts
→ Agents rewrite their own models
→ Ransomware jumps on a fresh flaw
→ Telnet brute-force still works
→ RF attacks leak audio remotely
→ and more...

Check out the full list of threats here: https://thehackernews.com/2026/09/threatsday-self-rewriting-agents-800.html

‼️ NEW - Critical Check Point management flaw lets unauthenticated attackers run code as root.

The 9.8-rated bug (CVE-2026-91843) sits in the login path before authentication.

Affected versions and fix details: https://thehackernews.com/2026/09/critical-check-point-management-server.html