BigCommerce suffered a supply chain attack through a compromised application key belonging to the third-party app Ribon. Attackers used the stolen key to access customer data, including names, emails, phone numbers, and addresses, between September 13 and 17, 2026. The compromised key was revoked on September 17, and affected merchants were notified starting September 18. The incident was due to a compromise of the third-party app's credentials, not a breach of BigCommerce's own systems. BigCommerce uninstalled the Ribon app from affected stores to prevent further access.
Shadow IT refers to hardware, software, and services operating outside the visibility or approval of IT and security teams, creating security blind spots. Wazuh is an open source security platform that helps organizations reduce these visibility gaps by collecting detailed inventory data from monitored endpoints and correlating it with vulnerability and policy information. It supports agent-based and agentless monitoring, including for devices that cannot run agents. Wazuh provides centralized dashboards for visibility into unmanaged endpoints, unauthorized software, browser extensions, and services. It also enables detection and removal of unauthorized applications through custom rules and active response scripts. This approach addresses the limitations of network discovery scans, which only identify devices responding during scan windows, leaving many assets invisible. Overall, Wazuh helps organizations improve asset visibility and reduce risks associated with shadow IT.
The EvilTokens platform, responsible for compromising over 12,000 Microsoft accounts across more than 10,000 organizations, has been disrupted through an operation led by Microsoft's Digital Crimes Unit. This disruption aims to halt the platform's malicious activities targeting Microsoft accounts.
Cyera, a data security company specializing in data security posture management, data loss prevention, and identity access governance, has raised $400 million in funding, reaching a valuation of over $12 billion. The company provides an agentless, API-driven platform that offers real-time visibility and governance over sensitive data across hybrid cloud, SaaS, database, and on-premises environments. Cyera's platform also includes guardrails for AI operations, monitoring data inputs to large language models and mitigating exfiltration risks. This news is a funding announcement and does not describe a security vulnerability or threat.
A security researcher known as Nightmare Eclipse, revealed to be Abdelhamid Naceri, a former Microsoft Germany employee, has released a new proof-of-concept exploit called BigDiskBuster targeting Microsoft Defender. The exploit prevents Windows Defender from completing platform and signature updates and reportedly works on all currently supported Windows versions. The code is still considered buggy and under development. Microsoft has not yet commented on this exploit. Naceri previously disclosed multiple Windows and Microsoft Defender exploits and has publicly shared details about his contentious departure from Microsoft.
A malicious NPM package named indexed-btree, impersonating the legitimate sorted-btree package, was discovered to contain hidden malware in its JavaScript prototype method. This supply chain attack accumulated over 2 million weekly downloads by creating a credible GitHub repository and avoiding typical detection methods. The malware collects system information, communicates with a hardcoded Slack channel and Telegram chat, and uses a blockchain smart contract for command-and-control. Multiple related malicious packages have also been identified and removed after millions of downloads. The campaign is ongoing and represents a sophisticated threat to organizations using the NPM ecosystem.
AI Governance Engineer is an open, versioned body of knowledge that maps AI governance frameworks such as the EU AI Act, ISO 42001, and NIST AI RMF to concrete artefacts satisfying each obligation. It provides a structured approach to AI governance engineering, emphasizing continuous, machine-readable evidence over point-in-time attestations. The resource includes chapters, a maturity model, reusable patterns, and data exports to support implementation and auditability of AI governance obligations.
A joint advisory from the US, Japan, Germany, and Australia details the North Korean WaterPlum campaign, which uses a hiring scheme to target software developers and IT professionals globally. WaterPlum impersonates legitimate companies and recruiting services to infect devices and steal cryptocurrency funds. Japan dismantled its first North Korean laptop farm used to remotely operate infected devices. The campaign has compromised over 30,000 devices in more than 100 countries, stealing funds from over 7,000 cryptocurrency wallets. The group is linked to North Korea's 313 General Bureau and uses sophisticated evasion techniques including AI face-swapping during interviews. The campaign poses risks beyond theft, including potential network infiltration and extortion.
This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Tuesday, September 22nd, 2026.' It provides general information and links related to the ISC podcast and classes but does not contain any specific security threat or vulnerability details.
The U.S. government has proposed a new AI incident alert system intended to enhance transparency and cooperation between the U.S. and China regarding AI-related incidents that could impact national security. This initiative aims to establish a notification mechanism to share information about AI risks and incidents, fostering a shared vision of common goals and threats between the two leading AI powers. The proposal is part of broader diplomatic talks and trade discussions between the U.S. and China. There are no specific technical vulnerabilities or exploits detailed in this information, and no affected software versions are identified.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of three Linux kernel vulnerabilities, including one rated critical. Specific technical details and affected versions have not been provided. No confirmed exploits in the wild are documented beyond this advisory.
A potential compromise of the OWASP API Security website (https://api-security.owasp.org/) has been reported via a Reddit post. The page currently displays a responsible disclosure notice from NOX Offensive Security indicating a vulnerability affecting the organization and requesting secure contact for further details. No sensitive technical details or exploit information are publicly disclosed at this time.
Microsoft announced the retirement of the Microsoft 365 companion apps—Calendar, People, and Files—effective December 16, 2026. These apps, integrated into the Windows 11 taskbar, were designed to streamline workflows by providing quick access to contacts, files, and calendar events. Microsoft began automatically installing these apps on Windows 11 enterprise devices in late 2025 but has now ceased their installation and urged administrators to remove them from managed devices. After the retirement date, the apps will no longer be supported or functional. Additionally, Microsoft reminded admins to migrate Entra ID users to phishing-resistant authentication methods to avoid sign-in disruptions starting February 2027. There are no indications of security vulnerabilities or exploits associated with this retirement.
Ireland's Data Protection Commission fined Google €403 million for multiple GDPR violations related to processing users' location data. The investigation focused on three Google features active from May 2018 through February 2020: Web and App Activity, Location History, and Location Accuracy. The DPC found that Google processed location data without meeting GDPR requirements, failed transparency obligations, and retained data longer than necessary. Google has since updated its policies and implemented improved data management controls. The DPC requires Google to comply within six months. No active exploit or vulnerability is reported.
Microsoft resolved a known issue affecting Excel users where copy-and-paste functionality was broken following the installation of the September 2026 security updates. This fix restores normal copy-and-paste operations for all affected Office users.
This content is an interview/profile piece about Noopur Davis, the Global CISO at Comcast, detailing her unconventional career path from software developer to cybersecurity leader. It highlights her leadership philosophy, career experiences, and views on the evolving role of CISOs. There is no indication of any security threat, vulnerability, or exploit discussed.
The FBI's CJIS Security Policy version 6.1 updates encryption requirements and vulnerability scanning frequency for agencies handling Criminal Justice Information (CJI). It raises encryption strength for data in transit and at rest to at least 256-bit and requires monthly vulnerability scans instead of quarterly. While audit requirements are phased, agencies should prepare for more continuous assessments and stricter compliance verification, especially around password and multi-factor authentication (MFA) controls. The policy emphasizes stronger identity verification and device assurance but is not a Zero Trust standard. Agencies are encouraged to review and enhance password policies and MFA coverage to meet the updated requirements.
Accenture has completed a majority stake acquisition in Dragos as part of a $4.1 billion investment in operational technology (OT) cybersecurity. Following this, Dragos finalized its acquisitions of NetRise and runZero, expanding its platform capabilities to include firmware-level device exposure insight, software supply chain visibility, asset discovery, exposure assessment, and attack surface intelligence. These acquisitions aim to enhance defense across extended OT environments in critical infrastructure sectors. No vulnerabilities or exploits are reported in this transaction.
Microsoft has issued a reminder for administrators to migrate Entra ID users to phishing-resistant authentication methods, such as passkeys, ahead of the planned retirement of SMS-based first-factor sign-in in February 2027. This change aims to improve security by reducing reliance on less secure SMS authentication.
Rust-lang team members and popular crate owners have been targeted in a social engineering campaign involving video calls. Attackers impersonate recruiters or contractors to trick targets into installing malicious software or executing harmful code. This campaign is linked to previous incidents involving compromised Rust crates and is suspected to be associated with North Korean threat actors. Developers are advised to be cautious with unsolicited contacts, use trusted communication platforms, enable multi-factor authentication, and monitor accounts for suspicious activity.