CLOSEDQUORUM is a Windows malware binary representing the first documented implant utilizing autonomous AI-driven command and control. Discovered through Cisco Talos' CAIRN project, it delegates tactical decisions to a panel of commercial large language models including DeepSeek, Qwen, Mistral, and Google Gemini. The system operates through plurality voting among AI models to select actions for credential harvesting and crypto wallet theft, eliminating the need for continuous human operator involvement. The 16.4MB Go-compiled executable employs structured JSON schema to constrain LLM responses to executable attack choices. While containing placeholder credentials in public distribution, development builds demonstrate compile-time injection of operator-specific API keys and Discord webhooks. This architecture represents a significant shift toward effort displacement in cyber operations, where entire attack phases execute autonomously without human bottlenecks, though introducing new dependencies on commerci...
Microsoft has issued a warning that the File History backup feature in Windows may stop functioning on some systems after applying the September 2026 security updates. This issue affects the reliability of the built-in backup mechanism but does not indicate a security vulnerability or exploit. No specific affected versions or patch information have been provided.
Microsoft announced that Windows 11 version 24H2 Home and Pro editions will reach end of support on October 13, 2026. After this date, these editions will no longer receive security or non-security updates, including protections against the latest security threats. Customers are advised to upgrade to Windows 11 version 25H2 to continue receiving updates. Enterprise and Education editions of Windows 11 24H2 remain supported until October 2027. Systems not managed by IT will automatically upgrade to 25H2, with user control over restart timing.
Microsoft has acknowledged a known issue affecting Windows 11 users who are unable to log in with valid domain credentials after installing the September 2026 security updates. A temporary workaround has been shared by Microsoft to address this login problem.
The Windows 11 KB5124008 update has been reported to break domain trust relationships on some enterprise systems, causing login failures for users with valid domain credentials. Microsoft is currently investigating these issues.
Iranian state-linked hackers are deploying a Windows malware strain named CHOSEN BRICK to conduct espionage on dissidents, activists, and journalists globally. The malware is used to spy on targeted individuals, indicating a focus on surveillance rather than widespread disruption or destruction.
AI advancements are accelerating the discovery of vulnerabilities, leaving many operational technology (OT) systems unpatchable and at risk. These OT systems often run on legacy or bespoke software that cannot be easily updated or patched. Ignoring these vulnerabilities is not a viable defense. Instead, network-based protections such as micro-segmentation, next-generation firewalls (NGFW), and intrusion prevention systems (IPS) can provide compensatory controls by filtering and blocking exploit attempts. The concept of air-gapping is often ineffective in practice due to operational shortcuts. While patching remains the best defense, these layered network protections help mitigate risks where patching is impossible.
Microsoft announced that Windows Server 2022 will reach the end of mainstream support on October 13, 2026, transitioning to extended support until October 14, 2031. During extended support, security updates will continue to be provided at no additional cost. Hotpatching support for the Datacenter: Azure Edition will continue until October 2027. Microsoft recommends upgrading to Windows Server 2025 before the end of extended support to maintain full mainstream support and security updates.
A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]
A threat actor compromised the official HBO Max Reddit account and used it to run a malvertising campaign that directed macOS and Windows users to a fake HBO Max site. The site prompted users to execute commands that installed malware designed to steal credentials, messages, browser data, and cryptocurrency wallet information, and maintain persistence. The campaign, active for 48 hours, used multiple malware families including MacSync, AMOS Helper, Amatera Stealer, AnimateClipper, and ZigClipper. Clipboard stealers replaced cryptocurrency addresses to divert transactions. Reddit suspended the malicious ads after notification.
A buffer overflow vulnerability exists in the MINAS A5/A6 USB device drivers for Windows provided by Panasonic Industry Co., Ltd. This vulnerability could potentially allow an attacker to cause unexpected behavior or execute arbitrary code via the affected drivers.
Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month's security updates, along with Hyper-V and USB audio problems on some Windows versions. [...]
Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. [...]
Critical10.0KEVEPSS 98%Check Point ResearchCVE-2026-72898
The threat intelligence report from September 14, 2026, details multiple cyber incidents including data breaches, vulnerabilities, and AI-related threats. Notably, a data breach at Mathspace was caused by exploitation of CVE-2026-72898, a SQL injection vulnerability in the self-hosted Metabase tool, exposing user names, emails, usernames, and locations. Other significant vulnerabilities include Microsoft’s Patch Tuesday addressing 974 flaws including privilege escalation zero-days, and GitLab’s critical path traversal vulnerability CVE-2026-85706 allowing unauthenticated arbitrary file reads. MikroTik RouterOS vulnerabilities enabling passwordless SSH and privilege escalation were also fixed. The report includes AI threats involving prompt evasion and sandbox escapes. Check Point IPS provides protections for several mentioned vulnerabilities. The report does not specify affected versions for CVE-2026-72898. No CVSS score is provided for this vulnerability.
A critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows has been exploited by the Chinese threat group UNC3569 to achieve system-level code execution via a crafted URL. The flaw involves unvalidated command-line argument injection, unrestricted URL navigation, and an outdated Chromium browser engine with disabled sandboxing. The exploit enables deployment of the GrayRabbit backdoor, which provides extensive remote control capabilities. Tencent released a patch in version 16.3.0.3498 that addresses the URL parameter validation but did not update the underlying Chromium configuration. The vulnerability has been actively exploited in the wild.
Microsoft has confirmed that USB audio devices may fail on some Windows systems after installing the KB5124008and KB5124012 September 2026 security updates. [...]
A critical remote code execution vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows is actively exploited by the UNC3569 threat group to deploy the GrayRabbit backdoor malware. The attack chain abuses a custom URI handler, an unrestricted URL navigation in an embedded Chromium webview, and a known flaw in an outdated Chromium 80 engine running without sandboxing. Tencent released a patch in version 16.3.0.3498 that validates URL arguments and restricts navigation to approved domains, but the underlying Chromium engine remains outdated and unsandboxed.
The BlueMoon exploit kit chains together three zero-day vulnerabilities—two in Chrome's V8 engine and one in Windows ALPC—to achieve sandbox escape and privilege escalation. Initially used by the China-linked APT Violet Typhoon, it has rapidly proliferated among multiple espionage-motivated threat actors targeting NGOs, aerospace, manufacturing, government, consulting, and financial sectors across the US and Southeast Asia. The vulnerabilities in Chrome were patched on September 3 and 8, 2026, and the Windows privilege escalation was fixed in the September 2026 Patch Tuesday update. BlueMoon's rapid adoption and sharing among threat actors may reflect lowered barriers to exploit development, potentially aided by AI. The exploit kit downloads and executes payloads after successful exploitation.
Microsoft addressed a bug that caused Microsoft Teams and Outlook to fail launching on ARM-based Windows devices following updates released since the August 2026 Patch Tuesday. This issue affected users on ARM Windows PCs, preventing normal operation of these applications.