← Back to Threat Recap · This week · Monthly recap

September 2026 in security

Monthly recap · generated Thu, 01 Oct 2026 00:32:33 GMT

September 2026 in numbers: 1,614 security stories · 14,944 new CVEs (1,488 critical) · 43 added to CISA's exploited list · 880 ransomware claims

Top stories

1. Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation The Hacker News +14 sources · 27 Sep 2026
   Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that allow remote code execution have been exploited in the wild, Citrix confirmed on September 27. It released fixes for both, along with six…
2. Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks The Hacker News +5 sources · 28 Sep 2026
   Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers…
3. Cisco warns of new SD-WAN zero-day exploited in attacks BleepingComputer +3 sources · 30 Sep 2026
   Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. [...]
4. Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Huntress +3 sources · 28 Sep 2026
   Huntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.
5. Researchers used Claude to hack OpenAI Ars Technica +3 sources · 18 Sep 2026
   Researchers used Claude to reach an OpenAI employee account and sensitive GitHub data.
6. CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM Rapid7 +2 sources · 23 Sep 2026
   Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127 , a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS…
7. Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation Sophos News +2 sources · 15 Sep 2026
8. HACK TUESDAY WEEK 02 – 08 SEPTEMBER 2026 Hackmanac +2 sources · 08 Sep 2026
   HACK TUESDAY WEEK 02 - 08 SEPTEMBER 2026: 452 CYBERATTACKS ACROSS 69 COUNTRIES
9. Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution The Hacker News +1 source · 30 Sep 2026
   Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked…
10. Former US Air Force members sent to prison over BEC attacks BleepingComputer +1 source · 29 Sep 2026
    Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. [...]
11. Alleged ShinyHunters leader arrested in the Netherlands CyberScoop +1 source · 29 Sep 2026
    The arrest of a 24-year-old man in Amsterdam, which occurred a week before ShinyHunters hacked the FBI, marks a major turning point for law enforcement’s push to track down the group’s members.
12. FBI Hackers Say They Won’t Publish Massive Trove of FBI Employee Data 404 Media +1 source · 28 Sep 2026
    ShinyHunters, the group that stole data on “all FBI employees” including addresses and details on their spouses, told 404 Media on Monday “Since the very beginning we had made our decision that we would never publish…
13. The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches Qualys Threat Research +1 source · 28 Sep 2026
    A routine package install can open the door to a cloud breach. Learn how attackers exploit developer credentials. Discover practical steps to contain exposure and protect your cloud environment.
14. CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally The Hacker News +1 source · 28 Sep 2026
    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active…
15. ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft Google Threat Intelligence +1 source · 25 Sep 2026
    Introduction As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit , Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of…

Zero-days & actively exploited

• Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation The Hacker News +14 sources · 27 Sep 2026
• Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks The Hacker News +5 sources · 28 Sep 2026
• Cisco warns of new SD-WAN zero-day exploited in attacks BleepingComputer +3 sources · 30 Sep 2026
• CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM Rapid7 +2 sources · 23 Sep 2026
• Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation Sophos News +2 sources · 15 Sep 2026
• HACK TUESDAY WEEK 02 – 08 SEPTEMBER 2026 Hackmanac +2 sources · 08 Sep 2026
• Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution The Hacker News +1 source · 30 Sep 2026
• CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally The Hacker News +1 source · 28 Sep 2026
• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft Google Threat Intelligence +1 source · 25 Sep 2026
• CISA BOD 26-04 Timelines for Three Linux Kernel CVEs Qualys Threat Research +1 source · 23 Sep 2026

Biggest breaches

• 490 million records — Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records Infosecurity Magazine · 21 Sep 2026
• 3 million people — Three Million Affected in Pentagon Personnel Agency Data Breach Security Affairs · 29 Sep 2026
• The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches Qualys Threat Research · 28 Sep 2026
• DIVD says Zammad zero-days enabled AI-driven network breach BleepingComputer · 30 Sep 2026
• Hackers stole millions of US military personnel records during months-long data breach TechCrunch Security · 30 Sep 2026
• Opsec Fail Leaks a Rare Look Inside a Media-Buy-Powered Scam Operation Confiant · 30 Sep 2026
• AI Coding Agents Leak 13,000+ Internal Screenshots From 300+ Companies on GitHub Cybersecurity News · 30 Sep 2026
• Cybersecurity incident disrupts Slate Valley schools in Vermont DysruptionHub · 30 Sep 2026

Added to CISA KEV (43)

• CVE-2026-76504 CVSS 9.8 — Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability added 2026-09-30
• CVE-2026-86950 CVSS 8.8 — Apple Multiple Products: Apple Multiple Products Out-of-Bounds Write Vulnerability added 2026-09-29
• CVE-2026-88772 CVSS 8.1 — Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability added 2026-09-27
• CVE-2026-88771 CVSS 9.8 — Citrix NetScaler: Citrix NetScaler Improper Input Validation Vulnerability added 2026-09-27
• CVE-2026-67279 CVSS 6.9 — MikroTik RouterOS: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability added 2026-09-25
• CVE-2026-65660 CVSS 8.8 — Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability added 2026-09-25
• CVE-2026-87902 CVSS 8.1 — WordPress Core: WordPress Core Remote File Inclusion Vulnerability added 2026-09-25
• CVE-2026-5430 CVSS 10 — WSO2 Multiple Products: WSO2 Multiple Products Path Traversal Vulnerability added 2026-09-24
• CVE-2026-71362 CVSS 9.1 — Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability added 2026-09-24
• CVE-2026-93952 CVSS 10 — Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability added 2026-09-22
• CVE-2026-94127 CVSS 9.8 — F5 BIG-IP APM: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability added 2026-09-22
• CVE-2026-93616 CVSS 9.8 — Check Point Multiple Products: Check Point Multiple Products Path Traversal Vulnerability added 2026-09-22
• CVE-2026-85102 CVSS 9.8 — Check Point Multiple Products: Check Point Multiple Products Improper Certificate Validation Vulnerability added 2026-09-22
• CVE-2026-7273 CVSS 8.8 — Zyxel GS1900 Series Switches: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability added 2026-09-21
• CVE-2025-39964 CVSS 7.8 — Linux Kernel: Linux Kernel Race Condition Vulnerability added 2026-09-18
• CVE-2026-53266 CVSS 8.8 — Linux Kernel: Linux Kernel Out-of-Bounds Write Vulnerability added 2026-09-18
• CVE-2025-39682 CVSS 9.8 — Linux Kernel: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability added 2026-09-18
• CVE-2026-58704 CVSS 8.8 — Google Pixel: Google Pixel Improper Authorization Vulnerability added 2026-09-16
• CVE-2026-76460 CVSS 10 — Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability added 2026-09-16
• CVE-2026-87886 CVSS 7.8 — Acronis Backup: Acronis Backup Incorrect Default Permissions Vulnerability added 2026-09-16
• CVE-2026-76461 CVSS 9.8 — Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability added 2026-09-14
• CVE-2026-84869 CVSS 9.9 — ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability added 2026-09-11
• CVE-2026-42016 CVSS 8.1 — JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability added 2026-09-11
• CVE-2026-42018 CVSS 7.5 — JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability added 2026-09-11
• CVE-2026-85706 CVSS 10 — GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability added 2026-09-11
• CVE-2026-86060 CVSS 9.2 — MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability added 2026-09-10
• CVE-2026-67277 CVSS 8.8 — MikroTik RouterOS: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability added 2026-09-10
• CVE-2026-19490 CVSS 9.3 — Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability added 2026-09-09
• CVE-2025-25249 CVSS 7.4 — Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability added 2026-09-09
• CVE-2026-87491 CVSS 8.8 — Google Chromium V8: Google Chromium V8 Out of Bounds Write Vulnerability added 2026-09-09
• CVE-2026-20079 CVSS 10 — Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability added 2026-09-09
• CVE-2026-75650 CVSS 10 — Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability added 2026-09-08
• CVE-2026-81963 CVSS 7.8 — Microsoft Windows: Microsoft Windows Link Following Vulnerability added 2026-09-08
• CVE-2026-86218 CVSS 10 — N-able N-central: N-able N-central Static Code Injection Vulnerability added 2026-09-08
• CVE-2026-85880 CVSS 7.8 — Microsoft Windows: Microsoft Windows Heap-Based Buffer Overflow Vulnerability added 2026-09-08
• CVE-2026-85046 CVSS 8.8 — Google Chromium V8: Google Chromium V8 Type Confusion Vulnerability added 2026-09-04
• CVE-2026-59822 CVSS 8.8 — BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability added 2026-09-02
• CVE-2026-48710 CVSS 6.5 — Kludex Starlette: Kludex Starlette HTTP Request/Response Smuggling Vulnerability added 2026-09-02
• CVE-2026-49869 CVSS 10 — Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability added 2026-09-02
• CVE-2026-82329 CVSS 9.8 — JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability added 2026-09-02
• CVE-2026-9586 CVSS 9.3 — Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability added 2026-09-02
• CVE-2026-83548 CVSS 10 — SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability added 2026-09-02
• CVE-2026-83549 CVSS 7.8 — SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances OS Command Injection Vulnerability added 2026-09-02

Highest exploit probability (EPSS) in the news

• CVE-2024-45519 CVSS 10 — EPSS 99.9% (top 0.0%)
• CVE-2026-85706 CVSS 10 — EPSS 91.4% (top 0.2%)
• CVE-2025-66516 CVSS 8.4 — EPSS 88.1% (top 0.2%)
• CVE-2026-71362 CVSS 9.1 — EPSS 87.5% (top 0.2%)
• CVE-2026-85046 CVSS 8.8 — EPSS 48.9% (top 1.2%)
• CVE-2025-54988 CVSS 8.4 — EPSS 36.7% (top 1.5%)
• CVE-2026-76461 CVSS 9.8 — EPSS 28.3% (top 1.9%)
• CVE-2026-87902 CVSS 8.1 — EPSS 19.8% (top 2.7%)

Most active ransomware groups (September 2026)

• thegentlemen — 105 claimed victims
• qilin — 74 claimed victims
• Storm — 37 claimed victims
• akira — 36 claimed victims
• krybit — 34 claimed victims
• safepay — 32 claimed victims
• AuditTeam — 30 claimed victims
• incransom — 29 claimed victims

Most targeted countries: US (274), DE (38), BR (31), CA (29), GB (29).

Want news daily or the moment something is exploited? Use the free RSS feeds or turn on notifications on Threat Recap.

Ransomware figures are unverified claims posted by criminal groups. Tags are keyword-based.