Elastic Security Labs (report dated 14 September 2026; The Hacker News 16 September IST) tracks REF9334 delivering the KREMLIN toolkit against Brazilian banking users since at least May 2025. Infection starts with a manually run JavaScript lure (banking/invoice/document themed), then a multi-stage loader with sandbox evasion, Node.js staging, scheduled-task persistence, and Ethereum smart-contract dead-drop resolvers for C2/payload URLs (domains cited include volmira[.]site and zaviro[.]online). A C++ installer sideloads via a SentinelOne-named binary (SentinelAgentCore.dll). Malicious Chrome/Edge extensions use Phantom Extension / GhostChrome-X style Secure Preferences HMAC/App-Bound hash forgery to steal credentials and session tokens. Elastic notes similarity of the integrity-bypass technique to APT31 BlueMoon/GemStone tradecraft but attributes this cluster to Brazilian banking focus. (sources: Elastic Security Labs; The Hacker News)
In a Form 8-K filed with the US Securities and Exchange Commission on 14 September 2026, Houston-based utility CenterPoint Energy said that an unauthorized third party obtained personal information relating to a portion of its customers through one of its external-facing systems; BleepingComputer reported the filing on 15 September. CenterPoint says electric and gas services were not impacted and does not expect a material business effect; it activated IR, engaged third-party experts, hardened systems, and notified law enforcement/regulators. Class-action complaints filed in US federal courts allege the incident window was about 17 August–1 September 2026. UPDATE (14 Oct 2026, US time): KPRC 2 Houston reports that a CenterPoint breach report published on the Texas Attorney General's website on Monday (12 October, US time) lists 1,062,060 Texans as affected, gives names, addresses, Social Security information and driver's licence numbers as the information involved, and indicates affected people had not yet been notified when it was submitted. A CenterPoint spokesperson told KPRC the company is still working with third-party experts to assess the scope of affected customer data and identify which customers will be notified. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General) Correction (26 Oct 2026): removed the threat actor's own claims about how many records it took and how, and its later data release; CenterPoint has not confirmed them and no outlet has independently verified them. (source: BleepingComputer) Correction (26 Oct 2026): removed every SecurityWeek credit, link and detail; the affected-Texans count, data types and notification status from the Texas Attorney General's breach database are now credited to KPRC 2 Houston (14 Oct), citing the Texas Attorney General. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General) Correction (27 Oct 2026): CenterPoint's SEC Form 8-K is now linked and the company's statements are credited to it directly rather than to BleepingComputer's account of it. (source: CenterPoint Energy Form 8-K, SEC) Correction (29 Oct 2026): the card date is now 14 September 2026, the date shown on CenterPoint's linked Form 8-K, the earliest source for this story; the filing-acceptance time used for the earlier 15 September date came from an SEC page that is not linked, and it has been removed. Internal source labels were also removed. (source: CenterPoint Energy Form 8-K, SEC)
SEC — CenterPoint Energy Form 8-K, Item 8.01 (14 Sep 2026)
cPanel Security advisory (14 September 2026) warns of a critical privilege-escalation flaw in LiteSpeed Web Server Enterprise: on shared-hosting servers a malicious low-privilege website user could gain root-level access, bypassing account isolation including CageFS, and access or alter other sites and the server. Affected: LiteSpeed Web Server Enterprise prior to v6.3.7. Fix: upgrade to 6.3.7 or later. cPanel/LiteSpeed publish the forced update command /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 (auto-update may lag; as of THN 15 Sep, download page still listed 6.3.6 as stable). LiteSpeed store announcement for 6.3.7 (11 September 2026) lists three security changes (lscgid auth, internal redirect URL validation, block internal-use env vars from .htaccess) without naming a CVE or privilege-escalation root cause; neither cPanel nor LiteSpeed assigned a public CVE or CVSS for this Enterprise web-server issue as of 15 September 2026 check. Advisory does not state in-the-wild exploitation for this Enterprise flaw (distinct from earlier actively exploited LiteSpeed cPanel-plugin issues CVE-2026-48172 and CVE-2026-54420 already on Cyberstack). OpenLiteSpeed not named in the cPanel advisory. (sources: cPanel; LiteSpeed 6.3.7 announcement; The Hacker News)
Victorian car dealership Penfold Motors says it is contacting its customers after their contact and vehicle details were compromised by hackers, according to Cyber Daily (14 September 2026). Storm claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (30 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states. (source: Cyber Daily)
Cyber Daily — Penfold Motors latest car dealer to fall victim to the Storm ransomware group (14 Sep 2026)
Antonio De Turris (deturris.io, 14 September 2026) details two authorization bypasses in n8n’s AI Agents feature. CVE-2026-65015: a read-only Project Viewer can instruct an agent’s run_node_tool to execute arbitrary n8n nodes (including HTTP Request) with the project’s credentials; if Execute Command is enabled on self-hosted, that path can reach host command execution. Affected: all versions before 2.29.8, plus 2.30.0; fixed in 2.29.8 and 2.30.1. GitHub GHSA-x5vx-c2c8-m3w9 rates High (CVSS 4.0 overall 7.2). CVE-2026-59207: the agent MCP client sends credential headers without enforcing “Allowed HTTP Request Domains”, so a use-only credential holder can point MCP at an attacker host and exfiltrate the secret. Affected: all before 2.27.4, plus 2.28.0; fixed in 2.27.4 and 2.28.1. GHSA-h44j-f5r5-ph73 High (CVSS 4.0 overall 7.1). Reported June 2026; vendor advisories published with the fixes. (source: n8n GitHub security advisories)
De Turris — n8n AI Agents authorization bypasses (14 Sep 2026)
Silent Signal (14 September 2026) documents a pre-authentication vulnerability chain in the IBM Db2 Mirror for i web interface (Db2MirrorServlet on the IBM i administrative Liberty instance; lab IBM i V7R5, GUI WAR build timestamp late 2025). The write-up describes how authentication/validation filters can be confused, enabling unauthenticated reach into powerful admin features (arbitrary file read via log/trace viewers, attacker-influenced writes into an expanded WAR path that becomes JSP execution in Liberty, then a native helper crossing to QSECOFR on the local IBM i system). No CVE identifier is assigned in the post; the author withholds exploit/JSP payload bodies and frames the piece as vulnerability mechanics plus hardening guidance. Confirm IBM PSIRT/bulletin status for your Db2 Mirror for i / IBM i web stack build before declaring patched. (source: Silent Signal)
Silent Signal — Db2 Mirror for i pre-auth RCE chain (14 Sep 2026)
BleepingComputer (14 September 2026) reports that the verified Reddit account u/hbomax was hijacked and used to run about 108 malicious advertisements over roughly 48 hours. Ads used ClickFix social engineering (victims paste commands into Windows Run/PowerShell or macOS Terminal) and redirected to lookalike sites (including hbomaxx[.]us). Hudson Rock and ADAMnetworks link the activity to a broader campaign they call PasteSwitch delivering information stealers, loaders, crypto clippers, and fake wallets on Windows and macOS; one macOS chain referenced “AMOS helper” persistence under a .com.apple.accountsd-style directory. Some ads impersonated HBO Max; others pushed fake AI/developer/macOS utilities. BleepingComputer said HBO / Warner Bros. Discovery had not responded at publication. (source: BleepingComputer)
BleepingComputer — HBO Max Reddit ClickFix (14 Sep 2026)
Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhX (14 September 2026) covers CVE-2026-76461, a Critical SQL injection in email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway (physical and virtual, any configuration). Unauthenticated remote attackers can send a crafted email with malicious SQL statements and gain command execution as root on the underlying OS. Cisco CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-89; Bug CSCwu56234. Not affected: Secure Email and Web Manager, Secure Web Appliance. Cisco PSIRT became aware of active exploitation in September 2026; Cloud customers with detected malicious activity were contacted directly; Cloud fleet already upgraded to 16.5.0-780. IoC guidance: grep mail_logs for suspicious SQL (example COPY.*TO PROGRAM); also review external network/firewall logs because root access can erase on-box evidence. No workarounds. Fixed AsyncOS: 15.5 and earlier → 15.5.5-014; 16.0 → 16.0.4-302; 16.5 → 16.5.0-780 (Cisco strongly recommends 16.5.0-780). CISA added CVE-2026-76461 to KEV with FCEB remediation due 17 September 2026 (report: BleepingComputer / THN 15 Sep). Same-day Cisco also shipped other critical SEG/SEWM fixes (CVE-2026-76440/76441/20353/76443) without claimed in-the-wild use — covered here only as context, not separate cards. (sources: Cisco PSIRT; BleepingComputer)
Apple published security-content pages dated 14 September 2026 for major releases including iOS 27 and iPadOS 27 (support.apple.com/en-us/149034; 100+ CVE entries on that page alone), macOS Tahoe 26.7 (149042), macOS Sequoia 15.8 (149043), Safari 27 (149039), plus tvOS/watchOS/visionOS 27 and macOS Golden Gate 27. Highlighted iOS 27 entries (Apple does not publish CVSS): sandbox breakout CVE-2026-65354; sandboxed app to kernel privileges CVE-2026-84607; WebKit universal cross-site scripting via crafted webarchive CVE-2026-86898; ImageIO/remote code-execution class issues including CVE-2026-65414; privileged-network IPSec authentication bypass CVE-2026-65329 (also listed on earlier 26.6.x content). No “actively exploited” callouts observed on the fetched iOS 27 page. UPDATE 16 September 2026: macOS Golden Gate 27 security content (support.apple.com/en-us/149035) re-fetched — 200+ CVE entries on that page alone. Separate from prior /n/apple-ios-2661-20260817. Correction (30 Oct 2026): removed a fix count credited to SecurityWeek, which this desk cannot read; Apple's own pages are the source for the entries listed. (source: Apple)
Hunt.io (14 September 2026; The Hacker News same day) describes an intrusion against 3BB, a major Thai broadband provider. Researchers captured an attacker-operated server still live on 3 June 2026 that held tooling run from inside 3BB’s network, a MeshCentral deployment reporting to www.ayuthayatech[.]com under device group TH-3BB (agents with root), cleanup scripts that preserved MeshCentral, SSH password spraying against 55+ internal hosts, probes of agent.3bb.co[.]th, and scripts aimed at copying RADIUS subscriber credential databases (targeted; Hunt.io does not state confirmed exfiltration). The same cache held a complete exploit for FortiGate SSL-VPN CVE-2024-21762 aimed at mail.3bb.co[.]th and a valid 3BB VPN certificate plus Jasmine-network sessions (shared infrastructure; Jasmine breach not confirmed). (source: Hunt.io)
The Hacker News (14 September 2026) summarises academic/industry research (KU Leuven, ETH Zurich, Durham University, Google; ACM CCS 2026) on DDRop, an active DDR5 memory-bus interposer that silently drops writes so encrypted confidential-computing memory stays stale without integrity alarms. Targets Intel TDX (including Scalable SGX) and AMD SEV-SNP as used on major clouds; researchers demonstrated stronger outcomes on Intel TDX default logical-integrity mode (mapping, plaintext debug copy, attestation forgery) and a narrower page-copy result on AMD SEV-SNP. Requires prior software control of the host plus brief physical access to fit a ~US$159-parts interposer; researchers report no evidence of in-the-wild use. Intel and AMD treat physical interposer attacks as outside published threat models; Intel indicated it does not plan a CVE for this class of attack. No simple firmware patch: durable fix needs hardware freshness; optional Intel cryptographic-integrity mode blocks some TDX variants. (source: The Hacker News)
The Hacker News — DDRop vs TDX / SEV-SNP (14 Sep 2026)
UPDATE 14 September 2026 (BleepingComputer): Microsoft released emergency out-of-band updates that fix Remote Desktop Services failures introduced by the September 2026 security cumulatives, plus related Hyper-V Host Compute Service issues on some Windows 11 builds. OOB packages cited: Windows Server 2025 KB5129235, Server 2022 KB5129237, Server 2019 KB5129238; Windows 11 24H2/25H2 KB5129195, Windows 11 26H1 KB5129194; Windows 10 21H2/22H2 KB5129236. Server OOBs via Microsoft Update Catalog; the Windows 11 26H1 OOB also via Windows Update, Windows Update for Business and WSUS. USB audio regressions from September updates are not fully resolved by these OOBs. Earlier state: Microsoft confirmed RDS instability on release health and published Known Issue Rollback Group Policy packages (e.g. Server 2025 KB5122871, Server 2022 KB5122882, Server 2019 KB5122876) while developing the permanent fix. Prefer the matching OOB over long-lived KIR or cumulative rollback. Operational advisory for AU Windows estates — distinct from Patch Tuesday CVE cards. (sources: Microsoft Support KB5129195; BleepingComputer) Correction (31 Oct 2026): the card is now dated 14 September 2026, the date of Microsoft's out-of-band update notice and BleepingComputer's reports, instead of 10 September; replaced the link to Microsoft's Windows release health page, which no longer shows this issue, with Microsoft's KB5129195 notice, and removed a reference to other Windows 10 packages that no linked source gives. (sources: Microsoft Support; BleepingComputer)
BleepingComputer — Microsoft emergency OOB for RDS (14 Sep 2026)
