Citizen Lab (2 September 2026), with the SHARE Foundation, confirmed that an iPhone belonging to a member of Serbia’s student protest movement was infected with NSO Group’s Pegasus spyware via an iMessage zero-click exploit. High-confidence indicators cover December 2025–January 2026; Citizen Lab assesses the exploit was addressed in Apple iOS 18.4.1 (April 2025). SHARE has documented at least 14 recent Apple Threat Notifications among Serbian students, civil society and an opposition MP ahead of 2026 election cycles; Amnesty has separately described related Android spyware (NoviSpy-like) installed during detention. (source: Citizen Lab research note) Recipients of Apple Threat Notifications should treat devices as presumed targeted and seek forensic help; keep iOS current. UPDATE 19 October 2026 (Citizen Lab research note with the SHARE Foundation): two more cases bring to at least 16 the members of Serbian civil society publicly known to have been targeted or infected with mercenary spyware. Citizen Lab found with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of the student pro-democracy movement (his offices were raided by Serbian authorities on 31 March 2026), was infected with NSO Group's Pegasus in 2026 through a zero-click exploit that needed no click or file opening; the investigation is ongoing and Citizen Lab has not named the exploit or iOS version. Rade Bajić, a former senior prosecutorial associate at the Belgrade organised-crime prosecutor's office who worked on the 'Generalštab' corruption case over the planned Belgrade 'Trump Tower' project, received an Apple Threat Notification on 13 August 2026 and a reminder on 27 August, which Citizen Lab treats as a high-confidence sign of likely mercenary-spyware targeting; forensic analysis of his device continues. The findings come ahead of Serbia's 25 October 2026 snap parliamentary election. Citizen Lab advises Apple Threat Notification recipients to seek expert help at once (in Serbia, the SHARE Foundation; elsewhere, Access Now's Digital Security Helpline), have close contacts screened, enable Lockdown Mode and keep devices updated.
Cisco published a batch of security advisories on 2 September 2026. Two medium-severity flaws in Cisco Secure Email S/MIME decryption, CVE-2026-20354 and CVE-2026-20355 (Cisco CVSS 5.9 each), are due to insufficient validation of message integrity: Cisco says an attacker using a machine-in-the-middle technique to intercept and modify traffic between email gateways could obtain plaintext content from the encrypted communication. Cisco says that at the time of publication the flaws affected Secure Email devices running AsyncOS 16.5.0 or earlier with S/MIME configured for communication between email gateways, that a public announcement of the flaws is available, and that it is not aware of any malicious use. In the same publication, Cisco's notice lists the IOS XR Software Security Hardening Release for September 2026 (CVE-2026-20274 to CVE-2026-20280; Critical, CVSS 9.8), a Nexus 9000 Series Switches Silicon One remote code execution flaw (CVE-2026-20212; Critical, CVSS 9.8) and a high-severity SIP denial-of-service flaw in Desk Phone 9800, IP Phone 7800 and 8800 and Video Phone 8875 (CVE-2026-20281; CVSS 7.5), and recommends upgrading to the fixed software indicated in each advisory. (sources: Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY; Cisco's publication notice) Apply available IOS XR, Nexus and phone fixes; for Secure Email, Cisco says there are no workarounds and refers customers to bug IDs CSCwu28362 and CSCwu28364 for fixed releases. Correction (25 Oct 2026): Cisco's advisory (version 1.1, updated 8 September) says there are no workarounds for CVE-2026-20354 and CVE-2026-20355 and refers customers to bug IDs CSCwu28362 and CSCwu28364 for fixed releases; the earlier advice to apply workarounds from the advisory was wrong and has been removed. (source: Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY) Correction (26 Oct 2026): CVSS scores and fix status are now credited to Cisco's advisory and publication notice. An unlinked SecurityWeek summary and wording that came from it (the flaws described as unpatched, 'no fix at disclosure', and descriptions of the IOS XR flaw classes and the Nexus attack path) have been removed. (source: Cisco)
ThreatFabric (2 September 2026) details StreamRat, an Android banking trojan promoted through a fake television-streaming campaign on Meta aimed at Spanish-speaking users. ThreatFabric estimates about 570,950 Meta accounts in the EU saw the ad at least once; infected-device totals are not published. After sideloading app.apk, the dropper seeks default Home-app status, a VPN permission that blackholes other apps' traffic during install, unknown-sources install rights, then Accessibility access for the StreamRat payload (keylogging, credential overlays, UI inspection, remote control) before talking to C2. ThreatFabric does not name an attributed actor. Users should refuse streaming APKs that request Home, VPN, or Accessibility controls unrelated to playback; enterprises with BYOD Android in AU/EU travel cohorts should watch for sideloaded streaming lures.
Forescout Vedere Labs (covered by The Hacker News on 2 September 2026) reports researcher-guided use of Anthropic Claude to port a working pre-authentication RCE exploit for CVE-2021-31886 (Nucleus FTP USER-command stack buffer overflow, Siemens CVSS 9.8, TCP/21) from a WAGO 750-852 to a WAGO 750-831 on firmware V01.04.16, executing ARM shellcode on live hardware. The port needed sustained human steering; the final RCE stage cost about US$535.74 in API usage over roughly 8.5 hours. CERT@VDE advisory VDE-2021-050 says no updates are available for affected WAGO controllers and advises disabling/blocking FTP on port 21, segmentation, and traffic monitoring. A later session that tried to build a C2 implant bricked the PLC by writing flash-mapped memory. Forescout notes a skilled researcher might have finished the initial port without AI faster and cheaper. Old CVE, new AI-assisted exploit-port demonstration — useful for OT change-control and agentic-coding risk discussions.
Google launched the Fairwind Program (2 September 2026 posts) to give a limited set of trusted Google Cloud customers, government agencies, and cybersecurity partners early access to Gemini 3.8 Flash Cyber — Google's most capable cybersecurity model for vulnerability discovery and automated patching — paired with the CodeMender harness so defenders can find, verify, and fix issues in their own secure cloud environment. Google says it is working with more than 650 partners globally (examples named include CrowdStrike, Datadog, Menlo Security, Palo Alto Networks, and Snowflake). 3.8 Flash Cyber ships with a more permissive cyber-capability profile than general Gemini 3.8 Flash and is therefore limited to vetted defenders; Google states the focus is vulnerability fixing over offensive exploitation.
BerriAI LiteLLM GHSA-7488-6r32-c95q (CVE-2026-59822) is High: the MCP Streamable HTTP auth path could let an unauthenticated attacker establish an MCP session with an arbitrary Bearer token when OAuth2 passthrough fallback replaced failed key validation with an empty UserAPIKeyAuth object, exposing configured MCP tools and connected services. Affected versions before 1.84.0; fixed in 1.84.0. GHSA publishes CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N; CISA KEV (2 Sep 2026) and The Hacker News cite 8.8. CISA added the CVE to KEV on evidence of active exploitation. Upgrade to 1.84.0+ or disable/block /mcp/ until patched.
Kestra GHSA-5vc5-wxxq-3fjx (CVE-2026-49869) is Critical: AuthenticationFilter whitelists any path whose last segment is configs via endsWith("/configs"), so unauthenticated callers can hit flow/execution APIs and, with default script plugins, achieve remote code execution as root in the worker container. GHSA CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0). Affected through 1.3.20; patched in 1.0.45 and 1.3.21. CISA added it to KEV on 2 September 2026. Upgrade Kestra OSS immediately; do not expose the webserver to untrusted networks until patched.
Kludex Starlette GHSA-86qp-5c8j-p5mr (CVE-2026-48710) is an HTTP request/response path confusion: affected builds rebuild request.url from an unvalidated Host header, so a malformed Host can make request.url.path differ from the path the router actually dispatched. Middleware that authorises on request.url.path can be bypassed. GHSA rates Moderate; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5). Affected through 1.0.0; patched in 1.0.1. CISA added it to the KEV catalog on 2 September 2026 based on evidence of active exploitation. Upgrade Starlette (and FastAPI stacks that pin it) to 1.0.1 or later; ensure front-end proxies reject malformed Host headers.
BleepingComputer and SecurityWeek report a 2 September 2026 joint disruption of the long-running Sality peer-to-peer botnet. Europol, Eurojust, the U.S. DOJ, FBI and DCIS seized Sality-linked domains in the United States, with further seizures in Bulgaria, Hungary and Romania. CrowdStrike's Counter Adversary Operations, with law-enforcement and industry partners, sinkholed known super-peer lists that form the botnet's communication backbone, blocking file packs and URL packs that push payloads. CrowdStrike says Sality has been active since at least 2003, has infected more than 15,000 devices historically, and that the two still-active networks at takedown were mainly used to push EggJagger clipjacking payloads; earlier payload history spans credential theft, spam, proxies, exploitation and DDoS. BC quotes CrowdStrike that after more than two decades the botnet is now no longer able to push new malware payloads through those channels.
SonicWall's 2 September 2026 advisory SNWLID-2026-0016 (covered by SecurityWeek the same day) warns SMA1000 series secure remote access / SSL-VPN customers of two zero-days discovered and observed exploited internally. CVE-2026-83548 is a pre-authentication SSRF in the Appliance Work Place interface, rated CVSS 10. CVE-2026-83549 is an OS command injection in the Appliance Management Console (AMC), rated CVSS 7.8, that an authenticated attacker can use for arbitrary OS commands and potential RCE. SonicWall says both have been exploited and the pair can be chained for unauthenticated remote code execution. Affected models: SMA1000 6210, 7210 and 8200v. Hotfixes 12.4.3-03526, 12.5.0-02952 and higher patch both issues. SSL-VPN on SonicWall firewalls and SMA100 series products are not affected. CISA added both CVEs to the KEV catalog on 2 September 2026.
According to the CVE record published on 1 September 2026 (02:07 UTC; 10:07 am Perth; HackerOne CNA), CVE-2026-65643 is an eval injection (CWE-95) in cPanel 11.138.0.0 and earlier that allows remote authenticated users to execute arbitrary code as root. The record lists cPanel as affected before 11.110.0.141, from 11.112.0.0 before 11.134.0.53, from 11.136.0.0 before 11.136.0.37, from 11.138.0.0 before 11.138.0.2 and from 11.138.1.0 before 11.138.1.7, and rates it CVSS 4.0 8.7 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). CISA's enrichment of the record lists proof-of-concept exploitation, not active exploitation. cPanel's own advisory, linked here, returns 403 to Cyberstack. This is not the April login bypass (CVE-2026-41940), which is already on Cyberstack. (source: CVE record) Correction (27 Oct 2026): removed details that came only from cPanel's advisory, which Cyberstack cannot read: the parked- and addon-domain file-creation mechanism, the WP Squared product name, the line that all supported versions are affected, and the advisory's statements on scoring and exploitation; the CVE record's CVSS 4.0 score is now given. The card date has moved from 27 August to 1 September 2026, the Perth date of the CVE record (1 September, 02:07 UTC; 10:07 am Perth (AWST)). (source: CVE.org)
KrebsOnSecurity (1 September 2026) reported a dark-web identity-theft service branded Nexus advertising digital scans of more than 153 million US and Canadian driver’s licences plus millions of other ID cards, travel documents and medical cards. Krebs’s checks pointed to Louisiana identity-verification firm IDScan.net as the likely source; the company said it was investigating and the FBI New Orleans field office opened an inquiry. SecurityWeek (3 Sep) and Ars Technica (2 Sep) corroborated the listing. BleepingComputer (4 September 2026) reports multiple lawsuits against IDScan, with firms including Markovits, Stock & DeMarco and Hall Attorneys launching investigations into potential class-action litigation. Nexus appeared to shut shortly after Krebs published. Organisations that rely on third-party ID-scan vendors should treat this as a supply-chain identity risk. NEW 10 September 2026 (BleepingComputer): IDScan published a 4 September 2026 security notice (initially noindex) stating it learned on or around 1 September that an unauthorised party may have accessed or copied customer information in IDScan.net cloud accounts — full names and driver's licence or other government ID numbers — and that investigation continues with third-party specialists. IDScan's notice does not mention the Nexus listing or the 153 million figure; the link between the two comes from KrebsOnSecurity's reporting. UPDATE (IDScan notice, updated 29 September 2026): IDScan says an unauthorised third party gained access to a portion of its cloud environment between 4 April and 2 September 2026, that the event was limited to its VeriScan platform, and that the information potentially involved could include full name, contact information, date of birth, and driver's licence, passport or other government ID numbers, varying by how each customer organisation used VeriScan; it says it is not aware of misuse. UPDATE 16 September 2026: primary_url switched to IDScan.net press notice (datePublished 4 Sep 2026) stating unauthorised access/copy of cloud customer info may include full names and driver's licence or other government ID numbers; free credit monitoring offered; cooperating with federal law enforcement. ACS Information Age (8 Sep) re-covered the dump for AU readers — no new scope beyond vendor notice. Correction (22 Oct 2026): an earlier version said IDScan's notice tied the company to the 153M+ licence dump; the notice does not mention the dump, and that link is KrebsOnSecurity's reporting. (source: IDScan.net notice)
IDScan.net — Notification of Data Security Incident (4 Sep 2026)
