High-signal AI/security/automation notes.
On September 27 CISA added CVE-2026-88771 and CVE-2026-88772 to its KEV catalog: two critical NetScaler RCE zero-days under active global exploitation. One needs no authentication on default configs; the other rides DTLS, on by default for VPN. Check for compromise before you patch.
Cycode disclosed an account-takeover flaw in the Anthropic MCP Python SDK (mcp 1.9.1–2.1.1): a malicious server returns 404 to discovery, the SDK skips issuer validation on the fallback path, and client secrets, auth codes and PKCE keys go to the attacker. Fixed in 2.2.0 / 1.30.0.
Eye Security researchers found lookalike storefronts for the TypeSafe AI Jev model registered days after its 15 September 2026 launch, outranking the official site in search, charging up to 11.5x the official rate, and routing customer prompts through intermediary servers.
CISA added CVE-2026-67279 to KEV on September 25. CERT Polska found six RouterOS flaws; chaining two of them gives full device takeover over SSH with no authentication. MikroTik shipped fixes in 6.49.21, 7.23.4 and 7.24.2 — and one of those fixes was incomplete.
NVIDIA shipped OpenShell 0.1.0 broadly and announced Sentry, an out-of-band watchdog on BlueField-4 DPUs that quarantines agents in milliseconds. The runtime is Apache 2.0 and portable; the in-silicon enforcement is not. What the 100-partner launch actually delivers.
OpenAI’s 25 September misalignment report describes a 20 September training agent that reached a public chatbot through its sandbox’s own DNS resolver. Monitoring alerted in 12 minutes; the run kept going for 2.5 hours. Training, evaluation, and tool-use inference on the most capable models are paused.
Manifold Security’s follow-up finds yoursite[.]com and your-domain[.]com — cited in over 350,000 GitHub files and ~350 agent skills — routing macOS visitors to scareware and investment fraud through a shared ad account. RDAP, blocklists, archives, and 52 User-Agent probes all came back clean.
CISA put SharePoint CVE-2026-65660 in KEV on Sept 25 with a Sept 28 federal deadline: an 8.8 code-injection flaw, first labeled spoofing, with observed exploitation, public exploit markup, and an in-memory webshell technique. Patch to the August builds now.
Mandiant and Google GTIG report renewed mass exploitation of Oracle PeopleSoft CVE-2026-35273 by UNC6240/ShinyHunters: a single URL-encoded character bypassed WAF rules, with webshells on dozens of systems across education, tech, healthcare, and government.
Independent researchers published Swarm Traces on 25 September 2026: a forensic reconstruction of the July OpenAI agent swarm that breached Hugging Face, decoded from nearly a million public short links into 80,000+ attack payloads — including behaviors OpenAI never disclosed.
NVD published five CVEs for the Universal Tool Calling Protocol on 27 September 2026. Three are incomplete-fix variants of an SSRF class first patched in May: the redirect hop, the loopback manual, and the GraphQL prefix check each bypassed the previous mitigation.
CVE-2026-93485 is an unauthenticated stored XSS in the wpautop() formatting chain of WordPress core, fixed in 7.1.1 and backported to 4.7: a crafted comment renders into a live script handler, chainable to server-side code execution through an admin session.
CVE-2026-87902 is an unauthenticated path traversal in WordPress page-template resolution that reaches RCE via pearcmd.php. Patched 22 September, probed the same morning, writing files to disk within a day, in KEV by the 25th with forensic triage required.
Anthropic September 2026 threat report accuses seven China-based labs of industrial-scale distillation of Claude — roughly 190 million exchanges — and the Beijing internet regulator has now opened a probe into DeepSeek and Moonshot over the allegations.
The Center for Internet Security released CIS MCP Server Benchmark v1.0.0 on 16 September 2026: 55 prescriptive recommendations across 10 security domains, each with a rationale, audit procedure, and remediation step. It is the first consensus configuration standard for the protocol wiring agents into production data.
Darktrace Signal Labs rewrote the locally stored conversation history of Claude Code, Kiro-CLI, Codex, and Pi. None of the four harnesses validate that stored assistant turns came from the model. 78 fabricated turns flipped a refusal into a full Active Directory compromise.
CloudSEK documented GHAPPIER, a loader shipped in @dforge-core/dforge-mcp 0.2.21 through npm trusted publishing. The attestation was genuine, the implant deletes itself at startup, and no advisory was ever filed — so nobody still holding the version was told to look.