Stories first seen on 12 September 2026
Review the tracked stories and available summary evidence for the archived period shown.
Population: stories the tracker first saw on this Coordinated Universal Time (UTC) calendar day; publisher date is used only if first-tracked time is unavailable and remains on each item.
15 stories
- Breaches and Incidents
Not just Korea: Google leaked identifying info for sex crime victims across the world
Google's removal request process for illegally obtained sexual images exposed the private information of victims in multiple countries, not just South Korea. The Hankyoreh confirmed that victims who submitted takedown requests had their identifying information subsequently posted online. A victim reported that non-consensual photos from her childhood were distributed and later surfaced following her removal request.
Why it matters: Victims of image-based sexual abuse and practitioners handling privacy incident response need to understand that Google's removal process may inadvertently re-expose identifying information, creating compounded harm across multiple jurisdictions.
- Breaches and Incidents
NYS DFS Issues New Cybersecurity Guidance on Risk Assessments for Financial Services Entities
On September 10, 2026, the New York State Department of Financial Services (DFS) released guidance establishing expectations for DFS-regulated financial services entities to conduct risk assessments that inform their cybersecurity programs. The guidance specifies requirements around scope, frequency, and assessment roles.
Why it matters: Financial services firms regulated by DFS must align their risk assessment practices with this new guidance or face potential enforcement action and compliance violations.
- Industry and Vendors
Cylake Gets $245M to Build Cloud-Free Cybersecurity Platform
Cylake, a startup founded by Palo Alto Networks founder Nir Zuk, raised $245 million to develop an on-premises cybersecurity platform that integrates hardware, storage, security software, and local artificial intelligence (AI). The platform targets regulated organizations that cannot transmit sensitive security data to cloud providers.
Why it matters: Regulated enterprises and those under data residency constraints need to evaluate whether this on-premises alternative addresses their ability to run modern security operations without external cloud dependencies.
- AI Security
Anthropic Says AI Is Lowering the Bar for Sophisticated Attacks
Anthropic's Threat Intelligence team published findings showing that multi-agent artificial intelligence (AI) tools enable less-skilled attackers to execute complex, wide-ranging operations with minimal resources. The report emphasizes that the risk lies not in AI's speed of exploit development, but in how accessible sophisticated attack infrastructure has become to broader threat actor populations.
Why it matters: Security teams and incident responders need to prepare defenses against complex, multi-vector attacks from less-technical threat actors who can now leverage AI tools to scale their capabilities.
- Ransomware and Leak Sites
Ukrainian Conti Ransomware Developer Gets 4 Years in US Prison
Ukrainian national Oleksii Lytvynenko received a four-year prison sentence from a U.S. court after admitting to developing malware and stealing data for Conti ransomware. Conti has been attributed to over 1,000 victims and approximately $150 million in ransom payments.
Why it matters: Organizations targeted by Conti should monitor for ongoing activity from affiliated developers and prepare for potential follow-up attacks, as the network likely remains operational despite individual arrests.
- Breaches and Incidents
ID Verification Firm IDScan.net Confirms Data Breach
IDScan.net, a Louisiana-based identity verification firm, confirmed a data breach linked to the alleged darkweb sale of over 153 million U.S. and Canadian driver's licenses. The company's breach notice did not disclose the number of affected individuals or the attack vector used by threat actors.
Why it matters: Organizations relying on IDScan.net for identity verification should determine whether their data was included and assess customer notification obligations; individuals with U.S. or Canadian driver's licenses may face identity theft risk if their records were compromised.
- Vulnerabilities and PatchesCVE-2026-42016
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. CVE-2026-42016, affecting Artifactory with a CVSS score of 8.1, involves an incorrect authorization issue.
Why it matters: Security teams must prioritize patching these five vulnerabilities immediately, as they are under active exploitation and tracked by CISA as a prioritization resource for vulnerability remediation.
Spies, surveillance and rogue AI: Best infosec long reads 9/12/26
A New Yorker article examines Flock Safety's nationwide license plate recognition (ALPR) surveillance network, which trades anonymity for promised crime reduction. The piece documents growing public and political opposition across conservative and liberal states, including documented misuse by police for stalking, ICE enforcement, and reproductive surveillance. Founder Garrett Langley deflects responsibility for how the technology is deployed while framing privacy concerns as obstacles to safety.
Why it matters: Security practitioners and organizations evaluating surveillance infrastructure must understand the operational and reputational risks of ALPR systems: documented abuse patterns, bipartisan pushback leading to frozen funding and revoked permits in major states, and the liability exposure when vendors disclaim responsibility for misuse.
- Breaches and Incidents
Revolut confirms customer data breach through fake government requests
Revolut experienced a customer data breach resulting from fraudulent government requests. The company notified impacted customers and reported the incident to government agencies, law enforcement, and financial regulators.
Why it matters: Revolut customers face identity and fraud risk from exposed data; fintech users should verify account security and monitor for unauthorized activity.
Grouped: similar headlines.
- Vulnerabilities and Patches
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
BlueMoon exploit kit chains recent Chrome and Windows zero-day vulnerabilities to enable opportunistic attacks. Multiple espionage-motivated threat actors have rapidly deployed the kit in the wild.
Why it matters: Organizations running unpatched Chrome and Windows systems face immediate compromise risk from active exploitation by nation-state and criminal threat actors using this chained attack vector.
- AI Security
From Hacks to Bioweapons, Claude Misuse Is Now Everywhere
Claude, an artificial intelligence (AI) model, is being misused across multiple domains ranging from cyberattacks to generating harmful biological content. The report also covers law enforcement disruption of a major dark web marketplace, prosecution of a Conti ransomware group member, and Meta's struggles to prevent AI-generated child sexual abuse material.
Why it matters: Security teams must monitor AI model abuse vectors in their threat environment, law enforcement actions affect underground market operations and criminal enterprise viability, and practitioners should evaluate content moderation controls given the proliferation of synthetic abuse material.
- AI Security
When the Whole Company Adopts AI: What It Does to Your SOC
Enterprise security operations centers are observing a surge in alerts generated by artificial intelligence (AI) tools and agents deployed across organizations. These alerts stem from routine AI usage by developers and staff rather than attacks targeting AI systems, creating new noise in security monitoring workflows.
Why it matters: Security operations center teams need to adapt alert tuning and baseline models to distinguish legitimate AI tool activity from genuine threats, or risk alert fatigue and missed signals.
- Threat Intelligence
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
Researchers identified that a coordinated attack on RubyGems in May 2026 involved OpenAI agents operating as a swarm to target the package manager. The incident resulted in remote code execution (RCE) on RubyDoc servers and represented a significant supply chain security incident.
Why it matters: Ruby developers and organizations using RubyGems packages face supply chain compromise risk; practitioners should review their dependency management and audit package integrity for any affected versions from that period.
Grouped: the same names (SPENCER KITTS, SYDNEY VON ARX, THOMAS LARSEN).
- Vulnerabilities and PatchesCVE-2026-85706
NCSC-2026-0367 Vulnerability fixed in GitLab Community and Enterprise Editions
GitLab patched a path traversal vulnerability in its Community and Enterprise Editions that allows unauthenticated users to read arbitrary files through the repository commits application programming interface (API). The vulnerability stems from improper path confinement and missing authentication controls on the API endpoint. The flaw is tracked as CVE-2026-85706 with a CVSS score of 10.0, has been added to CISA's Known Exploited Vulnerabilities catalog, and public exploit code is available.
Why it matters: Organizations running internet-facing, self-hosted GitLab instances face immediate risk of sensitive file exposure without authentication; patch to GitLab 19.1.8, 19.2.6, 19.3.2 or later immediately, review API logs for suspicious requests with file.path parameters, and rotate any exposed credentials.
- AI Security
Users in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic Says
Anthropic disclosed that users in Houthi-controlled Yemen attempted to leverage its artificial intelligence (AI) systems to develop advanced weapons, though they did not achieve an operational device. The group conducted a failed test of a guided rocket using artificial intelligence (AI) assistance.
Why it matters: Security teams must monitor for nation-state and non-state actors exploiting AI services for weapons development, as Anthropic's disclosure reveals gaps in access controls and content moderation that could enable proliferation risks.