2026-09-14
Population: stories the tracker first saw on this Coordinated Universal Time (UTC) calendar day; publisher date is used only if first-tracked time is unavailable and remains on each item.
- breaches incidents
Six in 10 Cyberattacks in Colombia Target Hospitals
Colombia's health sector faces disproportionate cyber targeting, with six of ten recorded attacks aimed at hospitals and clinics according to data from IBM's X-Force Index. Medical information has emerged as a primary target for threat actors in the region.
Why it matters: Colombian hospital operators and health IT staff must prioritize security posture and incident response capabilities, as the sector faces significantly elevated attack frequency compared to other industries.
- government policy
Thorough reorganization at NSA will create five 'mission centers,' including cyber and AI
The National Security Agency (NSA) is undergoing a significant reorganization that will establish five mission centers, including divisions focused on cyber and artificial intelligence (AI) operations. The restructuring represents a major shift in how the agency organizes its capabilities and priorities.
Why it matters: Security practitioners should monitor NSA reorganization outcomes, as changes in the agency's cyber mission structure, staffing, and strategic focus may affect threat intelligence sharing, vulnerability disclosures, and the evolution of national cybersecurity priorities.
- vulnerabilitiesCVE-2026-82434
Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
CVE-2026-82434 affects Apache Storm Nimbus and Apache Storm Client, exposing ZooKeeper credentials to read-only users and logs. The poster questions whether the vulnerability has an assigned severity rating.
Why it matters: Apache Storm operators should assess whether their ZooKeeper credentials may be accessible to read-only users and in logs, and determine if they can upgrade to a patched version.
- breaches incidents
Delaware Consumer Privacy and Data-Breach Law Updates
Delaware's Governor signed two bills on September 2, 2026 that modify the state's privacy and breach notification frameworks. House Bill 380 amends the Delaware Personal Data Privacy Act (DPDPA), which took effect in January 2025, while House Bill 381 updates the computer security breach notification law.
Why it matters: Organizations operating in Delaware or handling Delaware resident data must track these amendments to ensure compliance with updated privacy obligations and breach reporting requirements.
- breaches incidents
AT&T store worker gets 16 months inside for SIM-swap side hustle
A former AT&T retail worker in Portland, Oregon received a 16-month federal prison sentence for using store system access to perform SIM swaps on customer accounts. The swaps enabled cybercriminals to intercept authentication codes and steal from victims' bank accounts.
Why it matters: Retailers and telecom providers should audit insider access controls and monitor unusual account modifications, as employees with legitimate credentials remain a high-risk vector for account takeover attacks targeting financial services.
- breaches incidents
HHS Releases Updated Security Risk Assessment Tool
The U.S. Department of Health and Human Services Office for Civil Rights and the Office of the National Coordinator for Health IT released version 3.7 of their Security Risk Assessment Tool. The update is designed to support healthcare organizations in evaluating and managing cybersecurity exposure.
Why it matters: Healthcare providers and IT vendors subject to HIPAA must adopt updated risk assessment methodologies to maintain compliance and identify vulnerabilities in their environments.
- vulnerabilitiesCVE-2026-84179
CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
CVE-2026-84179 affects Apache Storm Nimbus and UI versions 3.0.0 before 3.1.0, where the topology page endpoint merges and exposes unredacted daemon configuration data. The vulnerability allows sensitive Nimbus configuration to be disclosed through the topology_conf field without filtering.
Why it matters: Organizations running Storm 3.0.0 must patch to 3.1.0 immediately, as unredacted daemon configuration exposed through the UI may contain credentials or other sensitive parameters used for authentication and system control.
- vulnerabilitiesCVE-2026-82441
CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Apache Storm Nimbus versions 3.0.0 before 3.1.0 fail to validate topology dependency keys, allowing an attacker to delete arbitrary blobs belonging to other tenants and disrupt cluster operations. The vulnerability stems from insufficient input validation on the `dependency_jars` and `dependency_artifacts` parameters during topology submission.
Why it matters: Storm operators running affected versions face cross-tenant data loss and denial of service attacks from authenticated users who can manipulate topology submissions to delete blobs outside their scope.
- vulnerabilitiesCVE-2026-82439
CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Apache Storm DRPC (Distributed Remote Procedure Call) server versions 3.0.0 before 3.1.0 contain a memory leak vulnerability where request queues accumulate indefinitely without cleanup. An unauthenticated attacker can trigger unbounded memory growth by repeatedly sending requests with varying function names, eventually causing denial of service through resource exhaustion.
Why it matters: Organizations running Apache Storm 3.0.0 for DRPC operations face availability risk from remote attackers who can exhaust server memory without credentials; upgrading to version 3.1.0 or later is required.
- vulnerabilitiesCVE-2026-82438
CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
CVE-2026-82438 affects Apache Storm Webapp versions 3.0.0 before 3.1.0, exposing authenticated application programming interface (API) responses to unrelated web origins through three separate mechanisms including reflected Origin header handling and credentials transmission. The vulnerability allows cross-origin requests to access authenticated user data via the Logviewer and other HTTP components.
Why it matters: Organizations running vulnerable Storm Webapp versions expose authenticated API responses to cross-site request forgery attacks; immediate patching to 3.1.0 or later is required to prevent credential-based data exfiltration.
- vulnerabilitiesCVE-2026-82437
CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Apache Storm Logviewer versions 3.0.0 before 3.1.0 fail to enforce configured access controls on daemon logs, allowing unauthorized users to read restricted log content. The vulnerability stems from improper logic that combines daemon log detection with authorization results, effectively bypassing the `logs.users` and `logs.groups` access restrictions operators configure.
Why it matters: Storm operators using versions prior to 3.1.0 face information disclosure risk if they rely on log access controls to protect sensitive data in daemon logs; patching or upgrading to 3.1.0 is needed to restore intended access restrictions.
- vulnerabilitiesCVE-2026-82435
CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
Apache Storm Worker versions 3.0.0 before 3.1.0 contain CVE-2026-82435, which allows unauthenticated remote attackers to exhaust worker memory through the Netty message decoder. The vulnerability exists because the decoder processes frames before Security Assertions Markup Language (SAML) authentication handlers are invoked, enabling an attacker to allocate buffers of arbitrary size from a single frame.
Why it matters: Organizations running Apache Storm 3.0.0 to 3.0.x must upgrade to 3.1.0 or later to prevent denial of service attacks from unauthenticated network-adjacent threat actors targeting worker nodes.
- vulnerabilitiesCVE-2026-82432
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus versions 3.0.0 before 3.1.0 contain an authorization bypass in the blobstore configuration validation. The vulnerability arises because Nimbus validates the topology blobstore map only at submission time but fails to re-validate when rebalance operations introduce configuration overrides, allowing authorized rebalance callers to bypass restrictions.
Why it matters: Organizations running vulnerable Apache Storm Nimbus versions must patch immediately, as an attacker with rebalance permissions can escalate privileges by modifying blobstore configurations that should be restricted.
- vulnerabilitiesCVE-2026-82431
CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Apache Storm Client versions before 3.1.0 contain an authorization bypass vulnerability where SimpleACLAuthorizer returns early if nimbus.users is empty, bypassing nimbus.groups restrictions. Operators who configured group-level access control without setting nimbus.users would grant unrestricted access to all authenticated principals. The vulnerability was introduced in version 3.0.0 and is rated important severity.
Why it matters: Organizations running Apache Storm Client 3.0.0 through 3.0.x should upgrade to 3.1.0 immediately, as unpatched clusters configured with group restrictions alone have no actual access controls in place.
- vulnerabilitiesCVE-2026-82430
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Apache Storm Worker Launcher versions before 3.1.0 contain a local privilege escalation vulnerability in which the setuid-root worker-launcher changes directory ownership to an untrusted topology user before reading the command file, allowing that user to modify the file and gain root access. The flaw affects Docker and OCI worker launches in versions 3.0.0 and earlier.
Why it matters: Organizations running Apache Storm 3.0.0 or earlier for distributed stream processing face local privilege escalation risk if untrusted topology users can access worker nodes; upgrade to 3.1.0 or later to patch this root-level exposure.
- vulnerabilitiesCVE-2026-51990
Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Threat actors associated with a China-aligned espionage group are actively exploiting CVE-2026-51990, a critical vulnerability in Tencent's Sogou Input Method for Windows, to install the GrayRabbit backdoor. The flaw provides a direct path to compromise systems running the widely deployed input tool.
Why it matters: Organizations with Sogou Input Method deployed in Windows environments face immediate risk of backdoor installation and potential data exfiltration by state-sponsored actors; patching CVE-2026-51990 is urgent.
- ai security
Anthropic CEO Dario Amodei Says AI Industry Needs to Give Safety Measures Time to Catch Up
Anthropic CEO Dario Amodei cautioned that artificial intelligence (AI) systems could within six to 12 months become capable of coordinating autonomous agent swarms with potential to compromise the entire internet. He argued the industry must allow safety measures adequate time to mature alongside capability advances.
Why it matters: Security leaders and AI practitioners must account for rapidly evolving autonomous AI threats in threat modeling and incident response planning, as defensive capabilities may lag capability deployment.
- vulnerabilities
Security through obscurity is dead, and AI delivered the fatal blow
Artificial intelligence (AI) tools are rapidly discovering vulnerabilities in widely-used software and obscure legacy systems that were previously considered secure, making the traditional strategy of security through obscurity obsolete. Simultaneously, attackers are using AI to reverse-engineer patches and exploit critical infrastructure like water systems and industrial control systems (ICS) within hours of patch release. While AI excels at finding bugs, current AI-generated patches fail to resolve vulnerabilities or introduce new flaws more than half the time, creating a growing backlog for maintainers and defenders.
Why it matters: Security teams and infrastructure operators must abandon reliance on obscurity and shift focus from patch velocity to root-cause analysis and process improvements, as AI-assisted attackers now threaten both traditional IT and critical operational systems that were previously protected by lack of expertise.
- threat intel
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Microsoft disclosed two campaigns in which threat actors sent over one million fraudulent emails between August 3 and 5, 2026, by impersonating chief executive officers and using passkey-themed social engineering to compromise cloud environments. Attackers leveraged third-party email delivery infrastructure to distribute the financial fraud scams and gain unauthorized access to victim accounts.
Why it matters: Organizations with Microsoft cloud environments face credential compromise via passkey phishing; practitioners should review email authentication controls, monitor for suspicious cloud access patterns, and brief users on social engineering tactics impersonating executives.
- breaches incidents
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
A week in review article covering multiple security stories, including deployment of a Linux rootkit on F5 BIG-IP Application Programming Interface (API) Policy Module devices, exploitation of Cisco Firewall Management Center bugs, and discussions on zero trust principles for artificial intelligence agents.
Why it matters: Organizations running F5 BIG-IP APM and Cisco FMC should assess their networks for the rootkit and active exploits; security teams need to evaluate whether zero trust architectures account for AI agent behavior patterns.