Security News
Florida DMV database breached via stolen police credentials — ShinyHunters — Compromised law enforcement accounts used to access the Florida DMV system. Highlights the privileged access risk of law enforcement interconnects with government databases. (BleepingComputer)
Hackers abused Claude AI to extract secrets from 1.8 million Android apps — Threat actors used Claude to automate large-scale analysis of Android applications, extracting hardcoded API keys, credentials, and sensitive configuration data. (BleepingComputer)
AI generates 1 million personalised fraud emails in 3 days — AI-powered fraud infrastructure producing and dispatching individually tailored phishing and BEC emails at a scale and personalisation level previously impossible. (Dark Reading)
JFrog Artifactory: 3 vulnerabilities under active exploitation — all patched — CVE-2026-42016 (Incorrect Authorization), CVE-2026-42018 (Improper Authentication), and a third bug all being actively exploited. All three CVEs now on CISA KEV. Patch immediately. (The Register)
OpenAI agents probed RubyGems supply chain in May — Autonomous OpenAI agents targeted the RubyGems package registry in a supply chain probing operation. Follows yesterday's PaperCut AI-agent story. Supply chain infrastructure should be on active monitoring. (Simon Willison)
Users in Houthi-held Yemen attempted advanced weapons development via Claude — blocked — Anthropic flagged multiple attempts from Houthi-controlled territory to use Claude for dual-use weapons development research. Attempts were blocked. (SecurityWeek)
CISA urges more transparent breach notification as cyber outage costs mount — CISA calling for clearer, less spin-driven breach reporting as high-profile outages accumulate and public trust in disclosure erodes. (Dark Reading)
UK & CNI
No new NCSC advisories in the past 48 hours.
The PaperCut AI-agent attack (395+ orgs, 7 minutes to domain admin) disclosed yesterday remains directly relevant to UK education — UK schools and universities are among the most widely deployed PaperCut MF environments globally. Treat this as an active emergency patch, not a scheduled maintenance item.
September Patch Tuesday RDS breakage continues to affect UK Windows Server 2019/2022/2025 environments. Do not roll back the underlying patches — actively exploited zero-days make unpatched systems far more dangerous than the RDS outage. Apply Microsoft's RDS workarounds before completing your rollout.
New ransomware CNI alert: direwolf has claimed Port of Tanjung Pelepas, Malaysia — one of the busiest container transhipment hubs in Southeast Asia and critical regional logistics infrastructure. This is the same group that claimed RelyComply AML Platform (UK financial services) yesterday.
CISA Known Exploited Vulnerabilities — 4 added 11 Sep 2026
| CVE | Vendor/Product | Description |
|---|---|---|
| CVE-2026-84869 | ConnectWise ScreenConnect | Improper Privilege Management and Missing Authorization |
| CVE-2026-42016 | JFrog Artifactory | Incorrect Authorization |
| CVE-2026-42018 | JFrog Artifactory | Improper Authentication |
| CVE-2026-85706 | GitLab CE/EE | Path Traversal |
Full catalogue: cisa.gov/known-exploited-vulnerabilities-catalog
Ransomware (48h) — 29 victims · 19 groups
| Group | Victim | Country | Sector |
|---|---|---|---|
| akira | AK Stamping | — | Manufacturing |
| akira | Eagle Construction | — | Manufacturing |
| akira | George Cameron Nash | — | — |
| AuditTeam | ki***jp | 🇯🇵 JP | — |
| AuditTeam | my***ru | RU | Technology |
| chaos | mankatoclinic.com | 🇺🇸 US | ⚠️ Healthcare |
| chaos | artiflexmfg.com | 🇺🇸 US | Manufacturing |
| clop | Henry Pratt Company | 🇺🇸 US | Manufacturing |
| clop | Harley-Davidson | 🇺🇸 US | Manufacturing |
| direwolf | Port of Tanjung Pelepas 🇲🇾 | MY | ⚠️ Transportation/CNI |
| dragonforce | Medical Department Store | 🇺🇸 US | ⚠️ Healthcare |
| emperador | EASY JOB S.A.S. | 🇨🇴 CO | Professional Services |
| fulcrumsec | Dustin Group | 🇸🇪 SE | Technology |
| Global Secret Group | CO-OP Urban Bank | 🇮🇳 IN | ⚠️ Financial |
| incransom | JMS Building Corporation | 🇺🇸 US | Manufacturing |
| lockbit5 | alphaomega-eng.com | 🇩🇪 DE | Professional Services |
| Panzer | Konica Minolta Bulgaria | 🇧🇬 BG | Manufacturing |
| Panzer | Agencia Estatal de Meteorología (AEMET) | 🇪🇸 ES | ⚠️ Gov & Defense |
| pear | Foss Inc. | 🇺🇸 US | — |
| play | Sys-kool | — | Technology |
| play | Grunthal Welding & Supplies | 🇨🇦 CA | Manufacturing |
| qilin | Imperial Healthcare Solutions | 🇺🇸 US | ⚠️ Healthcare |
| rhysida | General Santos Doctors Hospital | 🇵🇭 PH | ⚠️ Healthcare |
| rhysida | Professional Retail Services | — | Retail |
| safepay | compunnel.com | 🇺🇸 US | Technology |
| Vexy Ransomware | i2k2 Networks | 🇮🇳 IN | Technology |
| Wallstreet | Goldston Oil Corporation | 🇺🇸 US | ⚠️ Energy/CNI |
| Wallstreet | On Demand Occupational Medicine | 🇺🇸 US | ⚠️ Healthcare |
| Wallstreet | NcbChurch | 🇺🇸 US | — |