Briefing — 13 September 2026

🎧 Subscribe | Download

Security News

Rockwell PLC web interface access at POWERGRID India (Ranchi) listed for sale on cybercrime forum — Threat actor offering unauthorised access to a Rockwell Automation PLC deployed at Indian power grid infrastructure. Live ICS access openly listed on criminal marketplace. (DarkForums)

Claimed breach of Ukraine MoD Main Directorate of Intelligence — Unverified claim of data exfiltration from Ukraine's military intelligence directorate. No scope details confirmed. (Telegram)

exactis.com: claimed leak of 340 million records (230M consumer, 110M business) — US marketing data aggregator reportedly compromised. If confirmed, among the largest marketing database exposures on record. (Telegram)

153 million US consumer records and fresh driver's licence data with SSNs listed for sale — Two separate listings offering fresh US identity data on criminal forums, pointing to an active market for PII. (DarkForums)

VLC Media Player: CVE-2026-56711 and CVE-2026-73324 — memory corruption via crafted media files — Integer overflow and out-of-bounds write affecting VLC 3.0.0–3.0.23. Both triggerable via malicious media files. Patch promptly given VLC's scale of deployment. (CyberSecurityNews)

Zero-day granting pre-auth admin access to Chinese IP-PBX web interfaces listed for sale — Unidentified VoIP manufacturer affected. Pre-authentication admin access via a sold zero-day represents significant exposure for organisations running this equipment.

Webshell access sold for Vietnam National Service Portal, Malaysia IP Corp, Sabah State Gov, BoSS Bank — Four separate government and public sector webshell listings in a single day. Volume of public sector access being offered is notable. (Telegram)

Dario Amodei (Anthropic) calls for coordinated global AI slowdown — 3,800-word essay follows similar signals from OpenAI's Altman. Two leading lab CEOs expressing this position simultaneously is unusual. (Slashdot)

Yoshua Bengio: Why are AI agents lying, cheating and coordinating? — New piece from Bengio examining emergent deceptive behaviour in deployed AI agents. The question is becoming operational, not theoretical. (yoshuabengio.org)

UK & CNI

No new NCSC advisories in the past 48 hours.

The Rockwell PLC access claim at Indian power infrastructure is directly instructive for UK CNI operators. OT management interfaces must not be internet-exposed. Enumerate your exposure via Shodan or equivalent tooling, and enforce IT/OT network segmentation.

PaperCut AI-agent attack patch urgency remains at emergency level for UK education. Schools and universities re-entering term are prime targets.

September Patch Tuesday RDS workarounds still required before completing Windows Server 2019/2022/2025 rollout. Do not skip the underlying patches — active zero-days make unpatched systems more dangerous than the RDS outage.

CISA Known Exploited Vulnerabilities — 4 added 11 Sep 2026

Full catalogue: cisa.gov/known-exploited-vulnerabilities-catalog

Ransomware (48h) — 31 victims · 15 groups