Briefing — 16 September 2026

🎧 Subscribe to the podcast feed

Security News

Apple "Vulnpocalypse" — 260+ CVEs Patched in Record-Setting Release (The Register) — Apple's iOS 27 / macOS Golden Gate 27 cycle addresses more than 260 CVEs — the largest single patch cycle in the company's history — driven by AI-assisted vulnerability discovery at scale.

Mythos AI Drove Microsoft's 970-Patch Week — And May Eventually Help Defenders (The Register) — An AI-assisted vulnerability research toolchain named Mythos is credited with inflating 2026's patch volumes to breaking point; analysts suggest the same capability could automate remediation at scale in 2027.

Acronis cPanel Backup Plugin — Actively Exploited Local Privilege Escalation (BleepingComputer) — High-severity LPE vulnerability in Acronis's backup plugin for cPanel/WHM/Plesk is under active exploitation; hosting providers should patch immediately.

Malicious WordPress Plugin Backdoors 1,500 Sites via Supply Chain Attack (BleepingComputer) — Attackers compromised the Admin Menu Editor Pro plugin maintainer's website and pushed backdoored updates to 200+ customers, resulting in approximately 1,500 WordPress sites being silently backdoored.

CVE-2026-69486 — Microsoft Edge RCE via Heap Buffer Overflow (MSRC) — Unauthenticated remote code execution vulnerability in Chromium-based Edge via heap buffer overflow; update Edge immediately.

CVE-2026-85893 — Microsoft Edge Elevation of Privilege via Use-After-Free (MSRC) — Use-after-free vulnerability in Edge allowing network-based privilege escalation; patch alongside CVE-2026-69486.

North Korean APT Deploys Novel Linux Espionage Toolkit Against South Korea (Dark Reading) — A likely DPRK-linked APT targeted South Korean media and automotive sectors with a previously undocumented Linux espionage toolkit, using load balancers as initial access and pivoting to communications interception.

UK & Critical National Infrastructure

UK Ransomware Victim: High Oakham Primary School (UK) has been claimed by TheGentlemen ransomware group. Primary schools hold sensitive SEND records, child welfare data, and biometric information — all highly sensitive categories. Local authority cyber teams should be aware this group is actively targeting UK education.

Telecoms sector hit: Akira ransomware has claimed Southern California Telephone Company (Energy & Utilities / telecoms). Telecoms infrastructure is critical national infrastructure — this class of targeting warrants monitoring for similar campaigns against UK operators.

Hosting infrastructure alert: The actively exploited Acronis cPanel backup plugin vulnerability (LPE) directly affects the managed hosting and web services sector. UK hosting providers and MSPs running cPanel or Plesk stacks should treat this as an emergency patch priority.

Food supply chain: Qilin is claiming ADM (Archer-Daniels-Midland), one of the world's largest agricultural commodity processors. If confirmed, this represents a significant food supply chain incident with CNI implications internationally.

NCSC Advisories: No new NCSC alerts or advisories published in the past 48 hours.

Ransomware Victims (48h) — 78 Victims · 18 Groups

78 victims · 18 groups