Briefing — 25 September 2026

🎧 Subscribe to the podcast feed

Security News

Crook used three open-source AI agents to breach Fortune 500 hospitality company, major US airline and 25+ orgs (The Register) — A threat actor chained three publicly available agentic AI frameworks to compromise over 25 organisations with no custom tooling or nation-state resources.

Autonomous AI Hacks Raise Thorny Questions of Legal Accountability (SecurityWeek) — As autonomous agents carry out intrusions without direct human control, legal frameworks struggle to assign liability to operators, developers, or victims.

'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing (Dark Reading) — Researchers demonstrate that Salesforce AI agents can be manipulated to send phishing messages to Slack users, expanding the enterprise attack surface.

MacSync malware uses public iCloud calendars to deliver new payloads (BleepingComputer) — A newly documented macOS threat abuses iCloud calendar events as a covert C2 channel, bypassing traditional email-based detection.

SectopRAT Returns, Hiding Inside a Legitimate Application (Dark Reading) — The infostealer resurfaces with a new delivery mechanism, embedding itself within a legitimate application to evade detection.

Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges (The Record) — The Department of Justice alleges a forensics contractor with federal security clearances concealed its Russian connections, raising supply-chain integrity concerns.

Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks (The Record) — US legislators propose a voluntary cybersecurity standards framework for telecoms in response to the Salt Typhoon intrusions that affected multiple major carriers.

CVE-2026-69282 — Microsoft SharePoint Remote Code Execution (MSRC) — A critical RCE vulnerability in Microsoft Office SharePoint requiring prompt patching across enterprise environments.

CVE-2026-68894 — Windows Error Reporting Elevation of Privilege (MSRC) — A privilege escalation flaw in Windows Error Reporting that could allow local attackers to gain elevated system access.

Sourcehut account takeover via build logs (XSS in ansi2html) (Hacker News) — An XSS vulnerability in the ANSI-to-HTML converter used in Sourcehut build logs enabled full account takeover — relevant to any CI/CD pipeline processing third-party output.

DriveWealth Suffers Data Breach Affecting Revolut Customers (Finextra) — DriveWealth, which provides brokerage infrastructure for Revolut's investment products, has disclosed a breach impacting Revolut customer data — coinciding with a ransomware claim against Revolut itself.

UK & Critical National Infrastructure

⚠️ GDM Pipelines (UK) — Qilin ransomware claim. A UK energy and utilities firm listed in the 48-hour ransomware window. Energy pipelines infrastructure sits at the core of CNI; the scope of any compromise is unconfirmed but warrants monitoring.

⚠️ Revolut (UK) — ImNotAVillain ransomware claim. Revolut, headquartered in the UK and serving tens of millions of customers globally, has been listed by the group ImNotAVillain. This coincides with the separate DriveWealth breach affecting Revolut's investment product customers. Two concurrent exposure events around the same brand in the same window.

ukbjja.org (UK) — The UK Brazilian Jiu-Jitsu Association listed by incransom.

Telecom security legislation (US/global relevance): US lawmakers have introduced a bill for voluntary telecom cyber standards following Salt Typhoon. UK telecoms face equivalent exposure from state-affiliated intrusions; the legislative debate in Washington sets a precedent that DSIT and NCSC will be watching.

No new NCSC advisories in the past 48 hours.

Ransomware Victims (48h)

45 victims · 18 groups

Today's Picks

• India orders blocking of 216 Google Firebase databases in single day after Android malware surge (Ministry of Cyber Affairs) — India's I4C issued five notices to block 216 Firebase Realtime Databases used as C2 for Android banking malware, the largest single-day Firebase enforcement action on record.