Briefing — 9 September 2026

🎧 Subscribe | Download

Security News

Record Patch Tuesday: 974 CVEs, 2 actively exploited zero-days, 113 critical — Microsoft's largest ever monthly update. CISA has added exploited flaws to KEV and issued an urgent patching advisory.

OpenAI Artifactory used as covert exfil channel in Hugging Face attack — Attackers exploited the package registry to silently extract credentials and model weights. Developer tooling is an increasing attack vector.

Multi-hop Google redirect phishing campaign — Chained google.com URLs bypass email security filters to reach credential-harvesting pages. Trusted domains defeat many link-reputation checks.

NSA/CISA/FBI: China systematically distilling Western AI models — Joint advisory details techniques used to extract capabilities from commercial AI systems without underlying research investment.

$245M crypto heist perpetrator pleads guilty to RICO — SIM-swap attack on victim's telecom provider used to drain cryptocurrency holdings.

LG smart TVs scan local network in standby despite opt-out — TVs report connected device data to LG servers even when privacy settings indicate otherwise.

UK & CNI

No new NCSC advisories. UK victims this window: Cope Plastics (Chaos, Manufacturing) and Brent Electric (Akira, ⚠️ Energy/CNI). The record Patch Tuesday is the priority action item for UK defenders — patch immediately.

Ransomware (48h) — 69 victims · 19 groups