🕵️ RESEARCH & DEEP DIVES
Researcher: 'fight AI with AI' automated patching narrative is overstated
A security researcher says claims that organizations are racing to automate patching at machine speed to fight AI are massively overstated.- Applies to organizations reportedly adopting automated, machine-speed patching to counter AI-driven threats
- Researcher GossiTheDog says the vast majority of orgs aren't doing this, don't need to, and it wouldn't be practical for most
- He argues the problem has been overstated in an effort to sell products and secure budget
DoppelCart fraud network uses 119,000 fake shops to steal credit cards — BleepingComputer
The EU CRA's Real Question: What Shipped, and When Did You Know? — BleepingComputer
Microsoft releases Windows 10 KB5122878 extended security update — BleepingComputer
Channel 5 Gave Hunter Biden a List of Its Subscribers’ Emails for Some Reason — 404 Media
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days — SecurityWeek
Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day — SecurityWeek
September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th) — SANS ISC
Russian national extradited to US for alleged involvement in bank-account takeover scheme — CyberScoop
CIA’s Michael Ellis says cyber intelligence is changing how the agency operates — CyberScoop
Why federal cyber defense demands an offense-driven mindset — CyberScoop
In the current development version of Eclipse aeriOS, for which no official r... — CVE ThreatInt
Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch... — CVE ThreatInt
ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)ColdFusion is affec... — CVE ThreatInt
ColdFusion | Improper Neutralization of Special Elements used in an SQL Comma... — CVE ThreatInt
ColdFusion | Uncontrolled Resource Consumption (CWE-400)ColdFusion is affecte... — CVE ThreatInt
ColdFusion | Improper Access Control (CWE-284)ColdFusion is affected by an Im... — CVE ThreatInt
ColdFusion | Improper Input Validation (CWE-20)ColdFusion is affected by an I... — CVE ThreatInt
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)Photoshop Desktop... — CVE ThreatInt
Photoshop Desktop | Out-of-bounds Write (CWE-787)Photoshop Desktop is affecte... — CVE ThreatInt
Photoshop Desktop | Uncontrolled Search Path Element (CWE-427)Photoshop Deskt... — CVE ThreatInt
Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)Photoshop Desktop is ... — CVE ThreatInt
moltis-org moltis vault.rs vault_recovery_handler missing authenticationA sec... — CVE ThreatInt
Illustrator | Improper Input Validation (CWE-20)Illustrator is affected by an... — CVE ThreatInt
Critical Patches Issued for Microsoft Products, September 8, 2026 — CIS Advisories
One of the elements to all of this, of course, orgs like Microsoft - at the top of the vendor train and trying to... — @GossiTheDog@cyberplace.social
For all the crying about the "AI vulnerability apocalypse" - it's just business as usual in the trenches amongst orgs... — @GossiTheDog@cyberplace.social
Here's where they rank in the whole DPRK state structure. — @campuscodi@mastodon.social
Kudelski and Sekoia researchers look at how the Lazarus Group is now operating from six distinct sub-clusters after a... — @campuscodi@mastodon.social
KEV: CVE-2026-81963 — Microsoft Windows — Microsoft Windows Link Following Vulnerability — CISA KEV
KEV: CVE-2026-85880 — Microsoft Windows — Microsoft Windows Heap-Based Buffer Overflow Vulnerability — CISA KEV
KEV: CVE-2026-86218 — N-able N-central — N-able N-central Static Code Injection Vulnerability — CISA KEV
A $10 Million Reward is the Latest U.S. Move to Slow Iranian Cyberattacks — securityboulevard.com (discovered)
The Willow Doesn’t Restore From Backup — securityboulevard.com (discovered)
RE: https:// infosec.exchange/@BleepingComp uter/117236794538501777 Nearly 1,000’patches good lord. — @metacurity@infosec.exchange
📋 ADVISORIES
- 📄 Source for Sophos details Linux rootkit injecting fileless PHP web shells into F5 BIG-IP APM servers — sophos.com