🕵️ RESEARCH & DEEP DIVES
AI Gives Lesser-Resourced Attackers Nation-State-Level Reach, Google's GTIG Warns
Google's Threat Intelligence Group reports criminal and nation-state adversaries are using AI to automate and scale attacks.- GTIG warns AI lets under-resourced attackers operate at a scale typically associated with nation-state-backed groups.
- TeamPCP (UNC6780) used an AI coding chatbot with prompts and agent instructions to execute a mass credential-harvesting campaign in under six hours, targeting PyPI, npm, and Docker Hub since March 2026.
- TeamPCP's Dustmaker credential stealer embeds AI/open-source exploitation methods, and it publicly released tools named Shai-Hulud and Miasma; GTIG expects adversary emulation.
- Nation-state actors also leverage AI: PRC-nexus Basin Castle uses LLMs for target profiling, social-engineering lures, and malware; Iran-linked Calanque Ion (APT42) uses Gemini for OSINT and lures; Ravine Castle (APT24) uses Gemini across the full attack lifecycle; DPRK-nexus Midnight Neptune (UNC1069) uses AI to support cryptocurrency theft.
- Google counters by disrupting adversary accounts/projects and deploying real-time defenses against model 'distillation' attacks.
Android's September 2026 updates patch 180 vulnerabilities after two empty bulletins
Google's September 2026 Android security updates patch 180 vulnerabilities, including critical remote code execution flaws.- Applies to all Android devices; updates split into 2026-09-01 (95 bugs) and 2026-09-05 (85 bugs) patch levels, after bulletins with no vulnerabilities in July and August 2026.
- The 2026-09-01 patch fixes 56 System flaws including 23 critical RCE, EoP and DoS bugs, 37 Framework flaws, and one Android Runtime flaw; the most severe is a critical System RCE requiring no privileges or user interaction.
- The 2026-09-05 patch covers the kernel plus Arm, Imagination Technologies, MediaTek, Tsingteng Micro, Unisoc, Qualcomm, and TV components; notable flaw is CVE-2026-28662, a Wi-Fi memory corruption bug enabling silent RCE and privilege escalation.
- Devices at patch level 2026-09-05 or newer contain all fixes; no separate patches for Wear OS, Android XR, or Android Automotive OS this month, though their updates include the same fixes.
CISOs face mounting security burden as accelerated AI adoption drives breaches and burnout
CISOs report growing pressure from AI adoption, with 85% calling safe use of AI assistants and automation a top priority.- Applies to security leaders across enterprises, especially mission-critical sectors like finance, pharma, energy and healthcare.
- 85% of CISOs say ensuring safe use of AI assistants, copilots and automation is a top priority for the next two years, per Proofpoint's Voice of the CISO report.
- AvePoint's State of AI 2026 report found 89.5% of organizations had a GenAI-related breach and 88.4% an AI agent breach in the past year, despite rising confidence in access controls.
- A survey of 1,001 US and UK CISOs found 50% say cyber-capable models like Anthropic's Mythos made them consider leaving the profession, and 60% say board pressure to adopt AI outpaces their ability to govern it.
- AI has elevated CISOs into boardroom roles governing internal AI agents, with hiring demand and pay packages surging for AI-proven candidates.
FBI cyber chief says private sector too hesitant to share cyber threat information with the bureau
FBI Cyber Division Assistant Director Brett Leatherman says companies are not sharing enough cyber incident information due to misconceptions about how the FBI uses collected data.- Applies to private-sector organizations, especially critical infrastructure victims of nation-state breaches, including PRC-linked intrusions.
- Leatherman says a key misconception is that the FBI shares victim information with regulators for regulatory purposes, which he says is not the case.
- The FBI's posture is to 'share until it hurts', prioritizing rapid, actionable threat intelligence to victims over preserving future operations.
- The remarks accompanied the FBI's first unclassified, agency-wide cyber strategy, emphasizing victim support, disruption operations, and closer industry partnership.
- He warned it is concerning when breached organizations believe handling a nation-state intrusion alone is less risky than involving law enforcement.
Linux kernel HID core fix resolves number/pointer type confusion on long items
A type confusion vulnerability in the Linux kernel HID core was fixed.- Affects the Linux kernel HID core subsystem, impacting devices using HID item parsing.
- The bug is a number/pointer type confusion when fetch_item() is called by hid_scan_report() on long HID items.
- The flaw was resolved via a patch fixing the type confusion in HID item handling.
US says Chinese firms extracted billions of tokens from frontier AI models — BleepingComputer
Driver’s License Data for Sale — Schneier on Security
Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories — SecurityWeek
Podcast: DHS’ Secretive ‘Predictive Policing’ Unit Pulling People Over — 404 Media
First ‘Take It Down Act’ Sentencing Puts Man Behind Bars for 15 Years — 404 Media
New FBI cyber strategy promises increase in adversary disruptions — Cybersecurity Dive
Identity-Based AI Attack Threatens Security of Enterprise Data — Dark Reading
CISA Releases Updated Insider Threat Guide With New Insights to Mitigate Physical and Cyber Threats — CISA News
vlan: fix skb_under_panic and races when toggling HW VLAN offloadIn the Linux... — CVE ThreatInt
crypto: krb5 - use kfree_sensitive() for derived key buffersIn the Linux kern... — CVE ThreatInt
xhci: dbgtty: Fix unregister on tty_register_driver() failureIn the Linux ker... — CVE ThreatInt
crypto: qcom-rng - Allow zero as a random numberIn the Linux kernel, the foll... — CVE ThreatInt
KVM: s390: vsie: zero stale crypto bitsIn the Linux kernel, the following vul... — CVE ThreatInt
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argumen... — CVE ThreatInt
Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 thr... — CVE ThreatInt
io_uring: defer eventfd signaling when queued from a wakeup handlerIn the Lin... — CVE ThreatInt
drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_formatIn the... — CVE ThreatInt
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systemsIn the L... — CVE ThreatInt
kcov: fix data corruption and race conditions on PREEMPT_RTIn the Linux kerne... — CVE ThreatInt
drm/xe: Fix DPT allocation paths.In the Linux kernel, the following vulnerabi... — CVE ThreatInt
Cups: openprinting cups: remaining case-insensitive username matching in sche... — <https://cve.threatint.com