FBI and Coast Guard probe cyberattacks on ships entering US waters

🕵️ RESEARCH & DEEP DIVES

• FBI and Coast Guard investigate suspected cyberattacks on ships entering US waters
  The FBI and Coast Guard are investigating suspected cyberattacks on ships entering US waters.

  • The FBI and US Coast Guard are probing suspected cyberattacks targeting ships entering US waters.
  • The investigation comes amid heightened vigilance over US port facilities and maritime security.
  Sources 📎 Coverage: cybersecuritydive.com · 👁 via Cybersecurity Dive

• US Coast Guard and FBI board oil tanker over suspected network compromise
  The US Coast Guard and FBI boarded an oil tanker mid-voyage over indications its network had been compromised by a foreign actor.

  • The US Coast Guard and FBI boarded the oil tanker mid-voyage last month as it traveled toward Texas.
  • The boarding followed indications that the ship's network "may have been compromised by a foreign actor."
  • Investigators boarded the supertanker at sea to examine the suspected compromise by malicious hackers.
  Sources 📎 Coverage: bitdefender.com · 👁 via Graham Cluley

• CISA Urges Organizations to Deploy Cyber Decoys to Expose Attackers After Compromise
  CISA has published guidance urging organizations to deploy fake credentials and decoy systems to expose attackers after an initial compromise.

  • CISA's new guidance, Using Cyber Decoys to Strengthen Detection and Response, was published on September 16, 2026, and is aimed at organizational defenders.
  • It covers fake credentials, decoy systems, files, and data assets placed inside environments to expose attackers after an initial compromise.
  • CISA notes many attackers now avoid malware-heavy intrusion methods and instead abuse legitimate user credentials and tools.
  • Decoys are positioned as a way to strengthen detection and response once intruders are already inside a network.
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

• What Recent AI-Powered Attacks Mean for Your Identity Security — BleepingComputer

• Manufacturers make patching progress, but identity management still major weakness — Cybersecurity Dive

• OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training — SecurityWeek

• CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot — SecurityWeek

• Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom — SecurityWeek

• AI Threat Landscape Digest: July–August 2026 — Check Point Research

• University Rescinds Job Offer to Activist Who Allegedly Wiped Phone Before DHS Could Search It — 404 Media

• Contest to Open for Ed Sheeran Flooded With Free Palestine Videos and Fart Memes — 404 Media

• LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th) — SANS ISC

• CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 — CrowdStrike Blog

• VU#280377: Dokploy is vulnerable to OS command injection — CERT/CC Vulnerability Notes

• libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p... — CVE ThreatInt

• dynamic_oidc identities are not namespaced by connection in ash_authenticatio... — CVE ThreatInt

• libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID an... — CVE ThreatInt

• libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA... — CVE ThreatInt

• BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds WriteBlueK... — CVE ThreatInt

• RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter... — CVE ThreatInt

• RAGFlow through 0.27.2 Tenant Import Endpoints Path TraversalRAGFlow through ... — CVE ThreatInt

• b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Arr... — CVE ThreatInt

• Mattermost Desktop App Missing IPC Sender Validation in Calls Leave HandlerMa... — CVE ThreatInt

• Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalo... — CVE ThreatInt

• Mattermost Desktop App plugin popout scheme validation bypassMattermost Deskt... — CVE ThreatInt

• vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds ... — CVE ThreatInt

• Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next v... — CVE ThreatInt

• CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionCake... — CVE ThreatInt

• Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameterNuxt O... — CVE ThreatInt

• Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHT... — CVE ThreatInt

• Vendure: Shop API list queries can return non-public entities when filterOper... — CVE ThreatInt

• The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents — Securelist (Kaspersky)

• FBI Takes Down NightmareStresser DDoS Service Used in Hundreds of Thousands of Attacks — Cyber Security News

• CVE-2026-90999: A fabricated Sentry bug report can make Seer's coding agent run attacker code — r/netsec

• CISA Wants Defenders to Plant Fake Credentials and Systems to Catch Hackers — cryptika.com (discovered)

• Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casino — <https://www.cryptika.com/hacked-thai-college-website-abused-to-