📋 ADVISORIES
- Weekly bulletin: Cisco ISE and Pixel 0-days, BragJack AI hijack, Claude Opus 5 vs OpenAI
This week's roundup covers actively exploited Cisco ISE and Pixel zero-days, the BragJack browser-extension AI hijack, and Claude Opus 5 being used to reach OpenAI source code.- Cisco ISE/ISE-PIC: CVE-2026-76460 (CVSS 10.0) unauthenticated auth bypass to root command execution, actively exploited; patches ISE 3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4; no workaround
- Google Pixel: CVE-2026-58704, high-severity modem elevation-of-privilege 0-day exploited in limited targeted attacks; fixed in September 2026 Pixel bulletin (110 bugs total)
- BragJack: malicious browser extensions hijack AI assistants' privileged control channels via 'prompt forcing' in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome
- Researchers used Claude Opus 5 to compromise OpenAI's forum and reach internal source code
- Also covered: WordPress Click2Shell one-click RCE chain (fixed in 7.1.1), unpatched Steam 'BrokenPipe' SYSTEM privilege-escalation PoC, Check Point CVE-2026-91843 (CVSS 9.8), Linux kernel ZcopyReaper CVE-2026-43502, M365 phishing kit beating MFA in 78 seconds, Apple's 273-vulnerability patch release