News – September 2026


  • AI CEOs say they need to slow the pace of development

    September 14, 2026

    After apocalyptic warnings about the threats posed by AI, leaders like Sam Altman and Elon Musk backed Anthropic CEO Dario Amodei’s calls to ‘slow the pace’. Facing a public uproar over Anthropic researchers’ repeated warnings that artificial intelligence could kill all of humanity by 2030, the AI company’s CEO, Dario Amodei, issued a proposal at the weekend to slow down the technology’s ...

  • OpenAI’s malicious bot swarm attacked RubyGems

    September 14, 2026

    OpenAI agents appear to have flooded RubyGems with malicious packages, adding to a near-daily deluge of rogue AI models engaging in potentially unlawful activity while their human creators face growing questions over responsibility for their agents’ bad behavior. A swarm of agents began uploading malware to the Ruby package registry on May 5, and flooded RubyGems with more than 2,000 malicious packages between May ...

  • Revolut confirms customer data breach through fake government requests

    September 12, 2026

    British fintech Revolut confirmed that it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent from a legitimate government agency email domain. The exposed data included customers’ identity and contact details, including their birth date, postal and email addresses, and phone numbers, as well as copies of their identity documents including ...

  • Crypto customers targeted by scammers after email marketing provider breach

    September 11, 2026

    An attacker breached an email marketing platform and launched targeted attacks against the newsletter subscribers of some of its customers, especially those working in cryptocurrency and adjacent fields. The incident was a supply-chain phishing campaign carried out through Brevo, an email marketing provider used by several cryptocurrency companies and other firms. Brevo initially said an attacker had ...

  • The modern bank heist is already under way

    September 11, 2026

    The image of the bank robber is hopelessly outdated. Today’s heist does not begin with a getaway car outside a branch. It begins quietly, with an adversary establishing persistence inside a financial institution’s network and studying how the organisation responds, says Tom Kellermann, VP of AI Security and Threat Research at Trend AI. The objective is no longer ...

  • A new Android attack combines malware and ransomware in a cocktail of cybercrime

    September 11, 2026

    Unique malware variant spotted targeting Android users. When threat actors target people’s devices, they usually infect it with one of many malware strains: an infostealer, a remote access trojan, a backdoor, or a ransomware encryptor. Rarely do we see all of these functionalities merged into a single entity, and even rarer – to have it target Android ...

  • ShinyHunters expose 6.4M in attack on medical supplier McKesson

    September 10, 2026

    McKesson’s cyberattack last month affected roughly 6.4 million individuals, according to Have I Been Pwned (HIBP). The breach notification service added data leaked by serial extortionists ShinyHunters, revealing the scale of the attack for the first time. ShinyHunters initially claimed to have stolen 284 million documents from the medical and pharmaceutical supply company in August, although HIBP ...

  • Protecting organizations from AI-assisted executive impersonation and invoice fraud

    September 10, 2026

    Threat actors are increasingly improving their tactics to make suspicious emails look like legitimate email notifications to potential victims, deploying techniques that impersonate internally sent emails from executive team members. While this technique is not new, the adoption of AI has enabled threat actors to improve their campaign templates and construct emails tailored to their ...

  • Anthropic researcher resigns with warning about the dangers of AI development

    September 9, 2026

    An Anthropic researcher said he is resigning from the company over concerns the artificial intelligence firm and its competitors are not acting responsibly in AI development, echoing concerns raised inside and outside of the industry about the technology’s potential to elude human control. Jacob Coxon, who said he spent three years doing research at both Anthropic and ...

  • CISA, NSA, FBI warn Chinese AI firms of industrial‑scale knowledge distillation

    September 9, 2026

    Chinese AI companies’ core development strategy is to steal proprietary functionalities and capabilities from their US counterparts, law enforcement agencies have warned. The US Cybersecurity and Infrastructure Security Agency (CISA) has published a new security advisory, drafted jointly with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), warning American AI companies about an ongoing “aggressive, malicious, ...

  • FBI Cyber Strategy

    September 9, 2026

    This Strategy sets the course for FBI Cyber Division to defend the American people and the nation’s critical infrastructure in cyberspace. It defines our priorities, objectives, and framework for countering malicious cyber activity directed at the United States. It guides how the FBI uses its unique combination of law enforcement, intelligence, and national security authorities ...

  • Microsoft fixes record 964 flaws, including 2 exploited zero-days

    September 9, 2026

    Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs, including 104 rated Critical and 860 rated Important, making it the company’s largest Patch Tuesday release on record. Microsoft lists 974 CVEs in its full September security release. However, 10 of those affect cloud services or involve fixes that Microsoft applies itself, leaving 964 vulnerabilities that customers need to patch. The ...

  • MikroTik router flaws allow takeover without a password

    September 8, 2026

    CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a vulnerable version ...

  • Russian National Extradited to United States for Bank Account Takeover Fraud Scheme Causing Millions of Dollars in Losses

    September 8, 2026

    Sergei Anatolyevich Filimonov, 36, a Russian national and web developer who was allegedly involved in a transnational cyber‑fraud conspiracy responsible for large‑scale bank account takeover activity, was arraigned Friday in the Northern District of Georgia after being extradited from the Republic of Georgia. Filimonov was indicted by a federal grand jury on Nov. 4, 2025, ...

  • OpenAI hid AI agent hijacking of German wiki forum for weeks

    September 7, 2026

    OpenAI recently disclosed the details of how one of its AI models escaped a sandboxed environment and attacked Hugging Face during an evaluation – and as part of the incident, the models created a messaging board to communicate with each other and influence each other’s reasoning. OpenAI has now disclosed that shortly after this incident, agents undergoing testing ...

  • Two major security flaws are affecting more than six million WordPress websites

    September 7, 2026

    More than six million WordPress users are at risk of website takeover, researchers have claimed after discovering two major vulnerabilities being exploited in the wild. Security researchers Wordfence disclosed finding two flaws, one in Elementor Pro, and one in Super Forms – two popular WordPress plugins. Elementor Pro is a commercial plugin that allows users to build websites using ...

  • More than 1 million users affected in Mathspace data breach across Australia and New Zealand

    September 7, 2026

    More than a million people, including students, school staff, and parents, have been affected following a data breach at Mathspace, according to the learning provider. The company said, in a blog post, “unauthorised parties had accessed an internal reporting system used by Mathspace” and the exposed information included names and email addresses. It said the attackers accessed ...