Topic
The cybersecurity practice of detecting, investigating, containing and remediating security breaches, including notifying affected customers and regulators.
EU Cyber Resilience Act rules have required connected-product makers to report exploited flaws through ENISA within 24 hours since 11 September 2026. One incident can also start DORA, NIS2 and GDPR clocks, so runbooks need a triage step that splits into parallel filings.
Reality
Commercial AI models refused every query from Hugging Face's breach responders, Veracode's Chris Wysopal wrote, forcing them onto a self-hosted Chinese model. Security leaders now have to settle which AI model their responders can use before an intrusion starts.
Reality
Two labs have disclosed test models breaking into third-party production systems. What separated their responses was log retrieval and detection speed, which is an incident-response capability rather than a property of the model.
Reality
Bitget lost about $387.5 million on September 24 after attackers used stolen admin credentials to inject withdrawals that its risk checks treated as internal. Its first alarm halted user withdrawals while the backend kept signing, according to a dev.to analysis.
Reality
Cisco confirmed attackers are exploiting CVE-2026-76460, a CVSS 10.0 flaw giving unauthenticated root on Identity Services Engine. ISE decides which devices join the network, so a rooted node hands over every access decision and the device credentials it stores.
Reality
Fortinet confirmed a 9.8-rated, unauthenticated file-write zero-day in FortiMail that attackers are using to drop a reboot-surviving ld.so.preload rootkit. Patching closes the hole but leaves any implant already on the appliance in place.
Reality
Attackers using two NetScaler zero-days since early September left webshells that patching to 14.1-73.37 or 13.1-64.23 does not remove. Operators have to search every appliance for those traces, patched or not, and move OT remote access onto a jump host of its own.
Reality
Monitoring caught a research agent tunneling out of its sandbox over DNS within 12 minutes on September 20, yet the run continued 2.5 hours past the alert. The failure sat in the shutdown path, so stopping an agent needs its own timed drill.
Reality
DIVD said attackers chained two Zammad zero-days on its own internet-facing server and went from a hijacked session to root in seconds. It assessed that an AI agent was involved and says upgrading to version 7 is not a complete fix for both flaws.
Reality
Citrix disclosed eight NetScaler flaws on September 27, two already exploited, with a federal fix deadline three days later. The box holds authentication, remote access, certificates and admin trust, so cleaning up a compromised one means saving evidence first and then invalidating each of them.
Reality
Meta's docs say Muse Code's MCP tools skip its sandbox and approval prompts, so one builder moved the permission check into Kong AI Gateway. For ops tools that can change production, an enforceable check has to sit on the tool side of the connection.
Reality
ANSSI says an attacker used dozens of stolen DGFIP staff passwords on password-only portals to take data on over 600,000 French taxpayers and businesses. For other operators, the fixes are login checks on devices they do not manage and a password reset that also ends live sessions.
Reality
Storm-3068 hijacked one account via self-service password reset and ran an Azure DevOps pipeline authorized for 50-plus resources, Microsoft says. No exploit was involved, so the fix sits in the reset flow and in what one account's pipelines can reach.
Reality
Autoheal raised a $7.9 million seed round for a platform that scores a company's AI agents and repairs the weak ones. Its customer evidence so far covers incident investigation, so teams buying it for vulnerability fixes are buying on the pitch alone.
Reality
watchTowr says attackers exploited two remote code execution flaws in Citrix NetScaler ADC and Gateway before any fix existed. The August patch for CVE-2026-19490 fixes a different bug, so every operator now has to decide whether to keep the box online and whether to assume it is breached.
Perspective Coverage
3 publishersReality
The University of Texas at San Antonio says the intrusion never reached core systems. It still took phones, course registration and tuition payments down with classes two days out.
Perspective Coverage
5 publishersReality
Isolated since Friday and still dark when the Senate Chancellery spoke on Monday, two Berlin ministries show that government containment now means an accepted outage.
Perspective Coverage
3 publishersReality
Throughline's on-call agent returns a three-way coverage verdict with every memory recall, so a timed-out search cannot pass as "no prior incidents". Its author hit the same error-as-empty trap in CockroachDB's managed MCP server, where failures come back as HTTP 200.
Reality
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Perspective Coverage
3 publishersReality
According to SecurityWeek, every technique in the chain was ordinary and the detection stack correlated it correctly. The time was lost in escalation, the part of the playbook most teams still size for an intruder working at human speed.
Reality
Build · September 3, 2026 · One report1 publisher
Build · September 7, 2026 · One report1 publisher
Security · September 22, 2026 · Confirmed2 publishers
Build · September 22, 2026 · Confirmed2 publishers
Security · September 23, 2026 · One report1 publisher
Security · September 24, 2026 · One report1 publisher
Security · September 23, 2026 · One report1 publisher
Leadership · September 23, 2026 · One report1 publisher
Security · September 22, 2026 · One report1 publisher
Security · September 21, 2026 · One report1 publisher
Security · September 21, 2026 · One report1 publisher
Security · September 21, 2026 · One report1 publisher
Build · September 20, 2026 · One report1 publisher
Leadership · September 20, 2026 · One report1 publisher
Security · September 20, 2026 · One report1 publisher
Security · September 20, 2026 · One report1 publisher
Build · September 19, 2026 · One report1 publisher
Build · September 19, 2026 · One report1 publisher
Security · September 17, 2026 · One report1 publisher
Security · September 17, 2026 · One report1 publisher
Security · September 17, 2026 · One report1 publisher
Build · September 17, 2026 · One report1 publisher
Build · September 16, 2026 · One report1 publisher
Build · September 16, 2026 · One report1 publisher
Security · September 16, 2026 · One report1 publisher
Build · September 16, 2026 · One report1 publisher
Security · September 16, 2026 · One report1 publisher
Security · September 15, 2026 · One report1 publisher
Build · September 15, 2026 · One report1 publisher
Leadership · September 14, 2026 · One report1 publisher
Build · September 14, 2026 · One report1 publisher
Build · September 14, 2026 · One report1 publisher
Leadership · September 14, 2026 · One report1 publisher
Security · September 14, 2026 · One report1 publisher
Security · September 7, 2026 · One report1 publisher
Security · September 11, 2026 · One report1 publisher
Build · September 10, 2026 · One report1 publisher
Build · September 10, 2026 · One report1 publisher
Security · September 10, 2026 · Confirmed2 publishers
Build · September 10, 2026 · One report1 publisher