Cyber Threat Intelligence 03 September 2026

NCSA_THAICERT

Vulnerabilities

Off The Hook: Discovering And Observing Active Exploitation Of Sangoma Switchvox CVE-2026-9586
"At Horizon3, we’re constantly looking for technologies and applications to perform security audits on that we believe may be targeted by threat actors. In April of 2026, we took a look at the Sangoma ecosystem after several FreeBPX vulnerabilities, CVE-2025-57819 and CVE-2025-64328, landed on the CISA Known Exploited Vulnerabilities (KEV) catalog. One such application we landed on was Sangoma Switchvox. Switchvox is an enterprise VoIP telephony management solution. It allows organizations to easily configure phone systems to include voicemail, call forwarding, and monitoring and analytics across their enterprise."
https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/
https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html
https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/
SonicWall Warns Of Actively Exploited SMA1000 Zero-Day Flaws
"SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. The first is a maximum-severity command injection flaw (CVE-2026-83548) found in the SMA1000 Appliance WorkPlace interface that stems from a server-side request forgery (SSRF) weakness. This actively exploited zero-day chain also targets a command injection vulnerability (CVE-2026-83549) in the SMA1000 Appliance Management Console that attackers with admin privileges can exploit to execute arbitrary OS commands on vulnerable devices."
https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html
https://www.darkreading.com/vulnerabilities-threats/sonicwall-sma-1000-zero-days-unauthenticated-rce
https://www.infosecurity-magazine.com/news/hackers-chain-sonicwall-zeroday/
https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
https://securityaffairs.com/198303/security/sonicwall-patches-two-new-actively-exploited-zero-days-in-sma-1000-vpns.html
https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/
5 Million WordPress Sites Affected By SQL Injection Vulnerability In All-In-One WP Migration And Backup WordPress Plugin
"On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations. This vulnerability makes it possible for unauthenticated attackers to inject SQL that is later executed when a site administrator performs an archive restore, which can be used to leak the plugin’s secret key and ultimately achieve remote code execution, leading to complete site takeover."
https://www.wordfence.com/blog/2026/09/5-million-wordpress-sites-affected-by-sql-injection-vulnerability-in-all-in-one-wp-migration-and-backup-wordpress-plugin/
https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
"Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31. GeoNetwork originated at the United Nations Food and Agriculture Organization and is maintained under the Open Source Geospatial Foundation (OSGeo). It is a core component of many Spatial Data Infrastructure deployments across Europe and beyond, including the backend of the European INSPIRE geoportal."
https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html
Chrome And Firefox Updates Patch Dozens Of Vulnerabilities
"Google and Mozilla on Tuesday announced patches for dozens of vulnerabilities across Chrome and Firefox, including critical- and high-severity flaws. A fresh Chrome 152 update has been rolled out with fixes for 26 bugs, two of which are critical-severity use-after-free issues in Shared Tab Groups (CVE-2026-84353) and WebGL (CVE-2026-84352). The update also addresses nine high-severity security defects, including use-after-free, incorrect authorization, information leak, improper input validation, uninitialized resource, and buffer overflow weaknesses."
https://www.securityweek.com/chrome-and-firefox-updates-patch-dozens-of-vulnerabilities/
https://www.malwarebytes.com/blog/bugs/2026/09/two-critical-chrome-flaws-put-users-at-risk-on-malicious-websites
CISA Adds Seven Known Exploited Vulnerabilities To Catalog
"CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability
CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability
CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability
CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability
CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability
CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog
Eight Findings Across Seven Agents. Four Remain Unpatched At Publication.
"What it is. AI coding agents run git commands in the background to gather context, on some agents before you type a prompt, before the workspace-trust prompt, before you have even authenticated. Improper sanitization in this context-gathering mechanism is a widespread security vulnerability across AI coding agent products, each ending in arbitrary code execution. What an attacker gets. Arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen. Their SSH keys, the cloud credentials in their environment, the tokens in their shell config, every repository on disk, and a foothold on the machine. How widespread. Not one vendor’s bug. Claude Code ships over 77 million npm downloads a month (as per npm API). Across the five projects, Hermes carries over 237,000 GitHub stars, Claude Code 143,000+, Goose 54,000+, Qwen Code 27,000+ and Grok Build 26,000, close to half a million together."
https://www.manifold.security/blog/ai-coding-agents-git-hijack
https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
Exploit Published For Fresh Cleo Harmony Vulnerability
"Organizations are advised to immediately patch a fresh authentication bypass vulnerability affecting the file transfer application Cleo Harmony. Tracked as CVE-2026-84115, the security defect impacts the JWT refresh token logic and allows remote attackers to elevate their privileges via argument bearer manipulation. The flaw was discovered in an unknown function in the file ‘/api/connections’. An attacker could craft a malicious payload that tampers with the arguments in HTTP headers, bypassing access controls and leading to privilege escalation."
https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/
https://vuldb.com/cve/CVE-2026-84115

Malware

Kim Sooki Again? This Time, It Was Disguised As a Request For Seafood Ingredients
"A request to review the purchase of seafood ingredients arrived. When the file is opened, a normal hwp document appears, but while the user is reviewing the contents, a malicious script runs in the background and even registers a scheduled task. It then extracts system information to an external location, downloads and executes additional commands, and wipes all traces. Let’s examine the tactics used by a malicious LNK file linked to Kimsuky, which disguises the attack by masquerading as a legitimate business document."
https://asec.ahnlab.com/en/95217/
“Evasive” Malware Attack Tactics: Hiding, Bypassing, And Reappearing
"People who initially seem fine but tend to subtly avoid others as the relationship deepens or when conflicts arise—and who disappear when pressured—are commonly referred to as “avoidant types.” By repeatedly pulling away only to reappear, they drain the other person’s emotions and energy, ultimately undermining the relationship. The attack pattern of the recently identified “MoiClient” backdoor exhibits similar behavior. It lowers users’ guard by disguising itself as an invoice, executes while hidden within legitimate programs, and finds alternative paths whenever it encounters security controls. It bypasses permission controls and exploits vulnerable drivers to neutralize even security products designed to block it, while repeatedly executing itself through the Task Scheduler. Let’s take a closer look at MoiClient’s attack method: it bypasses obstacles when blocked and hides again when attempts are made to detect it."
https://asec.ahnlab.com/en/95211/
Gambling Goblin: A Chinese-Speaking Actor Hijacks Brazilian Government Sites To Fuel a Global SEO Fraud Machine
"Check Point Research has been tracking a sustained campaign, active since mid-2025, that marks a real shift in how and where cyber crime targets trusted infrastructure. The group behind it, which CPR dubbed, “Gambling Goblin”, is a Chinese-speaking cybe rcrime cluster tied to Earth Berberoka, previously documented targeting gambling sites across Asia. Its playbook: compromise trusted, high-reputation web servers and turn them into infrastructure for a global SEO fraud operation."
https://blog.checkpoint.com/research/gambling-goblin-a-chinese-speaking-actor-hijacks-brazilian-government-sites-to-fuel-a-global-seo-fraud-machine/
https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/
https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html
https://www.infosecurity-magazine.com/news/gambling-goblin-brazilian/
Pegasus Spyware Infection Of Serbian Pro-Democracy Student Activist
"In collaboration with the SHARE Foundation, the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware. Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware. We found high-confidence indicators of infection from a period across December 2025 – January 2026, however this does not preclude the possibility of additional infections."
https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/
https://cyberscoop.com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/
Tech Support Scams Look Different Now. Here’s What To Watch For
"In a tech support scam, criminals pretend to work for a trusted technology or security company. They claim there is a problem with your device, software, subscription, or account, then try to persuade you to pay them, share personal information, or give them remote access to your computer. These scams used to rely mainly on browser locks and fake virus warnings. Now, scammers use many more ways to reach people, including websites and platforms they trust."
https://www.malwarebytes.com/blog/scams/2026/09/tech-support-scams-look-different-now-heres-what-to-watch-for
Kali365 And Why Stealing Passwords Is No Longer Enough
"Attacks abusing authentication processes are on the rise. Since early 2026, Kali365, a phishing-as-a-service (PhaaS) platform targeting Microsoft 365 environments, has abused authentication processes in waves of attacks. A number of cybersecurity vendors and the FBI have reported on Kali365, and Barracuda researchers have seen many Kali365 attacks in recent months. This article details Barracuda’s findings."
https://blog.barracuda.com/2026/09/02/kali365-phishing-microsoft-365-authentication-abuse
Counterfeit Installers To System Compromise: Tracking a Deceptive Software Download Campaign
"Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors."
https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
https://thehackernews.com/2026/09/fake-software-installers-disable.html
Uncovering StreamRat: From Meta Ads To Full Device Takeover
"ThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign reaching approximately 570,000 potential victims. Following a two-stage installation, StreamRat abuses Accessibility Services and MediaProjection to provide operators with near-complete control over infected devices, combining VNC and hidden-screen control, UI-tree collection, keylogging, credential-stealing overlays, internet and screen-blocking capabilities."
https://www.threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat
https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html
New Pro-Ukraine Hacker Group Targets Russian Companies With Custom Ransomware
"A ransomware group believed to be linked to pro-Ukrainian hackers is targeting Russian organizations with custom malware and demanding multimillion-dollar payments, according to new research. The group, which calls itself VantaCore, has targeted at least seven known victims, Russian cybersecurity firm F6 said in a report published this week. Researchers first detected its activity in August, although the group's data-leak website appears to have been created in early June."
https://therecord.media/new-pro-ukraine-hacker-group-custom-ransomware-russia
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
"Unit 42 responded to an incident where a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransomware attack. The agents breached the company's security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal. The impact was at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks."
https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
EtherHiding In The Browser: ClickFix Chain Ends In Amatera
"Netskope Threat Labs has been tracking a WordPress mass-compromise campaign affecting hundreds of sites. On each one, a rogue must-use plugin registers a Service Worker in the visitor’s browser. That worker strips the site’s Content-Security-Policy header and injects a script that reads its payload from a smart contract on Base. In turn, the smart contract serves a fake reCAPTCHA telling the visitor to paste a command into the Windows Run dialog. The campaign employs Service Worker persistence, EtherHiding on-chain payload delivery, fake reCAPTCHA, and ClickFix, also adding a disguised polyglot file, mshta abuse, a fileless PowerShell stage, an image-hidden loader, and finally the Amatera password stealer. That is a lot of technique for one password stealer."
https://www.netskope.com/blog/etherhiding-in-the-browser-clickfix-chain-ends-in-amatera
Trapping a Mustang Panda
"As of mid-2026, IBM X-Force continues to monitor cyber campaigns conducted by ITG27, a China-aligned state-sponsored espionage group whose victims align with China’s regional strategic interests. In collaboration with Deception.Pro, X-Force captured live ITG27 activity in simulated enterprise environments, including the deployment of a previously undiscovered VNC-capable backdoor named Havencode. The observed activity extends a campaign previously reported by Acronis, where ITG27 targeted India’s energy sector and government organizations. This campaign relied on the use of Claimloader malware, lure documents, and the Toneshell backdoor. The campaign coincides with intensifying China-India competition over regional hydropower and India’s expanding strategic relationships with partners such as Taiwan."
https://www.ibm.com/think/x-force/trapping-a-mustang-panda

Breaches/Hacks/Leaks

Dropbox Accounts Breached Through Lenovo Email Verification Flaw
"Dropbox is warning some users that an unauthorized party accessed their accounts by exploiting a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs. Although some affected users did not have Lenovo accounts, the cloud-storage provider said it uses Lenovo Identity Provider Services as part of its authentication infrastructure. This allows users to log into Dropbox accounts using verified Lenovo IDs. According to the notification sent to impacted users, the unauthorized access was possible due to "an issue with Lenovo's email verification process," which "allowed an unauthorized party to register a Lenovo ID using your email address.""
https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/
FBI Probes Service Selling 153M+ Drivers Licenses
"A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images."
https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
https://www.malwarebytes.com/blog/news/2026/09/dark-web-site-puts-153-million-drivers-licenses-and-millions-more-ids-up-for-sale
Hackers Expose Donor Data From Russian Fundraisers For Ukrainians, Political Prisoners
"Hackers reportedly gained access to payment accounts used by two Russian fundraising projects supporting Ukrainians and political prisoners, exposing donor email addresses and limited payment card information. The unknown threat actor targeted Davayte, which raises money for civilians in Ukraine affected by Russia’s invasion, and You Are Not Alone, a project supporting Russian political prisoners and their families."
https://therecord.media/hackers-russia-fundraisers-ukraine

General News

Communicating Under Pressure: Best Practices For Service Providers
"Developed by CISA, the Federal Bureau of Investigation, and international partners, this guidance describes how organizations can plan and execute clear, timely, accurate, and audience-appropriate communications during IT and operational technology (OT) outages. Whether caused by cyber threat actors, human error, equipment failure, or natural hazards, service outages can create disruption and societal panic even without speculation from end users and the public as added factors. Outages at one organization may cascade across interconnected systems, increasing uncertainty and alarm. The guidance emphasizes clarity, accountability, and transparency as core principles and details key elements of effective crisis messaging to inform affected stakeholders and the public while aligning with legal requirements, operational security, law enforcement, and containment efforts."
https://www.cisa.gov/resources-tools/resources/communicating-under-pressure-best-practices-service-providers
https://www.cisa.gov/sites/default/files/2026-09/joint-guidance-communicating-under-pressure-508c.pdf
Russian National Indicted For Exploiting Online Platform Used For Freelance Employment And Distributing Malware To Thousands Of Victim Users Worldwide For Financial Gain
"A federal grand jury has indicted Searzhudin Tamirlanovich Aktulaev on charges of Conspiracy, Transmission of a Program, Information, Code, and Command to Cause Damage to a Protected Computer, and Aggravated Identity Theft, among other offenses. Defendant was arrested in Cyprus in May 2025 and has been extradited to the United States. Yesterday, he made his initial appearance in federal court in San Francisco, and he was remanded to federal custody."
https://www.justice.gov/usao-ndca/pr/russian-national-indicted-exploiting-online-platform-used-freelance-employment-and
https://www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/
https://thehackernews.com/2026/09/extradited-russian-hacker-faces-charges.html
https://therecord.media/russian-national-facing-20-years-malware-campaign
https://www.infosecurity-magazine.com/news/russian-man-extradited-malware/
Global Public-Private Operation Disrupts Sality Botnet Active For Two Decades
"An international operation supported by Europol has disrupted the Sality peer-to-peer (P2P) botnet, a long-running criminal infrastructure used to distribute malicious payloads to thousands of infected computers worldwide. The coordinated action, carried out on 31 August 2026 and led by the US authorities, targeted a botnet believed to have been operating for more than two decades. At its peak, the botnet gave its operator access to up to one million infected machines worldwide. To date, more than 11 million unique IP addresses have been linked to the infrastructure, which could be used to distribute malicious payloads to compromised devices."
https://www.europol.europa.eu/media-press/newsroom/news/global-public-private-operation-disrupts-sality-botnet-active-for-two-decades
https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html
https://www.bleepingcomputer.com/news/security/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/
https://therecord.media/sality-botnet-cyber-doj
https://www.bankinfosecurity.com/global-public-private-action-disrupts-russia-linked-sality-botnet-a-32732
https://cyberscoop.com/sality-botnet-dismantled/
https://www.securityweek.com/23-year-old-sality-p2p-botnet-disrupted/
https://www.helpnetsecurity.com/2026/09/02/sality-botnet-disruption-crowdstrike-law-enforcement/
AI Gives Cybercriminals a Dangerous Time Advantage
"Brett Johnson has seen cybercrime from both sides. Once dubbed the "original Internet Godfather" by the US Secret Service, Johnson built and ran Shadow Crew, an early organized cybercrime community, before eventually leaving that life behind. Now, he works with law enforcement and businesses to help defend against the kinds of threats he once deployed. In this conversation with Dark Reading's Kristina Beek, Johnson shares what he spoke about at Black Hat USA in Las Vegas alongside Illumio, demonstrating how artificial intelligence (AI) can compress the time it takes to carry out an attack."
https://www.darkreading.com/threat-intelligence/ai-gives-cybercriminals-dangerous-time-advantage
AI’s Vulnerability Surge May Be More Manageable Than First Feared
"A new study suggests that while AI is rapidly accelerating vulnerability discovery, enterprise organizations are better equipped to handle the surge than generally assumed. The key is their ability to quickly validate findings, prioritize risk and get available fixes into production. Software supply chain security firm Echo recently analyzed nearly 40,000 CVE life cycles across 250 open source container projects, drawing on a year of its own platform telemetry, survey responses from more than 80 security leaders, and an independent analysis of Anthropic's Claude Mythos."
https://www.darkreading.com/application-security/ai-vulnerability-surge-manageable-than-first-feared
The Industrialization Of Cybercrime In Africa
"INTERPOL’s newly released African Cyberthreat Assessment Report 2026 highlights a defining shift in the threat landscape: Cybercrime has evolved from isolated incidents into an industrialized, borderless ecosystem. That conclusion closely aligns with FortiGuard Labs’s global observations and forecasts for 2026. Criminal groups now operate as coordinated enterprises rather than just individual threat actors, supported by specialized service providers, shared infrastructure, automated tools, and mature supply chains."
https://www.fortinet.com/blog/industry-trends/the-industrialization-of-cybercrime-in-africa
https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-finds-AI-linked-to-more-than-half-of-cybercrime-in-Africa
A Battery Storage Cyberattack Would Look Exactly Like a Badly Tuned Controller
"Batteries connected to the grid make money by reacting to frequency, pushing power out when it sags and soaking it up when it rises. A few hundred of them moving together, on command from someone who should not have the command, would look the same on a control room screen right up to the moment the network starts disconnecting customers. Rafael Narezzi, chief executive of the London firm Centrii, puts the number needed at 1,500 units in Texas, 5.4 percent of the ERCOT fleet, and 400 units in Great Britain, about 29 percent of the fleet there."
https://www.helpnetsecurity.com/2026/09/02/grid-battery-storage-cyberattack/
National Life Group CISO Expects More Vulnerabilities In Six Months Than In Thirty Years
"In this Help Net Security interview, Becky Palmer is VP and CISO at National Life Group, answers five questions about defending against AI-driven attacks. The discussion covers why patch cycles built for human speed cannot keep up, and which compensating controls buy time when an immediate fix is not possible. It includes numbers from agentic AI in the security operations center, where four of five cases close without human escalation. The rest looks at questions that separate a working AI product from a wrapper, contract terms for third-party AI use, and three steps smaller banks and carriers can take in 90 days."
https://www.helpnetsecurity.com/2026/09/02/becky-palmer-national-life-group-ai-driven-cyber-threats/
Scareware Ads Keep Running On Google’s Transparency Tool, Even After They’re Reported
"A team of NYU and Radboud University researchers spent a year building a tool to find deceptive software ads inside Google’s public ad archive. It works. It also exposed something more uncomfortable: reporting a bad ad to Google doesn’t mean the ad, or the domain behind it, stops running. The tool is called AdLens, and it comes out of a study that mined Google’s Ads Transparency Center, a public database Google built to satisfy transparency rules like the EU’s Digital Services Act."
https://www.helpnetsecurity.com/2026/09/02/google-scareware-ads-research/
https://racro.github.io/papers/adlens.pdf
Anthropic’s Enterprise Frontier Safeguards Lets Your Claude Logs Stay In Your Cloud
"Eight members of the Analysis and Resilience Center for Systemic Risk, a group whose roster includes the CISOs of Goldman Sachs, Morgan Stanley, Citi, Bank of America, and Wells Fargo, spent months working with Anthropic on a question their examiners care about more than benchmark scores. Scott DePasquale, the center’s president and chief executive, said those eight defined “what it would take to run the most capable frontier models inside a systemically important bank: who holds the data, who holds the keys, what automated review can and cannot see, and under what conditions a human is ever permitted to look.”"
https://www.helpnetsecurity.com/2026/09/02/anthropic-enterprise-frontier-safeguards/
An AI CAPTCHA Solver Talked Itself Out Of The Right Answer
"You have probably spent a few seconds of your life turning a picture until it lines up. Some sites, instead of asking you to tick a box, show you a circular chunk of a photo that has been spun around, and you drag it until the inside matches the ring around it. Simple enough. Annoying enough. Two researchers at Bern University of Applied Sciences wrote a script that solves one of those in 0.006 seconds. It uses circle-detection math from the 1970s and a signal-matching technique that predates everything currently being called AI. It got all ten test puzzles right, every time, faster than you can blink."
https://www.helpnetsecurity.com/2026/09/02/ai-captcha-solver-research/
https://arxiv.org/pdf/2608.28794
Scammers Are Getting Smarter About Where They Target You
"Scammers are becoming more strategic about where they target people. Nine in ten toll scams—the fake unpaid-toll messages that threaten fines or license suspension—arrive by email or text, while roughly six in ten romance scams show up first on social media. That’s no coincidence. Rather than blasting the same message everywhere, criminals are tailoring different scams to the platforms where they’re most likely to succeed. This finding comes from Malwarebytes’ own threat research systems and draws on global data between April 15 and July 14, 2026. The research reveals the various ways scammers are adapting their tactics and provides new insights about where they show up, when they strike, and which brands they impersonate."
https://www.malwarebytes.com/blog/scams/2026/09/scammers-are-getting-smarter-about-where-they-target-you
Google, Anthropic, And OpenAI Unveil Cyber AI Models, Safeguards, And Access Programs
"Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program. "The Fairwind Program gives high-priority defenders (like governments, healthcare providers, and telecommunications services) early access to advanced models that help them build better defenses, before new threats arrive," Google said. "So defenders have an early advantage, to help them protect vital infrastructure – which in turn protects people who rely on those systems.""
https://thehackernews.com/2026/09/google-anthropic-and-openai-unveil.html
OpenAI’s Astra Crosses ‘Critical’ Cyber Threshold After Finding Zero-Days
"OpenAI said its newest model, Astra, has reached the ‘Critical’ cybersecurity capability level under the company’s Preparedness Framework, the first time any of its models has been placed in that category. The designation applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems, or carry out a complete cyberattack against a hardened target from only a high-level instruction. OpenAI said the classification requires additional safeguards before the model can be released."
https://www.securityweek.com/openais-astra-becomes-first-model-to-cross-critical-cybersecurity-threshold/
https://securityaffairs.com/198317/ai/openai-astra-brings-autonomous-zero-day-exploitation-to-ai.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)