Daily cybersecurity intelligence digest from CyberNetSec.io - September 13, 2026
📊 8 threat intelligence reports covering vulnerabilities, exploits, threat actors, and security advisories.
1. BlueMoon Exploit Kit Used by Four Spy Groups in Attacks
At least four distinct state-aligned espionage groups, including China-linked Violet Typhoon, are leveraging a new exploit kit called 'BlueMoon'. The kit chains two Google Chrome zero-days (CVE-2026-85046, CVE-2026-87491) and a Windows zero-day (CVE-2026-85880) to achieve remote code execution and full system compromise. The rapid, widespread adoption of this tool across different threat actors suggests a shared, possibly rushed, deployment to exploit the vulnerabilities before patches were widely applied. Targets include NGOs, aerospace, and manufacturing firms in the U.S. and Vietnam. CISA has added all three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
2. Anthropic CEO Warns of AI Risks, Calls for Slowdown
Dario Amodei, CEO of AI firm Anthropic, has publicly called for the AI industry to slow its development pace due to escalating safety concerns. He warned that without a pause, AI could develop the capability to "take over the entire internet" within 6 to 12 months. Amodei's call is supported by other industry leaders like OpenAI's Sam Altman and xAI's Elon Musk. The warning follows recent AI safety incidents and public resignations from concerned employees, highlighting a growing anxiety about the potential for catastrophic outcomes from increasingly powerful and unpredictable AI models.
3. CISA KEV Catalog Adds Five Exploited Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch them on a tight deadline. The flaws affect JFrog Artifactory (CVE-2026-42016, CVE-2026-82329), ConnectWise ScreenConnect (CVE-2026-84869), and MikroTik RouterOS (CVE-2026-67277, CVE-2026-86060). These vulnerabilities pose significant risks, including remote code execution and administrative control, and CISA urges all organizations to prioritize remediation.
4. GitLab CVSS 10.0 Flaw Exploited in the Wild
GitLab is urging users of self-managed instances to immediately patch a critical path traversal vulnerability, CVE-2026-85706, which holds a maximum CVSS score of 10.0. The flaw allows unauthenticated attackers to read arbitrary files on the server, including credentials and source code. Active scanning and exploitation attempts were detected just one day after GitLab released patches. CISA has added the vulnerability to its KEV catalog, mandating a short patching deadline for federal agencies due to the high risk of widespread, indiscriminate attacks.
5. Ransomware Disrupts Texas Water Treatment Plant
A ransomware attack has disrupted operations at a water treatment facility in Texas, highlighting the vulnerability of critical infrastructure. The attack is believed to have originated through a compromised third-party vendor, demonstrating the persistent threat of supply chain attacks against operational technology (OT) environments. While details on the specific ransomware group are pending, the incident follows a pattern of increasing cyberattacks against U.S. water systems and has prompted an investigation by local and federal authorities to restore services and assess the impact.
6. Microsoft Uncovers AI-Assisted BEC Invoice Fraud
Microsoft has uncovered a large-scale business email compromise (BEC) campaign that used generative AI to impersonate CEOs and trick employees into making fraudulent payments. The attackers sent over a million emails in just three days, targeting U.S. companies in IT, real estate, and manufacturing. The campaign was highly sophisticated, using AI-generated email templates, impersonation domains, trusted email infrastructure, and forged email chains to create a convincing narrative for an urgent invoice payment. This marks a significant evolution in BEC attacks, leveraging AI for speed, scale, and believability.
7. Siemens PLC Vulnerability Risks Industrial Control Systems
Siemens has patched a critical vulnerability, CVE-2026-12345, in its widely used SIMATIC S7 series Programmable Logic Controllers (PLCs). The flaw could allow an unauthenticated attacker to gain remote access to industrial control systems, potentially causing severe operational disruption in sectors like manufacturing, energy, and water treatment. This disclosure follows a recent U.S. government warning about active threats targeting these same PLCs. Asset owners are urged to apply the patches immediately and ensure their OT environments are not exposed to the internet.
8. Check Point Patches Critical CVSS 9.8 VPN Flaws
Check Point has released patches for two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, affecting its VPN and security management products. Both flaws are rated with a CVSS score of 9.8 and could allow a remote, unauthenticated attacker to execute arbitrary code. The vulnerabilities involve improper certificate validation and a heap-based buffer overflow during VPN negotiation. While there is no evidence of active exploitation, the flaws affect high-value, internet-facing targets like security gateways. Admins are strongly urged to apply the provided hotfixes immediately.
📌 Subscribe to daily updates at CyberNetSec.io
All reports include detailed analysis, IOCs, mitigation strategies, and references.
Top comments (0)