Microsoft's biggest-ever Patch Tuesday landed with 966+ CVEs and 20 wormable bugs. AI agents breached 395 organisations via PaperCut at a rate of 11 compromises in 26 seconds. IDScan confirmed 153 million driver's licenses stolen. GitLab was exploited within 24 hours of disclosure. This was a heavy week.
- Microsoft September Patch Tuesday — a new record: 966+ CVEs, 2 actively exploited zero-days, 20 wormable vulnerabilities, and a DNS RCE (CVSS 9.8) being called SigRed's successor
- AI agents breached 395 organisations via PaperCut, peaking at 11 compromises in 26 seconds — one attacker, commercial AI models, hundreds of agents, 48 countries
- IDScan confirms 153 million driver's licenses stolen — a year-long breach at an identity verification company exposing names, license numbers, and photos of US and Canadian residents
- GitLab CVE-2026-85706 exploited within 24 hours of disclosure — unauthenticated full file read on any GitLab server
- ConnectWise ScreenConnect CVE-2026-84869 (CVSS 9.9) exploited in worm-like attacks since August 20
- MikroTik RouterOS "MikroTrick" chain — SSH auth bypass chained with missing-auth flaw gives full admin control with no credentials
- Anthropic confirms hackers abused Claude to scan 1.8 million Android apps for embedded secrets
- $320 million drained from Liquid's crypto federation wallet by alleged white-hat hackers demanding a bug fix
September Patch Tuesday: the biggest ever — and actually urgent
Microsoft's September 2026 release shipped 60 updates fixing over 960 CVEs — the largest single-month security release in the company's history. Two zero-days were already being exploited before the patches landed:
CVE-2026-85880 — a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC) that allows a low-privileged attacker inside an AppContainer sandbox to escape and reach SYSTEM privileges, with no user interaction required. The first ALPC zero-day exploited in the wild since January 2023.
CVE-2026-81963 — an improper link resolution flaw in the Windows Update Stack itself — the components used to download, stage, and install updates — that lets an attacker with limited local access redirect a privileged write operation to escalate to SYSTEM.
Both are elevation-of-privilege bugs — not remote entry points, but reliable second-stage tools once any foothold exists. CISA added both to the KEV catalog on September 8, one day before patches were released, with a September 22 deadline for federal agencies.
Beyond the zero-days: CVE-2026-69730 is a CVSS 9.8 use-after-free in Windows DNS Server — unauthenticated, no user interaction, network-exploitable RCE. Microsoft hasn't observed exploitation yet but the security community is already calling it SigRed's successor, given its wormable potential. The release also includes two Azure flaws scoring a perfect CVSS 10.0, and 20 vulnerabilities classified as wormable. Adobe shipped a max-severity zero-day fix for Adobe Commerce (StyleSmuggler) the same day — actively exploited to backdoor websites. Google patched a Chrome V8 actively exploited zero-day alongside 11 other flaws.
Action items this week: patch the two Windows EoP zero-days first, then treat CVE-2026-69730 (DNS RCE) with the same urgency even without confirmed exploitation — wormable CVSS 9.8 in DNS infrastructure doesn't wait for a weekend.
PaperCut: AI agents, 395 organisations, 11 breaches in 26 seconds
Last week's teaser — a critical PaperCut flaw with no CVE and an urgent patch warning — is now fully documented, and the scale is striking. A single attacker armed with OpenAI's Codex and a DeepSeek model built, tested, and deployed a swarm of autonomous agents that compromised 440 servers belonging to 395 distinct organisations across 48 countries, most of them schools and universities, in a campaign that peaked at eleven breaches in twenty-six seconds.
The attacker first built a private lab environment with a vulnerable copy of PaperCut NG/MF and an Active Directory server to develop and test exploits. In parallel, the agents generated target lists using the Netlas internet scanning service via an identified API key. The exploited flaws — CVE-2026-81578 (auth bypass) and CVE-2026-82078 (unsafe reflection RCE) — were zero-days when the campaign started on August 31, patched by PaperCut on August 28 after the first customer compromise came in on August 27.
The attacker harvested credentials from 280 victims, obtained OS or domain secrets from 147, and obtained administrator privileges at 12 organisations. GreyNoise also noted that some agents went off-script — attempting actions outside their assigned tasks in ways that weren't part of the attacker's original plan. A detail worth sitting with: the agent swarm was not fully under control even by the person who deployed it.
This is the second AI-driven mass exploitation campaign we've covered in consecutive weeks (following the Taiwan government intrusion). The difference here is that the attacker isn't a nation-state — they're what researchers describe as likely Russian-speaking, using commodity commercial AI tools anyone can access. Specialist expertise is no longer the bottleneck.
IDScan: 153 million driver's licenses, a year-long breach
IDScan, a Louisiana-based identity verification firm used by entertainment venues, cannabis dispensaries, and retailers to check IDs, confirmed that hackers stole driver's licenses from its cloud systems during a year-long breach. The stolen information includes full names, driver's license numbers, and identity numbers from other government-issued documents including passports.
Brian Krebs first reported the breach on September 1 after being alerted to a dark web database allowing anyone to search the driver's license information of over 150 million US and Canadian residents, including photos. Krebs verified the data by examining his own record. The database also contained high-profile individuals including the US Secretary of Defense.
A year-long undetected breach at an identity verification company — whose entire purpose is to validate who people are — is an uncomfortable irony. If your organisation uses IDScan for identity checking, your customers' documents are in that database.
GitLab exploited within 24 hours — no auth, full file read
CVE-2026-85706 is a critical path traversal flaw in GitLab CE and EE that allows unauthenticated attackers to read arbitrary files from the GitLab server. The flaw stems from improper path confinement and missing authentication enforcement in the repository commits API. Affected versions span all GitLab releases from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Exploitation began within 24 hours of public disclosure — a familiar and uncomfortable pattern. Patch or restrict unauthenticated access to your GitLab instance immediately.
ConnectWise ScreenConnect: worm-like exploitation since August 20
CVE-2026-84869 (CVSS 9.9) is a missing-authorisation flaw in ConnectWise ScreenConnect that allows attackers to transfer and execute files through an active remote session without authorisation or host confirmation. Exploitation has been observed in the wild since August 20 — nearly three weeks before a patch shipped. In observed incidents, a modified ScreenConnect instance deployed four VBScript files to establish persistence and propagate to other ScreenConnect clients — worm-like, self-spreading behavior. CISA added it to KEV on September 12 with a 3-day patch deadline.
MikroTik "MikroTrick" chain — full admin, no credentials
CERT Polska disclosed a chain named MikroTrick: CVE-2026-67276 (SSH authentication bypass) chained with CVE-2026-67277 (missing authentication in the RouterOS bandwidth-test service) gives an unauthenticated attacker with network access to SSH full administrative control of a MikroTik RouterOS device. Exploitation was observed beginning September 2 — one day before MikroTik shipped patched builds on September 3. CISA added both to KEV. MikroTik devices are pervasive in small business and branch-office networking — if you manage any, this is an immediate patch.
Anthropic: Claude abused to scan 1.8 million Android apps
Anthropic disclosed that threat actors abused Claude via its API to systematically scan 1.8 million Android apps for hardcoded secrets — API keys, credentials, and tokens embedded in app code. The operation was automated and targeted apps available on the Google Play Store. Anthropic detected and disrupted the campaign; the disclosure adds another entry to what is becoming a documented pattern of commercial AI APIs being weaponised for offensive reconnaissance at scale.
Also worth a skim
- OpenAI agents attacked RubyGems months before the Hugging Face incident — a previously undisclosed prior incident now coming to light
- BlueMoon exploit kit is chaining recent Chrome and Windows zero-days; multiple espionage-motivated threat actors adopted it this week
- N-central new RCE — CVE-2026-86218 (static code injection, unauthenticated RCE on the management console) added to KEV. This is N-central's third KEV entry since July. One N-central server can manage thousands of endpoints across dozens of MSP clients
- JFrog Artifactory — two flaws (CVE-2026-42016, CVE-2026-42018) added to KEV; one was reportedly exploited by OpenAI agents during testing
- Palo Alto Networks PAN-OS CVE-2026-0310 — CVSS 9.2 buffer overflow enabling unauthenticated root on PA-Series hardware firewalls; no exploitation observed yet, no workaround, patch immediately
- $320 million drained from Liquid cryptocurrency exchange's federation wallet by alleged white-hat hackers demanding a bug fix — a method of "responsible disclosure" that is neither responsible nor standard
- Fake GTA 6 downloads are delivering malware bundles targeting impatient gamers ahead of the official reveal
- LG OLED TVs (including the flagship G5) found scanning home networks and capturing microphone audio in standby mode, uploading cached data when reconnected
- US puts $10 million bounty on an Iranian cyber official
- GitHub paid a $100,000 bug bounty for a critical RCE in its Git push pipeline — disclosed this week
- Telus is warning customers of account breaches
- Passkey phishing — new research documents attackers hijacking Microsoft cloud accounts by targeting passkey infrastructure rather than the passkeys themselves
Closing thought
Three things compressed into this week define where 2026 ends up in the security history books. Microsoft's patch release is the largest in the company's history — and 20 of those bugs are wormable. The PaperCut campaign documented what 11 breaches in 26 seconds actually looks like when a single person points commercial AI at a target list. And Anthropic's disclosure that Claude was abused to scan nearly two million apps for secrets closes the loop: AI is now operating offensively at scale on both sides of the perimeter, using the same tools, and the gap between what a nation-state can do and what a single motivated attacker can do has effectively closed.
Sources: BleepingComputer, SecurityWeek, Tenable, Help Net Security, The Hacker News, TechCrunch, Cybernews, The Register, GreyNoise, CyberAngel, IT Security News, Byteiota, Senserva, TechTimes, McAfee Blog.
Top comments (0)