Hello, stay ahead with CISO Brief 🚀

Every day the cybersecurity world moves fast — new incidents, evolving AI risks, changing regulations, and critical vendor updates. We cut through the noise to deliver only what matters most for your business and security strategy.

CISO Brief brings you a daily digest of high-signal news: major breaches, hyperscaler security releases, AI and compliance shifts, and the latest threat intelligence — all in one concise update.

Built for CISOs, CTOs, and architects, our goal is to save you time, reduce distraction, and keep you always on pulse with the risks and opportunities that shape tomorrow.

👉 Join our Telegram channel for your daily update — stay informed, stay ready.

Cybersecurity News Digest — Daily Briefings

Latest News

all posts →

September 24, 2026

MacSync uses iCloud calendars to load payloads

📌 A new MacSync variant for macOS now leverages public iCloud calendar events to deliver follow-on payloads. Kaspersky found the Swift-based infostealer being distributed via ClickFix-style social engineering and fake apps, with a downloader extracting commands from calendar DESCRIPTION fields to fetch archives hosted on iCloud. The malware retains broad credential-stealing capabilities and added an Objective-C backdoor that persists via LaunchAgents, .zshrc changes, and Git hooks.

Infostealer ClickFix Malware Persistence

September 24, 2026

WordPress critical RCE flaw patched; rapid attacks follow

🔒 WordPress released a security update fixing a critical remote code execution vulnerability (CVE-2026-87902) that allows unauthenticated attackers to include and execute readable local PHP files outside active theme directories. The flaw, reported by researcher Robert Ressl, has been backported to versions as far back as 4.7 and has already seen exploitation in the wild. Security firms observed reconnaissance within hours and active payload delivery within a day, prompting urgent calls for fast, verified patch rollouts and increased visibility of forgotten WordPress instances.

Remote Code Execution Zero-Day Exploitation Active Exploitation Vulnerability Disclosure

September 24, 2026

Carbonato malware hijacks exposed Docker hosts

🛡️ A new botnet named Carbonato targets unsecured Docker daemons to install the Hermes Agent AI framework and seize control. Researchers from Malwarebytes ThreatDown found evidence from October 2024 to August 2026 showing worm-like spreading via unauthenticated Docker APIs on port 2375. The malware launches privileged containers, opens reverse SSH tunnels, installs operator keys, and establishes persistence mechanisms while reporting deployments over Telegram.

Docker Botnet Malware Container Escape

September 24, 2026

Google Named a Leader in 2026 Container Management

🚀 Google Cloud was named a Leader in the 2026 Gartner® Magic Quadrant™ for Container Management, ranking highest for Ability to Execute. The accompanying Gartner Critical Capabilities report placed Google Cloud first across all evaluated use cases, including AI training and inference. Google highlights recent GKE and Cloud Run innovations—like predictive latency boosts, rapid startup times, serverless GPU scale-to-zero, and Agent Substrate/Sandbox—to support enterprise and AI workloads at scale. The post invites users to try the open-source Agent projects and explore Cloud Run and GKE enhancements.

Google Cloud Google Kubernetes Engine Cloud Run Agentic AI

September 24, 2026

AWS Lambda Durable Functions Reach European Sovereign Cloud

🛡️ AWS Lambda durable functions are now available in the AWS European Sovereign Cloud, enabling developers to build reliable multi-step applications and AI workflows within the Lambda developer experience. These functions introduce primitives like step and wait to checkpoint progress, recover from failures, and pause executions without incurring on-demand compute charges. Support covers new Python (3.13, 3.14), Node.js (22, 24), and Java (17+) runtimes, and activation is possible via the AWS Lambda API, Console, SDKs, and IaC tools such as AWS CloudFormation, AWS SAM, and AWS CDK.

AWS Lambda AWS Serverless Security

September 24, 2026

Unpatched OnePlus flaws let installed apps gain root

🔒 A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app that requests no special permissions. Researcher Rasmus Moorats chained two vendor services to gain root: one that accepts arbitrary calls and injects text into system commands, and another that executes shell instructions when invoked as root. OnePlus confirmed the flaws in May, claimed exclusive control over disclosure, and had not released a patch when Moorats published on September 24.

Privilege Escalation Authentication Bypass Mobile Security Vulnerability Disclosure

September 24, 2026

Trust Risks in Consultancy Scams and AI Malware

🔍 In this Threat Source briefing, Talos warns practitioners about social engineering that leverages flattering offers — such as paid consultancy or fake recruitment — to coax security professionals into abusing trusted access. The piece describes a staged consultation that escalates to requests for internal insights and special reports, and highlights emerging AI-integrated malware research from Talos. It outlines CAIRN, an open-source toolkit for hunting AI artifact tradecraft, and summarizes recent threats and notable incidents.

Talos AI Security Insider Threat

September 24, 2026

Weekly ThreatsDay: AI Search Poisoning and Malware

🛡️ This ThreatsDay bulletin outlines a steady stream of deceptively mundane threats leveraging AI, poisoned trusted paths, and social engineering to bypass defenses. Highlights include an AI-assisted Android banking trojan, AI code privacy concerns from Z.ai, and FBI/CISA guidance on ICS integrator access. Also covered are super-app surveillance findings, browser-in-the-browser phishing, novel EDR evasion, and large-scale AI search poisoning campaigns targeting major brands.

AI Security Malware Phishing Threat Report

September 24, 2026

Exposed GitLab email tokens enable malicious pushes

📧 Researchers found that private GitLab incoming-email addresses, generated by the Email work item to this project feature, are being published in public READMEs and guides. These addresses include long-lived tokens that let anyone create issues or merge requests if they modify the address suffix, potentially bypassing IP restrictions. Aikido reported instances affecting popular open-source projects and urges token resets and removal from public docs.

GitLab Secret Exposure API Abuse Token Theft

September 24, 2026

GKE agentic migration for safer cloud modernizations

🔧 Google Cloud released the open-source GKE agentic migration plugin to simplify migrations from AWS EKS to Google Kubernetes Engine. The tool combines LLM-driven translations with deterministic server-side validation and GitOps PR workflows to avoid direct changes to live clusters. It persists long-running migration state for multi-persona handoffs and produces runbooks for stateful transport, enabling human-in-the-loop approvals and safer, auditable migrations.

Google Kubernetes Engine Agentic AI DevSecOps

September 24, 2026

September 2026 Microsoft Security updates and features

🔒 This post summarizes September 2026 security updates across Microsoft Security, highlighting new controls for local AI agents, expanded Zero Trust for agentic traffic, and SOC improvements. It covers AI-powered detonation summaries for emails, Purview and Entra integration for data protection, Purview auto-labeling and eDiscovery enhancements, data lifecycle management for SharePoint, and new GCC High capabilities for Intune and PKI.

Microsoft Agentic AI Zero Trust

September 24, 2026

Storm-2570: Cross-ecosystem ransomware tradecraft

🔍 Microsoft details activity attributed to the Storm-2570 ransomware affiliate, showing how the actor operates across multiple RaaS ecosystems (Qilin, DragonForce, Anubis, BERT) while using consistent post-compromise tooling and techniques. The report highlights repeated use of remote management software like MeshAgent, tunneling utilities, credential theft tools, lateral movement methods, and cloud exfiltration utilities. It emphasizes analyzing actor behavior across the attack chain to detect and disrupt intrusions before payload deployment, and provides detection and defense recommendations.

Ransomware Lateral Movement

September 24, 2026

Scribd scales document classification with Gemini

📄 Scribd, Inc. used Gemini Enterprise to classify over 400 million user-uploaded documents (12+ billion pages) across Scribd and SlideShare. Native PDF input allowed more than 99% of the corpus to be processed without OCR or rendering, and batch prediction at a 50% discount made large-scale LLM classification economically viable. Google Cloud partnered on planning and scaling throughput, enabling the backfill to complete in months and converting the process into a continuous pipeline.

Google Gemini AI Application Security

September 24, 2026

Amazon RDS Adds Post‑Quantum TLS for PostgreSQL

🔐 Amazon RDS for PostgreSQL now supports post-quantum TLS (PQ-TLS) key exchange to provide post-quantum cryptography options for data in transit. RDS for PostgreSQL versions 18 and higher allow modification of the ssl_groups parameter so administrators can pick cryptographic groups from the RDS allow list. Customers can deploy or update managed PostgreSQL instances through the Amazon RDS Console or the AWS CLI to enable these options.

AWS RDS Post-Quantum Cryptography Encryption in Transit

September 24, 2026

Amazon RDS MySQL extended support for minors

🔔 Amazon RDS for MySQL announces Extended Support minor releases 5.7.44-rds.20260902 and 8.0.46-rds.20260908. RDS Extended Support offers up to three extra years of fixes for critical CVEs and bugs beyond standard support end dates. Customers can upgrade using Blue/Green Deployments, in-place upgrades, or restore from snapshots, and migrate with AWS Database Migration Service.

AWS RDS Patch Management

September 24, 2026

Amazon RDS Adds PostgreSQL 19 Beta 4 Preview

🚀 Amazon RDS now offers PostgreSQL 19 Beta 4 in the Amazon RDS Database Preview Environment, enabling evaluation of the pre-release on RDS. This beta refines query performance and autovacuum management, fixes TOAST table reporting in pg_stat_autovacuum_scores, and rebalances parallel autovacuum cost limits. Preview instances persist up to 60 days, snapshots are limited to the Preview Environment, and standard dump/load tooling is supported.

AWS RDS AWS Product Update

September 24, 2026

Microsoft adds integrated SOC features to Defender

🔒 Microsoft now offers Integrated Security Operations Center (ISOC) capabilities inside Microsoft Defender for Microsoft 365 E5 and E7 customers at no extra license cost during public preview. ISOC combines SIEM-like functions with Defender XDR, threat intelligence, automation and AI in a single portal, and ingests Microsoft product logs without charges. From Oct. 1, third-party data ingestion will be metered at $2.40 per GB, and more advanced features require an ISOC workspace and Azure subscription.

Microsoft Microsoft Defender XDR Microsoft Sentinel SOC

September 24, 2026

Placeholder domains weaponized to deliver ClickFix lures

🛡️ Manifold Security discovered that the documentation placeholder domain third-party[.]com has been registered and weaponized to serve a ClickFix social engineering lure for Windows visitors while showing benign decoys to others. The domain, referenced in over 1,700 public GitHub repositories, poisons the clipboard and prompts users to paste and run a command that fetches a remote PowerShell payload. It has been flagged as malicious on VirusTotal and Google Safe Browsing, and the researchers found a further 13 non-reserved placeholder domains being abused to serve scams and scareware to macOS users.

ClickFix Phishing