Hello, stay ahead with CISO Brief 🚀

🔒 Google released September 2026 security patches for Pixel devices addressing 110 vulnerabilities, including one zero-day actively exploited in targeted attacks. The high-severity issue, CVE-2026-58704, is a modem component authorization flaw that can allow adjacent-network attackers with basic privileges to escalate privileges without user interaction. Pixel users should install the update via Settings and restart devices to complete the patch.

🔒 Wordfence has observed active exploitation of a critical vulnerability (CVE-2026-27540) in the premium WordPress plugin WooCommerce Wholesale Lead Capture, enabling unauthenticated attackers to upload arbitrary files and achieve remote code execution. The flaw affects versions up to 2.0.3.1 and has prompted over 100,000 blocked exploit attempts since June 2026. Site owners should inspect for unexpected .php files and suspicious admin-ajax requests referencing the "wwlc_file_upload_handler" action.

⚠️ WSO2 users face active exploitation of CVE-2026-5430, a critical JWT signature verification flaw that enables account takeover. Affected products include API Manager, API Control Plane, Traffic Manager, and Universal Gateway across several 4.x releases; fixes and update levels have been published. WatchTowr reports in-the-wild attempts capturing forged admin JWTs on September 13, 2026, and urges immediate patching to prevent unauthorized access and lateral movement.

🔒 AWS Security Token Service (STS) now enforces a single assembled session token size limit of 4,096 bytes, replacing the previous packed policy and token size limits. STS returns session token size and utilization in API responses, CloudWatch metrics, and CloudTrail events, and preserves PackedPolicySize for backward compatibility. A new MinimumSessionTokenSize parameter lets you generate larger tokens to test infrastructure limits; error handling remains unchanged with PackedPolicyTooLargeException used for over-limit tokens.

🧾 AWS Billing and Cost Management now includes a Detected Anomalies widget in BCM Dashboards, letting teams view cost anomalies alongside budgets, usage, and Savings Plans or Reserved Instance reports. The widget shows anomaly counts, cost impact relative to month-to-date spend, root cause, duration, and supports 30/60/90-day look-backs. Filters for severity, service, account, and region and direct links to the Cost Anomaly Detection console facilitate investigation. The widget is available in all commercial AWS Regions at no additional charge and supports exports, scheduled email reports, CSV/PDF downloads, and cross-account dashboard sharing.

🔒 Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. The flaw, designated CVE-2026-87886 with a 7.8 severity score, allows a low-privileged attacker to elevate permissions on affected Linux servers. Acronis reports limited, targeted exploitation and urges administrators to apply patches that fix affected builds of the plugin and extension.

🔒 Cisco issued emergency fixes for a critical Secure Email Gateway vulnerability, CVE-2026-76461, that was being actively exploited. The flaw is an SQL injection in the product’s email parsing code and can lead to arbitrary SQL execution and root command execution. Patches are included in AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, and CISA has added the issue to its KEV catalog.

🔒 Amazon Cognito now supports multi-Region replication (MRR) to automatically replicate user pools across AWS Regions with near-real-time synchronization, built-in failover, and interoperable JWT sessions. Replica user pools support sign-in and token operations but are read-only for configuration and attribute writes, which must be performed in the primary Region. To use MRR you must configure a symmetric multi-Region AWS KMS customer managed key and consider adopting the updated multi-Region OIDC issuer to ensure consistent discovery and JWKS endpoints. Cognito supports automatic domain and OAuth failover via Route 53 health checks and recommends using infrastructure-as-code and JWKS caching strategies for smooth migration and operational continuity.

🔔 AWS Direct Connect now offers flat-rate monthly pricing for 10 Gbps and 100 Gbps dedicated connections, eliminating per-gigabyte data transfer out (DTO) charges within the chosen pricing tier. The model provides five geographic tiers from same-metro to global coverage and introduces an optional port-pair concept that provisions two redundant connections sharing the same bandwidth at no extra charge. Flat-rate pricing is available at all commercial AWS Direct Connect locations (excluding China Regions) and can be applied or changed per connection.

🛠️ AWS Billing Conductor now supports defining custom rate pricing and usage tiers for AWS services, enabling customers and partners to model negotiated commercial agreements more accurately. Using SKU-scoped pricing rules, users can enter exact rates and configure tier thresholds rather than applying percentage markups or markdowns to public on-demand rates. This feature is available in all commercial AWS Regions except the two China regions operated by Sinnet and NWCD. It simplifies pro forma billing configuration by providing precise control over pricing and tier breaks.

🆕 Amazon SageMaker now supports instance preference lists for training and processing jobs, letting you submit prioritized sets of instance types and counts so SageMaker can pick the first available configuration. This reduces wait times and removes the need for complex retry logic or multiple concurrent submissions during high-demand GPU periods. You can include on-demand sources or reserved SageMaker Flexible Training Plans, and the feature is available today in all AWS Regions via CLIs, APIs, SDKs, and the Console.

🔐 Google Cloud has rolled out a 16-hour default session length and expanded session management into a granular, Context-Aware Access (CAA) feature. Administrators can now configure session controls via Terraform, gcloud, and REST APIs for DevSecOps workflows. Policies can target Google Groups and specific applications like the Cloud Console, gcloud, and OAuth apps, and policy management is being integrated into the Google Cloud Console preview. These updates aim to reduce credential theft and account takeover risk while preserving developer productivity.

🔍 AWS CloudTrail now integrates with Amazon Q Console to let you investigate account activity using natural language queries. You can ask about CloudTrail configuration, search logged events for security investigations, and troubleshoot operational issues without writing queries. The integration queries CloudTrail trails, CloudWatch log groups, and event data stores to provide answers grounded in your account activity. It is available in all AWS commercial regions where Amazon Q Console is supported.

🔔 Amazon Connect Customer now lets contact center agents bid on preferred shifts, giving them greater control over schedules. Schedulers establish agent rankings via CSV upload or randomized generation, and Connect Customer uses forecasted demand and shift profiles to create available shifts for agents to rank. After the bidding window closes, the service assigns agents to their highest-ranked available shift, using rankings as tiebreakers to resolve conflicts. This feature aims to improve agent satisfaction and reduce manual scheduling effort.

🔧 This blog summarizes Google Cloud’s recommended “Verify→Investigate→Report→Resolve→Review” workflow for handling reliability incidents and advises preparing in advance by designing for failure, ensuring observability data, maintaining playbooks, and running drills. It distinguishes how to detect incidents via Personalized Service Health, Cloud Service Health, and observability tools, and provides guidance on scoping blast radius, diagnosing causes, and when to open and escalate support cases. It also covers mitigation steps while waiting for resolution and emphasizes blameless post-mortems to improve future response.

🛡️ Agent Substrate is now available on Google Kubernetes Engine (GKE). This open-source agent execution runtime is engineered for high-density sandboxing, delivering sub-500ms resume times and hundreds of suspend/resume activations per second with native kernel and network isolation. Optimized for GKE but portable to any Kubernetes cluster, it supports hardware-isolated microVMs or gVisor sandboxes and integrates with existing agent frameworks like Hermes, Claude Code, and OpenClaw.

🚀 Google Cloud introduces Distributed GraphFlow (DGF), an open-source Python library and framework designed to train and deploy Graph Neural Networks (GNNs) at scale for telecommunications. The post outlines an Autonomous Network Operations architecture built around a real-time network digital twin hosted in Spanner Graph, and explains how DGF integrates with that twin to enable anomaly detection, root cause analysis, predictive maintenance, and what-if simulations. DGF offers composable primitives and a high-level API to simplify GNN lifecycle management and production inference via Gemini Enterprise endpoints.

🚀 Filestore agent volumes deliver fully managed, high-performance elastic file storage tailored for large-scale agent fleets on Google Cloud. Integrated with Agent Substrate and GKE Agent Sandbox, volumes attach in milliseconds to provide isolated persistent workspaces with RWX support, POSIX semantics, and granular access controls. The feature targets non-production workloads now, with GA production access via allowlist.