Researchers Escape OpenAI Codex Sandbox, Compromise Staff Accounts
September 21, 2026
Security researchers broke out of OpenAI’s Codex sandbox using two methods and chained vulnerabilities to compromise ChatGPT and Codex staff
Identity and Access Management
Researchers Escape OpenAI Codex Sandbox, Compromise Staff Accounts
Security researchers broke out of OpenAI's Codex sandbox using two methods and chained vulnerabilities to compromise ChatGPT and Codex staff accounts.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
Two concurrent Android banking malware campaigns — GoldFactory's Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with credential theft and harassment.
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a vulnerability in Tencent's Sogou Input Method, one of the most widely used Chinese typing tools for Windows, to install GRAYRABBIT backdoor ...
Surfshark VPN Breach Exposes Internal Testing and Proxy Servers
Surfshark disclosed that hackers accessed internal test servers and proxy infrastructure after a configuration error exposed testing systems to the public internet on September 10.
Citrix NetScaler CVE-2026-19490 Exploited Since September 3
Critical authentication bypass vulnerability CVE-2026-19490 in Citrix NetScaler has been actively exploited since September 3, enabling unauthenticated attackers to bypass authentication controls.
CISA Sets September 12 Deadline for Cisco, Citrix, Fortinet Flaws
CISA added three actively exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its KEV catalog on September 10, requiring federal agencies to patch by ...
Infostealer Logs Expose Replayable AI Tokens That Bypass MFA
Cybercriminals harvest AI session tokens from infostealer malware logs to hijack Google, Anthropic, and OpenAI accounts, bypassing MFA through token replay attacks published September 9.
PoisonedRefresh Rootkit Injects PHP Web Shells into F5 BIG-IP Memory
SophosLabs published analysis of PoisonedRefresh, a fileless Linux rootkit that injects PHP web shells directly into F5 BIG-IP APM Apache server memory, leaving no disk ...
Microsoft Adds Age-Awareness APIs to Windows 11
Microsoft announced age-awareness APIs for Windows 11, enabling apps to classify users as children, teenagers, or adults while raising profiling concerns.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
September 11, 2026
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
September 11, 2026
Two concurrent Android banking malware campaigns — GoldFactory’s Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
September 11, 2026
China-linked UNC3569 exploited a vulnerability in Tencent’s Sogou Input Method, one of the most widely used Chinese typing tools for
Surfshark VPN Breach Exposes Internal Testing and Proxy Servers
September 11, 2026
Surfshark disclosed that hackers accessed internal test servers and proxy infrastructure after a configuration error exposed testing systems to the
Citrix NetScaler CVE-2026-19490 Exploited Since September 3
September 11, 2026
Critical authentication bypass vulnerability CVE-2026-19490 in Citrix NetScaler has been actively exploited since September 3, enabling unauthenticated attackers to bypass
CISA Sets September 12 Deadline for Cisco, Citrix, Fortinet Flaws
September 11, 2026
CISA added three actively exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its KEV catalog on September 10, requiring
Infostealer Logs Expose Replayable AI Tokens That Bypass MFA
September 11, 2026
Cybercriminals harvest AI session tokens from infostealer malware logs to hijack Google, Anthropic, and OpenAI accounts, bypassing MFA through token
PoisonedRefresh Rootkit Injects PHP Web Shells into F5 BIG-IP Memory
September 11, 2026
SophosLabs published analysis of PoisonedRefresh, a fileless Linux rootkit that injects PHP web shells directly into F5 BIG-IP APM Apache
Microsoft Adds Age-Awareness APIs to Windows 11
September 9, 2026
Microsoft announced age-awareness APIs for Windows 11, enabling apps to classify users as children, teenagers, or adults while raising profiling
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.