As your dedicated cybersecurity services provider, CyberOne equips you with timely and in-depth information about current cyber attacks. Discover a weekly cybersecurity report of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape.
Weekly Cybersecurity Report | Week 37, 2026
Information security updates and events from the past week
1. Microsoft September 2026 Patch Tuesday Fixes Record 966+ Flaws, Including Two Exploited Zero-Days
Summary: On September 8, 2026, Microsoft released its monthly security update addressing an unprecedented 966 vulnerabilities across Windows, Office, and server ecosystems. The release includes 105 Critical flaws and two actively exploited zero-days: CVE-2026-81963 (Windows Update Stack Elevation of Privilege, CVSS 7.8) and CVE-2026-85880 (Windows Advanced Local Procedure Call / ALPC Elevation of Privilege, CVSS 7.8). The ALPC flaw is a heap buffer overflow that enables local authenticated attackers to execute code with NT AUTHORITY\SYSTEM privileges on Windows 10 and Windows Server systems.
Impact / Significance: Elevation of Privilege (EoP) flaws are heavily weaponized as secondary post-compromise stages in ransomware attacks. Attackers who gain initial low-level footholds (e.g., via phishing) can exploit these flaws to seize complete control over servers, bypass endpoint detection and response (EDR) defenses, and execute lateral movement across domain networks.
Recommendations:
Prioritize deploying Microsoft’s September 2026 cumulative updates across all Windows endpoints, domain controllers, and servers.
Audit BitLocker policies prior to deployment, as non-standard configurations may trigger recovery key prompts post-update.
Enforce least-privilege policies across local accounts to restrict execution rights for standard users.
Source: BleepingComputer — Microsoft September 2026 Patch Tuesday Fixes 966 Flaws, 2 Zero-Days | The Zero Day Initiative — The September 2026 Security Update Review | Help Net Security — September 2026 Patch Tuesday Zero-Days
2. GitLab Issues Emergency Patch for Maximum-Severity CVSS 10.0 File-Read Flaw (CVE-2026-85706)
Summary: On September 11, 2026, GitLab rolled out critical out-of-band updates addressing CVE-2026-85706, an unauthenticated arbitrary file-read vulnerability rated at the maximum CVSS score of 10.0. The vulnerability allows remote external attackers without valid credentials to inspect server configuration files, internal application logs, database secrets, and API tokens. On the same day, CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog following verified reports of active exploitation in the wild.
Impact / Significance: Exposure of configuration and secret files on source code repositories creates critical software supply chain risks. Attackers can leverage exfiltrated deployment keys and database tokens to compromise continuous integration/continuous delivery (CI/CD) pipelines, manipulate proprietary source code, and pivot deeper into corporate infrastructure.
Recommendations:
Upgrade self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) instances immediately to the latest vendor release.
Rotate all API tokens, signing certificates, and database credentials stored or referenced within vulnerable GitLab instances.
Inspect web server and reverse proxy logs for unauthorized requests targeting internal configuration files or directory traversal paths.
Source: The Hacker News — GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
3. Cisco FMC Flaws Exploited by Nation-State and Ransomware Actors Prompt Emergency CISA Directive
Summary: On September 10, 2026, Cisco disclosed that two high-severity vulnerabilities in Cisco Firepower Management Center (FMC) software—command injection (CVE-2026-20079) and authentication bypass (CVE-2026-20316)—are being actively exploited in targeted intrusions. CISA responded by ordering federal civilian agencies to remediate these flaws alongside perimeter vulnerabilities in Citrix and Fortinet devices.
Impact / Significance: Cisco FMC serves as the central administrative controller for enterprise firewalls and intrusion prevention systems. Compromising FMC enables threat actors to disable security detection, tamper with firewall access control lists (ACLs), intercept encrypted network streams and establish persistent footholds on enterprise boundaries.
Recommendations:
Apply Cisco security updates for affected FMC deployments immediately.
Ensure FMC management interfaces are completely isolated from public internet exposure and restricted to dedicated administrative out-of-band networks.
Audit perimeter device configurations for unauthorized firewall rules, new administrative accounts, or atypical outbound network connections.
Source: Help Net Security — Cisco FMC Bugs Exploited by Nation-State and Ransomware Actors | The Hacker News — CISA Flags Exploited Cisco, Citrix, Fortinet Flaws
4. “MikroTrick” Attack Chain Targets Over 122,000 Internet-Exposed MikroTik Routers
Summary: Security researchers and national CERTs, including CERT Polska, documented active exploitation of the “MikroTrick” exploit chain affecting MikroTik RouterOS. The chain combines CVE-2026-67276 (SSH public-key authentication bypass) and CVE-2026-86060 (privilege escalation via crafted usernames) to allow unauthenticated remote attackers to gain root access over affected hardware. Internet scans identified approximately 122,500 MikroTik routers with public-facing SSH services vulnerable to takeover.
Impact / Significance: Hijacked enterprise and edge routers are frequently integrated into malicious proxy networks, utilized for large-scale distributed denial-of-service (DDoS) campaigns, or leveraged to snoop on unencrypted communications and stage man-in-the-middle (MitM) attacks.
Recommendations:
Update MikroTik RouterOS to patch version v7.16 or the latest stable release provided by the vendor.
Disable public WAN access to SSH (port 22) and administrative management ports (WinBox, WebFig), allowing access only through secure VPN tunnels or specific IP allowlists.
Review RouterOS user databases for unauthorized administrator accounts and check scheduled scripts for persistent backdoor tasks.
Source: The Hacker News — Attackers Hijack MikroTik Routers Through Internet-Exposed SSH | DIESEC — Top 5 Cybersecurity News Stories September 11, 2026
5. AdaptHealth Discloses Data Breach Impacting 4.1 million Patients
Summary: On September 10, 2026, medical equipment and home healthcare provider AdaptHealth confirmed that a major cyber incident resulted in the theft of sensitive data belonging to approximately 4.1 million patients. The exfiltrated records contain patient names, dates of birth, Social Security numbers, health insurance identifiers, medical diagnoses, and equipment prescription records.
Impact / Significance: Severe medical identity theft and targeted phishing risk. Unlike passwords or payment cards, medical histories and Social Security numbers cannot be reset. Stolen health information enables threat actors to file fraudulent insurance claims, conduct specialized spear-phishing campaigns, and perform synthetic identity theft.
Recommendations:
For Affected Individuals: Monitor explanation of benefits (EOB) statements for unrecognized medical charges and place fraud alerts or credit freezes with major credit bureaus (Equifax, Experian, TransUnion).
For Organizations: Enforce strict data segmentation and encryption for protected health information (PHI) repositories, limit access via granular role-based controls and monitoring for anomalous bulk data egress.
Source: SecurityWeek — 4.1 Million Impacted by AdaptHealth Data Breach
The cybersecurity attacks highlighted in this report aren’t just incidents, they’re blueprints of the adversary’s arsenal. To protect your business you need the right partner. CyberOne is here to help! Check out our services.
