Cyber Threat Intel Daily Briefing — 2026-09-10

CYBER THREAT INTEL

DAILY BRIEFING · 2026-09-10 12:15 UTC · REPORT BRIEF-20260910-121536

OPEN // LE

01

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

CISA added three flaws impacting Cisco, Citrix, and Fortinet to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 12. The additions underscore the urgency for organizations to remediate actively exploited vulnerabilities across networking and secure communications infrastructure.

SRC: The Hacker News Thu, 10 Sep 2026 16:06:46 +0530 https://thehackernews.com/2026/09/cisa-flags-exploited-cisco-citrix.html

02

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Cybercriminals are hijacking AI user accounts via information stealer logs to create 'stolen keys' that grant illicit access to tools from model providers including Google and Anthropic. The stolen keys can bypass multi-factor authentication and replayable tokens are being sold on underground forums.

SRC: The Hacker News Wed, 09 Sep 2026 19:53:55 +0530 https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html

03

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon, chaining multiple vulnerabilities in Microsoft Windows and Google Chrome browsers. The coordination across at least four state-sponsored or spyware groups highlights shared infrastructure and techniques in advanced persistent threat operations.

SRC: The Hacker News Wed, 09 Sep 2026 22:04:05 +0530 https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html

[ SOURCE ] OpenPhish (18 indicator(s))