Week in Review: Cisco Zero-Day Exploitation, Revolut Breach and Other Security News
Summary
The roundup covers reported breaches, actively exploited flaws, AI security risks, new defensive guidance, an FBI DDoS-service takedown, and AWS’s disclosure of unrecoverable customer data after strikes on Middle East infrastructure.
Key points
- Revolut confirmed that someone impersonating a government agency obtained sensitive customer records; CenterPoint Energy also disclosed unauthorized access to customer data after a hacker’s claims.
- Cisco confirmed active exploitation of a SQL injection zero-day in Secure Email Gateway (CVE-2026-76461) and an authentication bypass in Cisco ISE (CVE-2026-76460).
- Attackers compromised HBO Max’s verified Reddit account to run a ClickFix campaign targeting Windows and macOS users with information-stealing malware.
- Spain’s data protection authority reported a breach blamed on an autonomous AI agent that reportedly accessed a company network, altered personal records, and retrieved invoice data.
- Four major AI coding agents were reported to share a zero-click RCE vulnerability; the article says two remained unpatched.
- CISA, ENISA, NIST, and CISA announced or launched guidance and tools, including cyber-decoy guidance and a platform for reporting actively exploited vulnerabilities under the EU Cyber Resilience Act.
- The FBI seized domains linked to DDoS-for-hire service NightmareStresser; AWS said customer data in its Bahrain region and one UAE availability zone could not be recovered after strikes.
Article Details
- Event Type
- Weekly security news roundup covering data breaches, actively exploited vulnerabilities, account compromise, malware campaigns, and cybersecurity guidance.
- Impact
- Reported incidents included unauthorized access to customer data at Revolut and CenterPoint Energy, permanent loss of some AWS customer data in Bahrain and the UAE following Iranian strikes, and compromise of HBO Max’s Reddit account to promote a ClickFix campaign distributing information-stealing malware. Attackers were also reported to be exploiting vulnerabilities affecting Cisco Secure Email Gateway, Acronis backup extensions, and Cisco ISE. The roundup additionally covered malware and phishing campaigns, an AI-agent-related data breach reported by Spain’s data protection authority, and security risks involving AI coding agents.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe ClickFix campaign tricked victims into running malicious commands on their devices.T1078 · Valid AccountsCISA guidance discussed adversaries using legitimate credentials to evade detection.T1190 · Exploit Public-Facing ApplicationAttackers exploited a SQL injection zero-day to compromise Cisco Secure Email Gateway appliances.T1199 · Trusted RelationshipAn individual impersonating a government agency reportedly used an email address on that agency’s domain to obtain sensitive customer records from Revolut.T1566 · PhishingA fake ChatGPT billing email directed users toward a credential-theft page.T1583.006 · Web ServicesAttackers compromised HBO Max’s verified Reddit account and used its trusted advertising status to promote a ClickFix campaign.
CVE
CVE-2026-76460Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)CVE-2026-76461Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)CVE-2026-87886Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)CVE-2026-90894Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)
People
Malware
CHOSEN BRICKIranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalistsNeedle StealerAttackers built a website for a fake AI crypto trading agent and used it to install Needle Stealer, malware that replaces a victim’s browser wallet with a copy that sends the wallet password to the attacker. HP caught
Vendors
AcronisIt also covered critical vulnerabilities in Cisco Secure Email Gateway, Cisco ISE, Acronis, Parallels Desktop, and AI coding agents, alongside new guidance and tools from CISA, ENISA, NIST, Google, and Microsoft.Amazon Web ServicesSix months after Iranian drone strikes tore through its Middle East infrastructure, Amazon Web Services (AWS) has acknowledged the permanent loss of customer data in Bahrain and the UAE. In two updates posted SeptemberCiscoIt also covered critical vulnerabilities in Cisco Secure Email Gateway, Cisco ISE, Acronis, Parallels Desktop, and AI coding agents, alongside new guidance and tools from CISA, ENISA, NIST, Google, and Microsoft.HBO Maxbreaches, active exploits, and AI-related risks, including incidents at Revolut, CenterPoint Energy, HBO Max, and the first data breach blamed on an autonomous AI agent in Spain.OpenAIA fake ChatGPT billing email is after your OpenAI passwordParallelsIt also covered critical vulnerabilities in Cisco Secure Email Gateway, Cisco ISE, Acronis, Parallels Desktop, and AI coding agents, alongside new guidance and tools from CISA, ENISA, NIST, Google, and Microsoft.
Products
AWSAWS’s new sign-up gives accounts spend caps, email invites, and agent-set permissionsCisco Identity Services Engineone more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE). It checks connecting users’ identity, profiles devices and checks their security posture,Cisco Secure Email GatewayIt also covered critical vulnerabilities in Cisco Secure Email Gateway, Cisco ISE, Acronis, Parallels Desktop, and AI coding agents, alongside new guidance and tools from CISA, ENISA, NIST, Google, and Microsoft.Homebrewroot privileges on the host system. The danger is highest on developer laptops, where a single poisoned Homebrew formula or malicious npm preinstall script can go from local user to full control, and on sharedParallels DesktopIt also covered critical vulnerabilities in Cisco Secure Email Gateway, Cisco ISE, Acronis, Parallels Desktop, and AI coding agents, alongside new guidance and tools from CISA, ENISA, NIST, Google, and Microsoft.