Cyber Security News

Hacking Editorial Brief — September 16, 2026

Microsoft Ships Record 972 CVEs in September Patch Tuesday, Two Zero-Days Under Active Exploit

Microsoft released its largest security update on record, addressing 972 vulnerabilities in September's Patch Tuesday cycle. Among them are two actively exploited zero-day elevation of privilege flaws and 113 rated critical. The scale of disclosed vulnerabilities represents a significant spike in Microsoft's security posture reporting, though the company has not publicly attributed the active exploits to specific threat actors or disclosed exploitation scope. Organizations running Microsoft environments face an unusually large remediation surface this month, with immediate patching priorities centered on the two known-exploited flaws. The sheer volume suggests either improved internal discovery processes or an accumulation of third-party researcher submissions.

Critical WSO2 API Manager Flaw Under Active Exploitation; Iranian APT Uses Medical Imaging in Social Engineering

A critical authentication bypass vulnerability in WSO2 API Manager (CVE-2026-5430) is being actively exploited in the wild, enabling account takeover through improper JWT cryptographic signature verification. The flaw affects enterprise API management infrastructure and requires immediate patching. Separately, the UK's National Cyber Security Centre confirmed that Iranian state-sponsored actors are using fabricated MRI scan results as social engineering lures to compromise targets deemed enemies of the regime. The medical imagery tactic marks a shift toward exploiting sensitive health contexts to establish credibility and urgency in spear-phishing campaigns. Meanwhile, ShinyHunters claimed a breach of Florida's DMV system, asserting theft of 200,000 records, though state officials disputed the password-reset method cited by the group.

Sources: CrowdStrike · WIU Cybersecurity Center · The Record · Fox News