The Monthly Debrief: September 2026
September's fifteen cases ran from Exchange to France's tax agency. In ten, the vendor, a national agency or the reporting firm gave the same advice: restrict who can reach the service.
6 min readThe Debrief
Your security stack cannot outpace an AI attacker
AI agents scan, find and exploit exposed systems around the clock. Patching, MFA and detection engage after the first contact. Nothing you run today closes that gap alone.
7 min read
600 firewalls in five weeks, and not one exploit among them
An attacker with a low-to-medium skill set used AI to breach more than 600 FortiGate firewalls across 55 countries. There was no CVE. They scanned for exposed management interfaces and guessed passwords.
3 min read
ToolShell: 400 organizations and a US nuclear weapons agency
Two SharePoint zero-days gave unauthenticated remote code execution to anyone who could reach the server. Over 400 organizations were compromised, including a US nuclear weapons agency. The cloud tenants running the same product were fine.
3 min read
MITRE did everything right and lost its network to a VPN appliance
Two Ivanti Connect Secure zero-days let state actors past an authentication bypass into a research network, then session hijacking carried them past MFA. The appliance was reachable by everyone, which is the only reason the exploit chain had a target.
3 min read