Threat Intelligence Center

Oracle's September 2026 Critical Patch Update closed more than 800 flaws, none actively exploited — while CISA confirms ransomware crews are hitting CVE-2026-59310 in VMware vCenter, patched back in July. Add an AT&T store employee sentenced to 16 months for selling SIM swaps, and Unit 42's CL-CRI-1171 install market pushing Insomnia RAT, and the week's lesson is about exposure, not patch counts.

Attackers are distributing a fake AI trading agent that steals cryptocurrency wallet passwords from users who download and run it. The attack surface is the application itself rather than any specific sector, so exposure follows wherever the software is installed, including employee-owned or unmanaged endpoints.

xHealth has disclosed a data breach affecting approximately 118,000 individuals. Public reporting does not specify the threat type, intrusion method, or the categories of data involved, which leaves affected parties with limited detail to act on.

Researchers have tied a China-linked cluster tracked as APT31, JungleBamboo and UTA0560 to an exploit chain spanning Google Chrome and Microsoft Windows, using CVE-2026-85046, CVE-2026-85880 and CVE-2026-87491 to deploy the GRIMWEDGE implant. Additional tooling associated with the activity includes BlueMoon, GemStone, LONGTALE and SUPERSTOMP, along with the artifacts msgbox.exe and wsc.dll.

Broad AI adoption does not stay in the engineering team. Once Claude, Codex, and Cursor are in use across a company, the volume and shape of endpoint and developer activity your security operations center reviews changes with it. Analysts still need to separate that traffic from the tradecraft that matters, including living-off-the-land binaries such as Expand.

AI-assisted impersonation has made executive fraud harder to spot. Attackers pose as senior leaders using generated email, voice, and video to authorize wire transfers, redirect vendor payments, or approve fraudulent invoices. Because the request arrives through expected channels and matches a known voice or writing style, staff often act without question.