News archive · 27 stories
September 2026
- AI agentsAmerica.gov launches as an AI front door to federal services, with Login.gov as its sign-inGSA and the White House National Design Studio launched America.gov, an AI-assisted entry point to federal services. The executive order behind it makes Login.gov the authentication service and commits to no central citizen database. Transactions arrive in 2027, and the identity rules for them are still to be written.
- PasskeysIDEMIA pairs passkeys with restricted-use tokens so card networks can let AI agents payIDEMIA Secure Transactions launched an Agentic Commerce offering for domestic schemes and private-label issuers that combines passkey cardholder authentication with payment tokens limited by merchant, amount, category or time, plus stored proof of consent for disputes.
- More than 16,000 Supabase databases were readable by anyone because row-level security was missingUpGuard found over 16,000 Supabase databases exposing readable tables with personal data, plaintext passwords and authentication tokens, caused by missing or ineffective row-level security and misused keys. Many appear to have been built with AI coding agents.
- BreachBitget's $388 million theft ran on legitimate admin credentials through a third-party security productAttackers exploited a zero-day in an unnamed security product Bitget used, reached an internal management system, and inserted withdrawal commands while posing as administrators. Private keys were never touched; they did not need to be.
- Social engineeringDutch police arrest a suspect in the ShinyHunters investigation as the group's attacks escalatePolice in the Netherlands confirmed a 24-year-old Amsterdam man was arrested in September in an investigation into ShinyHunters, the extortion group behind help-desk vishing and PeopleSoft exploitation this year. The group denies any link.
- AI agentsJadePuffer used a service principal leaked in a GitHub issue to wipe Azure resources in seven minutesMicrosoft says the operator it tracks as Storm-3168 used two compromised service principals and an AI-driven toolchain to map an Azure tenant, pull storage keys, delete recovery locks and destroy resources in a seven-minute window.
- Zero-dayCisco ISE authentication bypass, CVSS 10, was exploited before the patchCVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. Cisco confirmed active exploitation; CISA gave federal agencies until September 19.
- BreachGyazo breach exposes 23.6 million accounts, including session IDs and X integration tokensAn attacker reached Gyazo's database through its image upload server and took 23.62 million user records: emails, password hashes, login session IDs, device IDs and X integration tokens, plus 490 million image metadata records.
- Machine identityNearly one in ten exposed LiteLLM gateways still accept the documentation's example admin keyWiz found 3,074 internet-facing LiteLLM gateways, of which 294 accepted sk-1234, the key printed in the setup docs. In 191 of those no key was set at all, which defaults to full admin: every provider API key, every prompt, and MCP access.
- BreachThe McKesson breach resolves to 6.4 million people, not the 284 million claimedShinyHunters published the McKesson data after a 55.2 million dollar demand went unpaid. Have I Been Pwned counted 6.4 million unique email addresses, against the group's claim of 284 million records, which were raw rows.
- VulnerabilityN-able shipped a fourth N-central hotfix in five weeks, and CVSS 10.0 was already exploitedCVE-2026-86218 is a static code injection giving pre-auth RCE on N-central, scoring 10.0 and exploited in the wild. Huntress found a compromised customer on September 4; CISA set a federal deadline of September 11.
- Token theftOkta found 1,843 unexpired AI session tokens sitting in a single infostealer dumpOkta analysed a 7GB infostealer dump from 5,871 machines and found 44,791 JWTs, 1,843 of them still unexpired on release day, plus 24 live API keys for Gemini, OpenAI, Groq and OpenRouter. Replaying them skips MFA entirely.
- PasskeysSingpass passkeys reach Android, with about 800,000 already registeredGovTech has opened Singpass passkeys to Android users after an iPhone beta, with about 800,000 passkeys registered by September 9. Singpass serves 5.5 million users and over 1,400 services; passkeys stay optional and desktop support is due by end-2026.
- VulnerabilityA phantom join key let anyone mint JFrog Artifactory admin tokens, and exploitation started in daysCVE-2026-82329 (CVSS 9.8) is an authentication bypass in JFrog Access. Instances without an explicit join key got a predictable one, letting an unauthenticated attacker forge access and mint administrator credentials. Exploited from September 1.
- BreachA service sold 153 million driver's licenses scraped from an identity verification vendorNexus, advertised on a Russian cybercrime forum, sold access to more than 153 million US and Canadian driver's licenses that its operators say they exfiltrated from IDScan.net over more than a year. The FBI opened an investigation.