Category: Cyber-Physical Security

VPN provider Surfshark has disclosed that hackers accessed one of its internal engineering test servers after a configuration error left the machine reachable from the public internet. The company said the incident did not affect customers or its production VPN infrastructure.

According to Surfshark, it first detected suspicious activity on the test server on August 31, 2026, contained the affected system by September 2, and completed remediation by September 5, ahead of its public disclosure on September 10. “Due to a human error, an internal test server used by our engineering teams was misconfigured in a way that made it reachable from the internet,” the company said.

A separate proxy server used for content-accessibility optimization was also accessed, Surfshark said, but that machine did not hold sensitive data such as user identity information, IP addresses, encryption keys, or browsing traffic. The exposed environment contained service configurations, build-related credentials, and portions of system binaries and code history.

Surfshark said it reviewed available access logs and found no evidence that exposed credentials were misused, but rotated or replaced all potentially affected secrets as a precaution. The incident underscores a recurring theme in enterprise breaches: internal, non-production environments used for testing and builds are frequently held to lower security standards than customer-facing systems, even though they can hold credentials capable of reaching production infrastructure.

Sources: BleepingComputer, Surfshark.

Security researchers at Gen Digital have disclosed active exploitation of a critical remote-code-execution vulnerability, tracked as CVE-2026-51990, in Tencent’s Sogou Input Method for Windows, one of the most widely installed Chinese-language input method editors with hundreds of millions of installations. The flaw was found while investigating a real-world intrusion attributed to UNC3569, a China-linked threat actor associated with espionage activity.

According to Gen Digital’s Threat Labs, the vulnerability could be triggered with a single click on a specially crafted sgbiz: link, which Sogou Input Method registers as a custom URI handler on Windows systems. Researchers say UNC3569 used the flaw in the wild to deploy a backdoor dubbed GrayRabbit.

Gen Digital reported the vulnerability to Tencent on April 9, 2026, under a 90-day coordinated disclosure timeline. Tencent confirmed the fix was complete and pushed to all users through an automatic update, version 16.3.0.3498, by April 21, 2026. MITRE assigned the CVE identifier on July 10, 2026, and Gen Digital published its technical write-up in September.

Because the patch shipped via Sogou’s automatic-update mechanism months before public disclosure, most current installations should already be running the fixed version. Organizations that permit Chinese-language input method editors on managed Windows endpoints, particularly ones with exposure to targeted espionage activity, are advised to confirm Sogou Input Method is running version 16.3.0.3498 or later.

Sources: Gen Digital (Gen Threat Labs), BleepingComputer.

British fintech Revolut confirmed it disclosed sensitive customer data — including birth dates, addresses, phone numbers, and copies of passports and driver’s licenses — to an unauthorized third party, TechCrunch and Reuters reported. The attacker spoofed a legitimate government agency’s email domain, passing SPF, DKIM and DMARC authentication checks, to submit fraudulent information requests that Revolut’s process treated as genuine.

Revolut said customer funds and core systems were unaffected, and it has notified regulators and law enforcement.

Why it matters: The breach illustrates a persistent weak point in data-request handling processes: even well-implemented email authentication (SPF/DKIM/DMARC) does not by itself verify that a request is legitimate if an attacker can obtain or spoof a domain that passes those technical checks, meaning verification of the requester’s actual authority remains a human-process problem, not just a technical one.

Source: TechCrunch and Reuters, September 12, 2026.

Check Point has patched two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a CVSS score of 9.8, in the VPN functionality of its Security Gateway and Spark Firewall products, SecurityWeek reported. The flaws stem from a certificate-validation issue and an ASN.1 heap overflow bug that together could allow unauthenticated remote code execution.

Check Point said its own researchers discovered both vulnerabilities internally, and the company has not confirmed any in-the-wild exploitation to date. Fixes are available in versions R82.10, R82, and R81.20.

Why it matters: VPN gateways sit at the network perimeter for a large share of enterprise and critical-infrastructure networks, making unauthenticated RCE flaws in this class of product a high-priority patch item regardless of whether active exploitation has been observed yet — the same category of flaw was exploited in the wild within days at other vendors this quarter.

Source: SecurityWeek, September 11, 2026.

As of September 11, 2026, manufacturers selling digital products in the European Union must report actively exploited vulnerabilities to ENISA within 24 hours of becoming aware of them, and file a full notification within 72 hours, Dark Reading reported, corroborated by the European Commission’s official Cyber Resilience Act reporting page. Non-compliance can carry fines of up to €15 million.

The reporting mandate is the first Cyber Resilience Act obligation to take effect, well ahead of the regulation’s full enforcement date in December 2027.

Why it matters: The 24-hour reporting window is significantly tighter than most manufacturers’ existing vulnerability-disclosure processes, and applies to any company selling connected digital products into the EU market — including physical security hardware vendors such as camera, access control and sensor manufacturers — making early compliance planning a genuine operational deadline rather than a distant regulatory milestone.

Source: Dark Reading, September 11, 2026, corroborated by the European Commission’s official CRA reporting page.

CISA issued Update A to advisory ICSA-26-183-01, covering four vulnerabilities in ST Engineering iDirect iQ-series satellite (VSAT) terminals, with CVSS scores up to 8.8 and one flaw rated 9.4 on the CVSS 4.0 scale. The advisory was originally released July 2, 2026.

The flaws include missing authentication on REST API endpoints that expose device identity and cryptographic material, a cross-site request forgery vulnerability that can trigger a remote reboot or denial of service, a local privilege-escalation path via a factory-default low-privilege account, and exposure of password hashes. CISA lists Communications, Defense Industrial Base, Energy, Government and Transportation as affected sectors.

Why it matters: VSAT terminals from vendors like ST Engineering iDirect provide connectivity for maritime vessels, remote energy sites, and defense operations where terrestrial networks are unavailable. Authentication bypasses on internet-facing satellite terminal management interfaces are a persistent, underappreciated risk category for organizations with remote or offshore infrastructure.

Source: CISA ICS Advisory ICSA-26-183-01 (Update A), September 10, 2026.

CISA published advisory ICSA-26-253-01 describing four vulnerabilities in AVEVA Pipeline Integrity Monitor, with CVSS scores up to 8.4 (CVE-2026-81821 through CVE-2026-81824). The flaws include a hard-coded cryptographic key, use of a broken or risky cryptographic algorithm, missing authorization checks, and a stored cross-site scripting vulnerability.

According to CISA, successful exploitation could allow an attacker to disclose sensitive project data, brute-force password hashes, or execute arbitrary code in a victim’s browser session. The advisory identifies the Critical Manufacturing sector as affected. AVEVA has released a fix in the 2025 SP1 P2 release.

Why it matters: Pipeline integrity monitoring software is used to track the structural and operational health of oil, gas and other pipeline infrastructure. Vulnerabilities that expose project data or credential material in this class of software are a direct concern for critical-infrastructure operators, even where exploitation requires network access rather than being remotely trivial.

Source: CISA ICS Advisory ICSA-26-253-01, September 10, 2026.

Waltham, Massachusetts-based Vecna Robotics raised $31 million led by Unless, DC Velocity reported, citing surging demand tied to a July 2026 Federal Communications Commission policy restricting purchases of certain foreign-made robots on cybersecurity grounds. The company builds case and pallet automation systems for warehouses.

Vecna said the funding will be used to scale deployment teams and expand its automation capabilities as US-based logistics operators shift purchasing toward domestically built robotics platforms.

Why it matters: The FCC’s restriction treats foreign-made warehouse and logistics robots as a potential cybersecurity and supply-chain risk category, similar to earlier restrictions on foreign-made telecom and video surveillance equipment — a signal that physical automation hardware is increasingly being evaluated through the same national-security lens as networking gear and cameras.

Source: DC Velocity, September 10, 2026, corroborated by GlobeNewswire press release and Boston Business Journal.

Security research firm GreyNoise reported that a Russian-speaking threat actor used hundreds of AI agents, built on an AI coding harness paired with a large language model, to weaponize CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF print-management software, BleepingComputer and SecurityWeek reported.

The AI-orchestrated campaign compromised at least 395 organizations across 48 countries since August 31, 2026, with roughly half of victims in the education sector, according to GreyNoise’s research.

Why it matters: The scale and speed of an AI-agent-orchestrated exploitation campaign against a known, patchable vulnerability illustrates how AI coding tools are lowering the operational cost of mass exploitation for attackers, independent of whether the underlying vulnerability itself is novel — a trend security teams increasingly need to plan around rather than treat as a future risk.

Source: GreyNoise research, corroborated by BleepingComputer and SecurityWeek, September 10, 2026.

CISA added CVE-2025-25249, a heap-overflow vulnerability in Fortinet FortiOS, to its Known Exploited Vulnerabilities catalog after identifying active exploitation, The Hacker News reported. Attackers are using the flaw to deliver a newly identified Node.js-based remote access trojan dubbed PivotC2, which has infected 178 devices to date, the majority located in the United States.

The disclosure was part of a broader CISA KEV update covering multiple actively exploited network-perimeter vulnerabilities, with a federal patch deadline tied to the update.

Why it matters: FortiOS underpins firewall and VPN infrastructure across a large share of small and mid-sized enterprise and critical-infrastructure networks. A newly identified, purpose-built RAT delivered through an actively exploited perimeter flaw is a strong signal that organizations running FortiOS should treat this patch as time-sensitive rather than routine.

Source: The Hacker News, September 10, 2026, citing CISA KEV catalog update.