AI Security Digest
Aggregated ecosystem risk analysis
Vendor Watchlist
Tracking 0 critical integrations
Threat Stream Feed
Real-time security logs and system alerts
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users. "The attack chain begins with a fake CAPTCHA page and
Zero Trust for AI Agents Starts With Fixing Zero Visibility
The way we talk about AI agents is shifting, and the way we implement them requires an even more fundamental shift. While earlier discourse focused on how quickly organizations could stand up agents and how much productivity they could promise, a string of recent incidents, including a widely discussed intrusion at Hugging Face during an evaluation of OpenAI agents, has spurred organizations to
Plaid - Service Disruption Impacting Bank of America connections
Status: InvestigatingBank of America is currently experiencing downtime impacting all channels and data recipients. API calls through Plaid are impacted. We will provide an update when Bank of America has resolved the issue.Affected components Dashboard (Partial outage) API - Production (Partial outage)
HashiCorp - Users unable to access releases.hashicorp.con
Status: MonitoringOur Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.Affected components Releases Site (Partial outage)
Snowflake - INC20000237
Sep 25, 23:26 UTC Monitoring - Current status: We've implemented the fix for this issue, and we'll continue to monitor the environment until we're confident all services are functioning properly.Customer experience: Customers hosted in the specified regions may have been unable to access or use multiple core Snowflake services and features. Affected users may have been unable to sign in, execute queries, or manage data, and may have been unable to connect to Snowflake via private connectivity, ...
New Relic - Data Irregularities for US region
Sep 25, 19:57 UTC Investigating - We are currently investigating a service interruption where a subset of customers may be experiencing delayed data in queries, charts, and dashboards as well as delayed or missing alert notifications for related data. Affected alerts are currently being suppressed.
Zoom - Service Degradation Affecting Customer Using Polycom Devices Going Offline
Sep 25, 10:45 PDT Investigating - We are currently investigating a service degradation with a subset of users with Polycom devices going offline. Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing
I'm a Salesforce admin, not a cybersecurity expert, so please talk to me like I'm dumb. Salesforce had a similar exploit that was "patched" last year. My question is, is there anything that prevents exfiltration via calling 3rd party URLs in other AI clients, like Claude? In Agentforce, after the first web-to-lead vulnerability was discovered last year, you have to allowlist URLs for your us...
Datadog - Users are unable to acknowledge, escalate, or resolve On-Call Pages
Sep 25, 11:38 EDT Resolved - The issue is now resolved. Sep 25, 11:29 EDT Monitoring - We are monitoring the issue. Sep 25, 11:23 EDT Identified - We have identified the issue with pages and are applying mitigations. Sep 25, 11:17 EDT Update - We are investigating an issue with users unable to acknowledge, escalate, or resolve On-Call Pages. Sep 25, 11:11 EDT Investigating - We are investigating an issue with users unable to acknowledge on call pages
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this
Zoom - Zoom Phone India Maintenance (Mumbai) : September 25, 2026
Sep 25, 04:30 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 3, 02:47 PDT Scheduled - Zoom Phone users registered to the India (Mumbai) Data Center will be automatically registered in an alternative datacenter (Hyderabad) starting at 25th September 2026 04:30 AM PDT (5:00 PM IST on 25th September 2026). During the maintenance window, a brief disconnection may be experienced and notifications may be missed. If you get disconnected, ...
On Anthropic’s AI Misuse Report
Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs...
Zoom - An unintended pop-up message appear for users in US region during initial invocation of Zoom AI’s Catch Me Up feature
Sep 25, 02:20 PDT Investigating - We are currently investigating an unintended pop-up message appear for users in US region during initial invocation of Zoom AI’s Catch Me Up feature in Zoom Meetings. At this time, Catch Me Up service itself remains fully functional.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare. The company
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane,
New Relic - SRE Agent UI Availability Monitor (EU) query result is > 0.0 for 20 minutes on 'SRE Agent UI Unavailable (EU)'
Sep 25, 03:56 UTC Resolved - Between 01:10 UTC and 03:33 UTC on September 25th, some customers in the US, EU, and JP regions may have experienced intermittent UI errors while navigating the New Relic UI. Data ingest and alert notifications were not impacted. We have resolved this issue and impacted services have returned to normal operations.
New Relic - SRE Agent UI Availability Monitor (EU) query result is > 0.0 for 20 minutes on 'SRE Agent UI Unavailable (EU)'
Sep 25, 03:55 UTC Resolved - Between 01:10 UTC and 03:33 UTC on September 25th, some customers in the US, EU, and JP regions may have experienced intermittent UI errors while navigating the New Relic UI. Data ingest and alert notifications were not impacted. We have resolved this issue and impacted services have returned to normal operations.
New Relic - SRE Agent UI Availability Monitor (EU) query result is > 0.0 for 20 minutes on 'SRE Agent UI Unavailable (EU)'
Sep 25, 02:57 UTC Update - We are currently investigating some intermittent UI navigation errors in the EU region. Data ingest and alert notifications are not impacted at this time. Sep 25, 02:34 UTC Investigating - We are investigating an issue with New relic UI for EU region
New Relic - Potential Service Interruption
Sep 25, 02:23 UTC Investigating - We are investigating a potential service interruption that may impact some customers. Please continue to monitor this page for updates.
Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)
(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR & MWAIT instructions used by Hyper-V and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU bug arguably caused by poor documentation of the SeLocateProcessImageName function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: ...
Zoom - Scheduled Update to Slow Track Versions for Zoom Clients: September 24, 2026 (No Operational Impact)
THIS IS A SCHEDULED EVENT Sep 24, 18:00 - 21:00 PDT Sep 17, 16:38 PDT Scheduled - Zoom will be updating the Slow track versions for Zoom clients on 9/24/2026.Slow channel updates:Windows: 7.1.9macOS: 7.1.9Linux: 7.1.9For more information, such as specific versions, please refer to the Zoom Minimum, Prompted, and Slow/Fast Update Versions support article: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0061900
The 2026 State of AI Security Report has three numbers that really stuck with me: 81%, 50.1%, 99.9%
So I read this state of AI security report from orca security yesterday and a couple numbers stuck with me longer than I expected. First, 81% of orgs with AI packages have at least one known vulnerability. Half of those alerts now have a public exploit, which is up from almost nothing two years ago. The one that actually got me was 99.9%. Thats the share of fixable AI vulnerabilities still unpatch...
Amplitude - Export Destinations data delivery issue
Sep 24, 12:58 PDT Identified - The issue has been identified and a fix is being implemented. We will provide another update in 30 minutes. Sep 24, 12:47 PDT Investigating - Since 2026-09-24 09:30 PT (17:30 UTC), Amplitude has been experiencing a delay in Data Export processing due to a lagging data partition. Realtime data processing and Amplitude charts and dashboards are not impacted. No data is being lost, and delayed exports will complete once the underlying issue is resolved. No customer...
Netlify - Error accessing Netlify-hosted sites
Sep 24, 19:25 UTC Resolved - This incident has been resolved. Service has returned to normal operation, and we are no longer seeing elevated error rates. Sep 24, 19:10 UTC Monitoring - We are seeing signs of recovery, and service has returned to normal operation. Sep 24, 19:01 UTC Investigating - We are investigating reports of errors affecting access to Netlify-hosted sites. Our engineering team is actively investigating the issue.We will provide additional updates as more information beco...
GitHub - Disruption with billing information updates
Sep 24, 16:51 UTC Update - We are investigating failures on billing information updates. Customers may be unable to create or update their billing information in the meantime. Sep 24, 16:51 UTC Investigating - We are investigating reports of impacted performance for some GitHub services.
Supabase - Project Lifecycle Issues in eu-west-1
Sep 24, 15:50 UTC Identified - We have isolated the scope of the problem to a specific upstream incident. We are working to address the upstream incident and determine mitigations. Sep 24, 15:36 UTC Investigating - We are investigating project lifecycle operation issues in eu-west-1.
Zoom - Service Degradation Affecting Live Transcription Services.
Sep 24, 08:47 PDT Investigating - We are currently investigating a service degradation affecting Live Transcription Services.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
submitted by /u/natcoba [link] [comments]
Heroku - Heroku Feature Degradation
Heroku engineers are investigating.
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the
HubSpot - The Salesforce integration is unavailable for some customers
Sep 24, 10:08 EDT Identified - We have identified an issue with our Salesforce integration. Some customers may find that their integration has been unexpectedly disconnected and is temporarily unavailable in the App Marketplace.We're actively investigating the cause and working to restore full functionality.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to...
Zoom - Service Degradation Affecting Zoom Phone and Zoom Contact Center Inbound calls in India
Sep 24, 04:19 PDT Investigating - We are currently investigating a service degradation affecting a subset of Airtel subscribers for inbound call connectivity to Zoom India phone numbers for Zoom Phone and Zoom Contact Center. Outbound calls continue to function normally. Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
Supabase - Permission errors in the Supabase Dashboard
Sep 24, 10:50 UTC Identified - We have identified the issue causing some users to encounter permission-related errors, such as “You need additional permissions,” when performing administrative actions in the Supabase Dashboard.We are working on a fix and will provide another update once it has been implemented. Sep 24, 10:37 UTC Investigating - We are investigating reports of users encountering permission-related errors, such as “You need additional permissions,” when performing administrativ...
OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files
An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not public, but no personal
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The campaign compromised 7 accounts –
Xero - Global: Invoicing/Contacts and Payroll - Brief latency in some areas on Xero
Sep 24, 04:00 UTC Resolved - Our team has resolved an issue impacting our customers globally over the past 3 minutes from 2:17pm-2:19pm AEST where there was some latency using Payroll, Invoicing and Contacts We apologise for any inconvenience this has caused.
Netlify - Elevated CDN Errors
Sep 24, 00:00 UTC Resolved - The issue causing elevated CDN errors has been resolved. DNS resolution has recovered, and affected services are operating normally. Sep 23, 23:50 UTC Monitoring - We have applied a fix for the issue causing elevated CDN errors. Services are recovering, and we are monitoring the platform to confirm full recovery. Sep 23, 23:40 UTC Update - We have identified the cause of the elevated CDN errors and are applying mitigations across affected systems. Recovery is un...
[CISA KEV] CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Product: Commerce and Magento by Adobe Description: Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Zoom - Service Degradation Affecting Live Transcription Services.
Sep 23, 16:43 PDT Investigating - We are currently investigating a service degradation with Live Transcription Services.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs
submitted by /u/dx7r__ [link] [comments]
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs
submitted by /u/dx7r__ [link] [comments]
Heap - Heap Connect Syncs: Possibility Of Stale Data
Sep 23, 15:15 PDT Identified - We are experiencing latency in our upstream data source. Syncs running during this period may have stale data. We will post an update within the hour.
Supabase - Supabase CLI CI workflow failures
Sep 23, 21:58 UTC Investigating - We're seeing rate limiting issues causing Supabase CLI CI workflow failures
Akamai - Account Protector Issues
Sep 23, 21:30 UTC Investigating - We are investigating an emerging issue with Account Protector. We are actively investigating the issue and will provide another update within the next 30 minutes. We will soon be posting more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications. If you have questions or are experiencing an impact due to this issue, please use the Support Center on Ak...
CircleCI - Delays in processing new signups and plan changes
Sep 23, 18:13 UTC Identified - Customers may experience delays in new signups and plan changes being reflected in their account.
HashiCorp - HCP Terraform Returning 404s
Status: MonitoringOur Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.Affected components HCP Terraform (Operational)
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a button labeled "Email work item to this project." Mail sent to it opens an issue in that project, authored
HubSpot - Some HubSpot tools may be unavailable for some users
Sep 23, 11:17 EDT Resolved - Between 10:37 AM EDT (UTC -04:00) and 10:53 AM EDT (UTC -04:00), many customers in all affected regions experienced issues with sales tools. This was caused by a server impairment. As of 10:53 AM EDT (UTC -04:00), our sales tools are working properly and the incident has been fully resolved.HubSpot conducts a thorough review after each incident to understand the cause and prevent it from happening again. Learn more about HubSpot's commitment to reliability at www.Hu...
Xero - UK: HMRC connected services (Corporate Tax, Personal Tax, Partnership Tax, MTD IT and MTD VAT)
Sep 23, 13:16 UTC Investigating - We're aware that the issue with HMRC services is affecting Corporate Tax, Personal Tax, Partnership Tax, MTD IT and MTD VAT. Some products are unavailable, responding more slowly than usual, or not updating their status. This is due to an issue with HMRC and HMRC have confirmed they are investigating.
Optimizely - Optimizely Graph - USEA production clusters experiencing intermittent availability issues
Sep 23, 14:46 UTC Monitoring - We have identified the root cause and applied a mitigation. The service has returned to normal operation and we are actively monitoring to confirm stability. Sep 23, 14:21 UTC Investigating - We are experiencing intermittent availability issue for the Optimizely Graph service impacting one of the USEA production clusters. Our team is working on mitigating actions.
Elastic Cloud - Degraded Performance: Cloud Provisioning Delays
Sep 23, 14:04 UTC Investigating - We are currently experiencing delays in provisioning new cloud resources due to slowness with an external container image provider. This may result in delays when creating new deployments, scaling existing ones, or relocating instances affected by infrastructure maintenance. As mitigation, you can try re-running failed plan changes.Existing running deployments are not impacted. Our team is actively monitoring the situation and working to mitigate the issue.We w...
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests
Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic, is a "major step up from Opus 5," and "achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands
GitHub - Incident with API Requests and Projects
Sep 23, 10:57 UTC Update - Database replicas have been restored. Org creation and the GitHub API are no longer degraded. Sep 23, 10:20 UTC Update - Database replicas have detached. We're working to restore the database replicas. Users may experience issues beyond creating organizations and a degraded experience with the GitHub API and Projects. Sep 23, 10:11 UTC Investigating - We are investigating reports of degraded performance for API Requests
Supabase - Increased error rate in project creation and project restore
Sep 23, 09:54 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 23, 09:39 UTC Identified - We've identified the issue affecting project creation and are implementing a fix. Users may experience delays when creating new projects while we work to resolve this. Sep 23, 09:21 UTC Investigating - We are currently investigating this issue
Supabase - Storage search failing for restored projects
Sep 23, 09:31 UTC Investigating - We have identified an issue with Storage for projects are restoring from backups. Users may experience increased 500 errors.We are working to identify the root cause and will notify for any progress as soon as we have an update
Amplitude - Export Destinations data delivery issue
Sep 23, 01:39 PDT Monitoring - Since 2026-09-22 16:50 PT (23:50 UTC), we experienced an issue with automated data exports to export destinations that filter events before export.We have deployed a fix and are now monitoring the system to confirm exports and backfills fully recover. No data has been lost. No customer action is needed at this time. Sep 23, 01:02 PDT Investigating - Since 2026-09-22 16:50 PT (23:50 UTC), we have been experiencing an issue with automated data exports to all expor...
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version
Leaked GitHub App private keys let researchers impersonate 440 apps including CDC and BuildBuddy
submitted by /u/mabote [link] [comments]
Zoom - Service Degradation Affecting Zoom Tasks in US Region.
Sep 22, 18:55 PDT Monitoring - On 09/23/2026, Between 00:42 UTC- 01:22 UTC, users may have experienced issues with Zoom Tasks in US Region. We have mitigated the issue and we will continue to monitor the situation closely and keep you informed of any further developments.Thank you for your patience.
Dropbox - Scheduled maintenance
Sep 23, 00:00 UTC In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 22, 22:52 UTC Scheduled - Dropbox will be performing routine maintenance on September 22, 2026 starting at 5:00 PM (Pacific). You may not be able to access Dropbox for a short period of time, but we’ll have things back up and running as soon as possible to minimize disruption to you.
Heap - Third party integration events latency impacting some customers
Sep 22, 15:43 PDT Identified - We have identified an issue where users may see delays in 3rd party integration events getting to the app, and potentially split users.
Amplitude - Snowflake Data Share export delivery issue
Sep 22, 11:49 PDT Investigating - Starting at 17:00 UTC, new data is not being delivered to Snowflake Data Share destinations. Existing shared data remains available, and data ingestion and analytics in Amplitude are not affected. No data loss is expected. Our team has identified an authentication issue on our side and is working on a fix. Delayed data will be delivered once resolved. No customer action is needed.We will share another update in 30 minutes.
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731."
Sumo Logic - Problem with Cloud SIEM Processing in North America 1 (US1)
Sep 22, 17:56 UTC Monitoring - We have implemented a fix for the issue affecting Cloud SIEM Processing. We are currently monitoring the results. Sep 22, 17:44 UTC Investigating - We are currently investigating reports of problems with Cloud SIEM Processing. Log security records may take longer than normal to become searchable after processing. Users may not receive data when running queries or viewing dashboards that depend on recently collected data and alerts may not dispatch. Users may al...
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every step of the attack chain." The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in
Leaked GitHub App private keys let researchers impersonate 440 apps including CDC and BuildBuddy
A large-scale scan for leaked GitHub App private keys turned up some nice numbers, summarized below. Out of 5,000 leaked private keys tied to GitHub App environments, 474 were still valid at time of analysis. Those keys could impersonate 440 different GitHub Apps, some with high-level permissions (repo access, org-level admin, etc.). A subset reportedly could have allowed takeover of privat...
Akamai - Origin Server Connectivity Issues with Elevated Errors
Sep 22, 13:19 UTC Monitoring - We became aware of an issue with origin server connectivity that caused intermittent connectivity issues and elevated errors for some customers in affected regions. The issue was resolved at approximately 11:41 UTC on 22 September, 2026. The issue appears to have self-corrected; based on current observations, the service is resuming normal operations. We will continue to monitor to ensure the impact has been fully mitigated. We apologize for the impact and thank y...
Supabase - Supavisor connection disruptions in EU West 1 (Ireland)
Sep 22, 10:49 UTC Investigating - Some projects in the EU West 1 (Ireland) region may experience disruptions to Supavisor connections. Our team is aware of the issue and actively working on a resolution. We’ll share further updates as they become available.
Zoom - Service degradation affecting comment and attachment features in Zoom Canvas in US region.
Sep 22, 03:32 PDT Resolved - This incident has been resolved and the affected services have been restored. Sep 22, 03:19 PDT Monitoring - On 09/22/2026, Between 09:31 UTC to 09:55 UTC, Users may have experienced issues with comment and attachment features in Zoom Canvas.This incident has been resolved and the affected services have been restored.
New Relic - Test Incident - Public Status Page -ImpactIQ
Sep 22, 08:55 UTC Resolved - Test message -resolved Sep 22, 08:55 UTC Investigating - Test message - after fix
Supabase - Project creations are degraded in multiple regions
Sep 22, 08:33 UTC Monitoring - We have identified increased latency in Project creations in these regions from 0730 UTC to 0805 UTC:ap-northeast-1ap-northeast-2eu-central-1eu-central-2eu-north-1eu-west-1eu-west-3us-west-1 The latency has since recovered and our teams are monitoring for full recovery.Existing project availability has not been impacted.
Akamai - Increased latency during upstream provider maintenance in Singapore, Hong Kong, and Japan
Sep 22, 00:30 UTC Investigating - Scheduled upstream provider maintenance is currently taking place along network routes connecting Singapore, Hong Kong, and Japan from September 18, 2026 at 06:30 UTC through October 3, 2026 at 23:59 UTC. While core service remains operational, customers in the affected regions may notice increased latency during peak traffic hours. We are monitoring network performance until maintenance concludes.Customers and partners with a valid Control Center login can fin...
AWS - Service impact: Increased Error Rates
Between 3:49 PM and 5:06 PM PDT, we experienced increased error rates affecting new instance launches in the US-EAST-1 Region. During this time, customers may have experienced elevated error rates when attempting to launch new EC2 instances through RunInstances, CreateFleet, and related EC2 launch workflows. AWS services that launch EC2 instances on behalf of customers, including Amazon ECS, AWS Fargate, Amazon EMR, amongst others were also impacted during this period. We identified the root cau...
Zoom - Zoom Phone Maintenance - CA01-YVR1 Data Center: September 21, 2026
THIS IS A SCHEDULED EVENT Sep 21, 17:00 PDT - Sep 22, 21:30 PDT Sep 15, 12:28 PDT Scheduled - Zoom will perform service maintenance at our CA01-YVR1 Data Center starting at 5:00 PM Pacific on September 21, 2026. Zoom Phone users registered to the those sip zones will be automatically registered in the CA01-YYZ1sip zone sequentially. During the maintenance window, a brief disconnection may be experienced and notifications may be missed. If you get disconnected, the system will attempt to rec...
AWS - Service impact: Increased Error Rates
We can confirm increased error rates affecting new instance launches, including elevated API error rates for RunInstances, CreateFleet, and related EC2 launch workflows in the US-EAST-1 Region. Customers attempting to launch new EC2 instances may experience launch failures or elevated API response latency. Our engineers are actively engaged and working towards recovering the issue. We are seeing initial signs of recovery. Existing instances remain unaffected. We recommend retrying failed RunInst...
AWS - Service impact: Increased Error Rates
We are investigating increased API error rates in the US-EAST-1 Region.
Zoom - Service Degradation Affecting Apple Login for Zoom Sign-in.
Sep 21, 11:17 PDT Investigating - We are currently investigating a service degradation affecting a subset of users with Apple Login for Zoom Sign-in.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers
CircleCI - Delays starting Linux Machine jobs
Sep 21, 16:48 UTC Monitoring - Task wait times for Linux Machine are returning to normal. Sep 21, 16:22 UTC Investigating - Customers may experience delays in starting jobs on Linux Machine. We are investigating.
Zoom - Zoom Phone Maintenance - EU02 - AMS4 Data Center: September 21, 2026
THIS IS A SCHEDULED EVENT Sep 21, 09:00 PDT - Sep 23, 21:30 PDT Sep 10, 14:07 PDT Scheduled - Zoom will perform service maintenance at our EU02-AMS4 Data Center starting at 9:00 AM Pacific on September 21, 2026. Zoom Phone users registered to the those sip zones will be automatically registered in the EU02-FRA4 sip zone sequentially. During the maintenance window, a brief disconnection may be experienced and notifications may be missed. If you get disconnected, the system will attempt to re...
Netlify - Errors accessing Netlify-hosted sites
Sep 21, 15:52 UTC Monitoring - A fix has been implemented and we are monitoring the results. We will provide another update as we continue to monitor recovery. Sep 21, 15:45 UTC Identified - We have identified the issue and are working to restore normal service. We will provide another update as more information becomes available. Sep 21, 15:30 UTC Update - We are continuing to investigate this issue. Customers may also experience issues accessing the Netlify application and its features. ...
Zoom - Service Degradation Affecting Zoom Virtual Agent and Zoom Contact Center in US region
Sep 21, 08:45 PDT Identified - We have identified the service degradation where users may be experiencing issues with Zoom Virtual Agent Chat Agent 1.0 and Zoom Contact Center AI Expert Assistant 1.0. Our team is actively working on a resolution, and we will keep you informed with timely updates as progress is made. Thank you for your patience.
Asana - Partial outage in Automations
Sep 21, 14:59 UTC Identified - We've heard reports of rules and automations not running in the EU region. We've identified the source of the issue and fixed it for new automations triggers going forward. Our engineers are currently working on the backlog of automations that triggered and did not run during the incident.
Datadog - Delayed Monitors Notifications
Sep 21, 05:44 EDT Investigating - We are investigating delayed evaluations for metric, service check, composite, and SLO monitors in US1 which began at Sep 21, 2026, 9:18 AM UTC.
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple
Zoom - Network Maintenance in SJC Datacenter: September 20, 2026
THIS IS A SCHEDULED EVENT Sep 20, 22:00 PDT - Sep 21, 02:00 PDT Aug 31, 00:56 PDT Scheduled - Zoom will perform service maintenance at SJC Datacenter. During the maintenance window, Users may experience an impact for a brief amount of time for services mentioned.
GitHub - Incident with Pull Requests
Sep 20, 22:32 UTC Update - A git fileserver issue caused a brief delay in creating some merge commits - we've isolated the underlying server and already observed recovery. Sep 20, 22:27 UTC Monitoring - The degradation affecting Pull Requests has been mitigated. We are monitoring to ensure stability. Sep 20, 22:13 UTC Investigating - We are investigating reports of degraded performance for Pull Requests
Zoom - Zoom Phone Update - Japan SIP Zones: September 20, 2026 (No Operational Impact)
THIS IS A SCHEDULED EVENT Sep 20, 08:00 - 10:00 PDT Sep 15, 15:49 PDT Scheduled - We will be providing an update to Zoom Phone - Japan SIP zones in Tokyo and Osaka. Please refer to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0062333 for more details. This update includes credential rotation for Zoom Phone Corporate Directory.There is no operational impact. All services will be available during this scheduled update.
Optimizely - CMP: Data Not Loading in Plan, Resources, Library, and Other Modules (GCP Stack)
Sep 20, 11:51 UTC Monitoring - A fix has been implemented and we're now monitoring the results. Sep 20, 11:29 UTC Identified - The issue has been identified and a fix is being implemented Sep 20, 11:24 UTC Investigating - We are currently investigating an issue affecting the Optimizely Content Marketing Platform (CMP), where data is failing to load across multiple modules — including Plan, Resources, and Library — for a subset of customers on the GCP stack.Our Engineering team has been enga...
Datadog - Delayed events triggered by emails
Sep 20, 01:17 EDT Investigating - We are investigating increased latency processing Events coming from inbound emails. As a result of this issue, some users may see delays or gaps in the event stream or for event queries on dashboards and for events based workflows such as on-call notifications
Zoom - Zoom Phone Update: September 20, 2026 (No Operational Impact)
THIS IS A SCHEDULED EVENT Sep 19, 17:00 PDT - Sep 20, 02:00 PDT Sep 15, 15:55 PDT Scheduled - We will be providing an update to Zoom Phone. Please refer to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0062333 for more details. This update includes credential rotation for Zoom Phone Corporate Directory.There is no operational impact. All services will be available during this scheduled update.
Supabase - Project Lifecycle Activity Degradation
Sep 19, 20:34 UTC Update - We are observing recovery in project lifecycle operations. Our team is investigating the root cause and actively working to prevent recurrence. Sep 19, 20:12 UTC Investigating - We are experiencing degradation of project lifecycle activities. We are investigating.
BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera Using 1 Extension
Hi folks, my name is Gal Weizman, I do browser security research. Excited to finally share my recent work, where I managed to hack Chrome, Comet, Edge, Opera and Claude in Chrome using one single browser extension 2 CVEs & $20,000 in bounties 🙂 Hope you like it! submitted by /u/Content-Winter5328 [link] [comments]
Xero - Xero Scheduled Maintenance - Xero Reports and NZ GST return
THIS IS A SCHEDULED EVENT Sep 19, 16:00 - 17:30 UTC Sep 15, 21:15 UTC Scheduled - We're carrying out scheduled maintenance on Sunday 20 September 2026 from 4.00am to 5.30am NZST. Customers may not be able to access Xero Reports or related reporting fields, including NZ GST return.
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI's public help forum and moved through a weakness in OpenAI's own login system. This was security research,
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote