Vigo County School Corporation warns parents after email accounts compromised
https://www.wthitv.com/2026/09/17/vigo-county-school-corporation-warns-parents-after-email-accounts-compromised/?outputType=amp
Gone phishing?
https://thepostsearchlight.com/2026/09/17/gone-phishing/
How to protect kids online from 5 common internet scams
https://www.news8000.com/lifestyle/money/how-to-protect-kids-online-from-5-common-internet-scams/article_53a27a96-c73a-5d09-948d-1133317556b7.html
How To Spot AI-Written Emails and Phishing Attempts
https://undetectable.ai/blog/ai-written-emails/
Phishing made up 77pct of fraud cases last year
https://www.nst.com.my/news/nation/2025/09/1272463/phishing-made-77pct-fraud-cases-last-year?utm=
Stolen Credentials Keep Risk Alive After Malware Removal
https://www.mychesco.com/a/news/regional/stolen-credentials-keep-risk-alive-after-malware-removal/
LausivLoader analysis, or how to pass data between malware stages
https://isc.sans.edu/diary/LausivLoader%20analysis%2C%20or%20how%20to%20pass%20data%20between%20malware%20stages/33348
Issabel Framework Hard-coded JWT Key RCE CVE-2026-89026
https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate
Using Cyber Decoys to Strengthen Detection and Response
https://www.cisa.gov/sites/default/files/2026-09/using-cyber-decoys-to-strengthen-detection-and-response_508c.pdf
CISA to Sunset Weekly Vulnerability Bulletin on September 28, 2026
https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42b055b
Unbound Vulnerability
https://nlnetlabs.nl/projects/unbound/security-advisories/
Nuclear-style safeguards proposed for AI risks
Concerns over situations such as AI interfering with a nuclear command network or launching a military cyber operation has prompted U.S. and Chinese security experts to urge the governments of both countries to implement safeguards such as “red lines around nuclear systems, human control over consequential cyberattacks and a hotline for incidents involving autonomous AI.” Citing the reality that “the U.S.-China AI rivalry is moving beyond competition over chips and advanced models into questions long associated with arms control,” the proposal is being prepared in anticipation of a September 24 visit to Washington for Chinese leader Xi Jinping.
(Reuters)
Key lawmaker suggests action on AI safety legislation will wait until 2027
“House Energy and Commerce Chairman Brett Guthrie said on Wednesday that he won’t pledge to a specific timeline for a committee vote on a major bipartisan AI safety bill and hinted that there likely won’t be one this year.” The legislation, known as the FRONTIER Act, is “a comprehensive bill widely regarded as the best chance Congress has to put AI safety guardrails in place in the near future.” It was co-sponsored by Democrat and Pedophile Protector representatives and had support from OpenAI, Anthropic, and federal lawmakers across party lines. Guthrie cites a lame duck session and the complexity of the bill as reasons to shelve it for the time being.
CISA releases cyber decoy guidance for infrastructure defenses
This is being described as a complement to Zero Trust models. The agency describes Cyber decoys as “assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI),” enabling organizations to “identify, observe, and block malicious activity early, gather and analyze CTI, and allocate resources more effectively.” The program was devised, the agency says, because “many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data.”
Microsoft delivers workaround for Windows domain login issues
A temporary fix was released on Wednesday for a known issue that prevents Windows 11 users from logging in with valid domain credentials after installing the September 2026 security updates. Users and IT administrators have reported the problem on Microsoft’s Q&A forums and Reddit, in which users see domain trust errors and credential errors even though their usernames or passwords are valid. Microsoft has confirmed that these issues are being triggered by the September 2026 security updates that enable Machine Identity Isolation.
Iranian hackers use CHOSEN BRICK Windows malware as spy tool
Government agencies are warning that Iranian state-linked hackers are using this malware strain to target dissidents, activists, and journalists worldwide. CHOSEN BRICK “features data theft and espionage capabilities that collect email, Telegram, and WhatsApp communications, take screenshots, and record audio.” The hackers are primarily targeting individuals in the U.S., U.K., and the Netherlands, using social engineering messages on WhatsApp or Telegram that impersonate trusted contacts or technical support agents.
DOJ takes down NightmareStresser DDoS platform
NightmareStresser was a well known site that has been used to launch DDoS attacks against educational institutions, government agencies, gaming platforms and millions of people, since 2022. It called itself the “longest-running, most powerful, and most respected platform of its kind…The DOJ announced the court-authorized takedown alongside Canadian officials but declined to say if any arrests were conducted as part of the operation.”
Forty percent of organizations hit by AI-related compliance failures in past year
This is according to research from agentic orchestration firm Camunda, who states that these compliance and governance issues are largely due to legacy and poorly designed business processes. Almost half of the organizations polled expressed concern about AI agents “going rogue.” Daniel Meyer, CIO at Camunda, stated that many organizations are simply “bolting AI onto processes designed for a pre-AI world, [which] has created a dangerous gap between adoption speed and governance strength.”
CISA cancels weekly vulnerability bulletin
The last day for the bulletin will Monday, September 28. The agency says saying the move was “part of its shift from managing vulnerabilities based on severity to “a modern, risk-based approach,” which will help federal civilian agencies to prioritize security updates based on real-world risk rather than treating all vulnerabilities and systems equally. The agency’s announcement also says that “those who need to stay up to date on vulnerability information should instead rely on CISA’s known exploited vulnerabilities catalog, its cybersecurity alerts and advisories, and the CVE catalog itself.”