CyberPulse

Summary: Criminal platforms now package AI—assisted fraud, token theft, and session reuse into services that sell credibility at scale. Combined with single sign—on sprawl, orchestration weaknesses, and long—lived developer access, authority is being granted without a human in the loop. This brief translates the pattern into five board actions: isolate sign—on, mandate out—of—band checks for payments, fund rapid revocation, shorten the tail of access, and isolate risky parsing.

• https://tusharvartak.com/posts/2026-09-25.html

Description: Identity gates, security controllers, workflow engines, and the browser all showed the same failure mode: privilege granted by assumption. This briefing maps the pattern — from an identity gateway flaw under active exploitation to management console abuse, an orchestration engine remote code execution, a web script injection via stolen distribution keys, and a browser—to—system exploit chain — and lays out immediate containment actions.

• https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html
• https://blog.talosintelligence.com/fmc-ongoing-exploitation
• https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks
• https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites
• https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html
• https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/
• https://www.securityweek.com/new-check-point-zero-day-vulnerability-exploited-in-the-wild
• https://tusharvartak.com/posts/2026-09-21.html

Description: Today’s CyberPulse Emerging Risks Brief argues that the next cyber crisis may be shaped by executive decision congestion rather than by a single missing patch. The briefing connects active exploitation across identity policy, secure email, firewall management, virtualization administration, browser chains, endpoint management, and AI-assisted operations into one board-level resilience question: can the enterprise make containment decisions fast enough when the control layer itself is under suspicion?

• https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs
• https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks
• https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root
• https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html
• https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html
• https://www.darkreading.com/identity-access-management-security/identity-attacks-overtake-exploits-top-ransomware-cause
• https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html
• https://www.bleepingcomputer.com/news/security/critical-fortinet-forticlient-ems-flaw-now-exploited-in-attacks/
• https://tusharvartak.com/posts/2026-09-18.html

Description: Today’s CyberPulse Emerging Risks Brief reframes recent exploitation and extortion activity as a board-level leverage problem. Gulf leaders should examine which data, digital channels, security tools, mobile devices, executive workflows, and suppliers can be converted into pressure even when core operations appear intact.

• https://www.securityweek.com/cl0p-ransomware-group-names-over-40-victims-of-ptc-windchill-campaign/
• https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html
• https://www.securityweek.com/organizations-warned-of-cisco-secure-fmc-exploitation/
• https://www.securityweek.com/new-shieldcrash-zero-day-exploit-targets-microsoft-defender/
• https://www.securityweek.com/androids-september-2026-updates-patch-180-vulnerabilities/
• https://thehackernews.com/2026/09/threatsday-ceo-phishing-kits-5k-dropbox.html
• https://www.cybersecuritydive.com/news/ransomware-extortion-intel-471/811954/
• https://industrialcyber.co/ransomware/ransomware-groups-standardize-double-extortion-and-ai-assisted-targeting-cyfirma-reports
• https://tusharvartak.com/posts/2026-09-11.html

Description: Today’s CyberPulse Daily Brief frames current exploitation as a move against systems that manufacture permission: collaboration platforms, browser fleets, enterprise application kernels, firewall management consoles, voice platforms, artifact repositories, and low-code workflow tools. Gulf security teams should prioritize assets that can issue tokens, create administrators, change policy, publish artifacts, or turn business data into authority.

• https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
• https://www.bleepingcomputer.com/news/security/google-patches-seventh-chrome-zero-day-exploited-in-attacks-this-year/
• https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/
• https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/
• https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/
• https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/
• https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/
• https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/
• https://tusharvartak.com/posts/2026-09-10.html

Description: Today’s briefing frames the current threat pattern as a tempo problem: attackers are compressing the time between disclosure, exploitation, and usable leverage across secure access, voice management, software repositories, workflow engines, model-routing infrastructure, website plugins, and social-engineering chains. Gulf security leaders should move from patch queues to evidence-backed exposure-tempo reviews.

• https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html
• https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
• https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/
• https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/
• https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/
• https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/
• https://www.securityweek.com/over-3-million-wordpress-sites-affected-by-migration-plugin-vulnerability/
• https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion
• https://www.darkreading.com/threat-intelligence/ai-gives-cybercriminals-dangerous-time-advantage
• https://tusharvartak.com/posts/2026-09-07.html

Description: Today’s CyberPulse Daily Brief frames the current threat pattern as exposure pricing: attackers are sorting reachable access appliances, browser fleets, endpoint agents, web administration surfaces, databases, and AI workflow systems by how quickly each can become leverage. Gulf security leaders should rank assets by exploitability, privilege proximity, credential value, business dependency, and containment readiness.

• https://tusharvartak.com/posts/2026-09-06.html

Description: Today’s board-level CyberPulse briefing frames the weekend risk as accumulated exceptions: exposed access paths, inherited database privileges, broad security-tool permissions, workflow automation, browser exposure, and administrative keys that turn old decisions into fresh leverage. Gulf leadership should require named ownership, expiry, containment playbooks, and proof that temporary risk can actually be revoked.

• https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html
• https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/
• https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/
• https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/
• https://www.securityweek.com/12-year-old-postgresql-vulnerability-enables-database-server-takeover/
• https://www.securityweek.com/vmware-workstation-and-fusion-updates-patch-critical-vulnerability/
• https://www.securityweek.com/google-patches-6th-chrome-zero-day-of-2026/
• https://www.securityweek.com/vulnerabilities-patched-in-crowdstrike-tenable-products/
• https://tusharvartak.com/posts/2026-09-05.html

Description: Today’s board-level CyberPulse briefing argues that the most important cyber constraint is no longer only vulnerability volume; it is executive reaction capacity under compressed attacker timelines. The priority for Gulf leadership is to pre-authorize containment, reduce concentrated access dependencies, and rehearse high-consequence decisions before hostile operators consume the organization’s time.

• https://www.darkreading.com/vulnerabilities-threats/ai-machine-speed-cuts-2-week-attack-down-to-10-hours
• https://www.darkreading.com/application-security/ai-vulnerability-surge-manageable
• https://www.darkreading.com/cyberattacks-data-breaches/threat-gang-springs-vishing-attacks-microsoft-teams-users
• https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html
• https://www.bleepingcomputer.com/news/security/interlock-ransomware-exploited-secure-fmc-flaw-in-zero-day-attacks-since-january
• https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs
• https://www.bleepingcomputer.com/news/security/trend-micro-warns-of-apex-one-zero-day-exploited-in-attacks
• https://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks
• https://tusharvartak.com/posts/2026-09-04.html

Description: Today’s briefing argues that attackers are choosing the shortest operational routes from exposed service to business pressure: remote-access gateways, deprecated virtual private network paths, low-code artificial intelligence platforms, print-management servers, file-transfer hubs, and web application frameworks. Gulf security teams should prioritize hotfixing, reachability reduction, forensic evidence collection, credential rotation, and explicit ownership of every high-consequence hot path.

• https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
• https://bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws
• https://www.cybersecuritydive.com/news/check-point-zero-day-ransomware/822372
• https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/
• https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html?m=1
• https://www.securityweek.com/papercut-exploitation-escalates-to-active-intrusions/
• https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/
• https://infosecurity-magazine.com/news/attackers-steal-metr-api-key
• https://tusharvartak.com/posts/2026-09-03.html