WeWorm has China's attention, as calls for AI slowdown and regulation continue.

Summary

By the N2K CyberWire staff

WeWorm has China's attention, as calls for AI slowdown and regulation continue.

The New York Times reports that Chinese analysts are alarmed by an AI-built proof-of-concept tool crafted by a team of researchers in California that could have launched a worm attack against millions of WeChat users by simply calling compromised accounts' contacts. WeChat has 1.4 billion monthly users and is deeply embedded in Chinese communications, government services, and payments. The Times says the discovery could shape upcoming talks between President Trump and Xi Jinping, which are expected to cover AI security among other issues.

Separately, OpenAI's Chief Global Affairs Officer Chris Lehane published a blog post calling for mandatory national AI safety requirements, saying Congress should implement the company's Blueprint for Democratic Governance of Frontier AI⁠. OpenAI also announced its support for four California AI safety bills headed to Governor Gavin Newsom's desk.

See attack paths across AWS, Okta, GitHub, and more

BloodHound Enterprise extends attack path management across your hybrid environment, mapping how identities, permissions, and trust connect across AWS, cloud, and identity providers so teams can find and break the paths that reach critical assets. Try BloodHound Enterprise today.

Russia's Cozy Bear used Claude to automate operations.

Anthropic has published a threat report outlining malicious use of its Claude AI over the past eight months, noting that the Russian threat actor Midnight Blizzard (also tracked as "APT29" or "Cozy Bear," a group attributed to Russia's SVR) used Claude to assist in "operations attacking military intelligence targets in Ukrainian and European governments, as well as diplomatic and defense organizations and individuals connected to US foreign policy." The threat actor used "customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration."

McKesson data breach affected 6.4 million people.

Have I Been Pwned has disclosed that last month's cyberattack against healthcare and pharmaceutical company McKesson exposed personal and health information belonging to 6.4 million people, the Register reports. The type of data involved varied by individual, but HIBP says the breach affected names, dates of birth, email addresses, employers, genders, personal health data, phone numbers, and physical addresses.

The ShinyHunters extortion group claimed responsibility for the attack, and has since published the data after apparently failing to extract a $55 million ransom from McKesson.

Notes.

Today's issue includes events affecting , and Russia the United States.

Attacks, Threats, and Vulnerabilities

GitLab urges users to patch max severity path traversal flaw (BleepingComputer) GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706.

ID verification giant IDScan confirms data breach with more than 150 million driver's licenses stolen (TechCrunch) The ID checking company said the data breach included people's full names and driver's licenses and other government-issued identity documents.

Legislation, Policy, and Regulation

EU's Cyber Resilience Act starts the 24-hour vulnerability clock (The Register) Manufacturers must now disclose actively exploited flaws and severe security incidents through ENISA's new reporting platform

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Open Source Security Summit (Virtual, Sep 17, 2026) The seventh annual Open Source Security Summit brings together business leaders, industry visionaries, and technology users to chart a path forward and highlight the future of open source security solutions at this free virtual event. Register now to explore advancements in open source security and how using open source tools can build trust with customers and consumers.

Events

Cybersecurity Operational Methods and Education Training (COMET) cohort (Virtual, USA, Aug 31 - Sep 28, 2026) COMET was established to provide relevant, up-to-date training to Maryland state and local government employees to elevate the ability of the workforce to identify and respond to the largest cybersecurity challenges facing the state and local government.

.conf26 (Denver, Colorado, USA, Sep 14 - 17, 2026) .conf26 is a three-day conference filled with hands-on training, AI insights, new certifications, fun celebrations, and endless opportunities to see how others use Splunk. Take your skills to the next level and build your most resilient defense yet. See you in Denver!

AI Security Summit 2026: State of Trust (Virtual, Sep 16 - 17, 2026) AI can now autonomously identify and exploit software vulnerabilities at near-expert level, and that capability is already in deployment. Autonomous systems have become part of the attack surface itself. Cloud architecture is being rearchitected around AI at speed. Identity perimeters are dissolving under the pressure of non-human access at scale. Zero Trust has moved from framework to survival requirement. Across all three pillars of modern enterprise security, the question of trust has never been more consequential or more contested. Join CSA for the AI Security Summit 2026: State of Trust, a free two-day virtual flagship event taking place September 16–17, 2026. Over two days, you'll get direct access to the research, standards, and practitioner guidance shaping five of the most consequential shifts in security today: agentic and autonomous AI security, quantum readiness, non-human identity management, global governance and assurance, and the next evolution of adaptive threat defense and Zero Trust. Built on CSA's vendor-neutral research and direct work with CISOs and industry leaders worldwide, this is where the global cloud, AI, and Zero Trust community comes to see clearly where trust actually stands, and where it's headed next.

Uniting Women in Cyber 2026 (Tysons, Virginia, USA, Oct 8, 2026) At UWIC 2026, our theme Creative Cyber: Amplified Intelligence reflects the energy and evolution of cybersecurity today. Join us to explore how human ingenuity and AI come together to outpace emerging threats and build a more creative, resilient future.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 09.11.26

Top stories.

WeWorm has China's attention, as calls for AI slowdown and regulation continue.

Russia's Cozy Bear used Claude to automate operations.

McKesson data breach affected 6.4 million people.

Notes.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Newly Noted Events

Events