Cisco patches a maximum-severity zero-day.

Summary

By the N2K CyberWire staff

Cisco patches a maximum-severity zero-day.

Cisco has issued a patch for a maximum-severity, actively exploited flaw affecting its Identity Services Engine (ISE), the Register reports. The company stated, “This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.”

Cisco has shared indicators of compromise to help customers identify exploitation, but the company notes that the attackers can erase evidence if they’ve obtained root access on the device. As a result, Cisco “strongly recommends that administrators cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.”

AI adoption isn't waiting for security to catch up.

As organizations race to adopt AI, security teams face a difficult challenge: enabling innovation without losing visibility into the tools, identities, permissions, and data entering their environments.

Stephen Harrison, VP of Product at Abnormal AI, explains why simply blocking AI isn't the answer and how security leaders can approach adoption with greater control.

Listen to the full conversation to learn how to enable AI without losing sight of the risks.

Gyazo data breach affects more than 23 million user records.

Japanese software company Helpfeel has disclosed a breach affecting its popular image-sharing service Gyazo, SecurityWeek reports. The company says an attacker exploited a vulnerability in its image upload server on September 11th and gained access to a database containing 23.6 million user records. The compromised data included names, email addresses, password hashes, user and device IDs, X integration tokens, profile information, usage statistics, and billing information.

Additionally, the company stated, “We have confirmed that approximately 490 million metadata records associated primarily with images registered in or before January 2019 (approximately 14.4% of all image-related data) were disclosed without authorization…The affected metadata includes information used to construct Gyazo image URLs. This information could be used by a third party to access and view the corresponding images without authorization.”

China's FamousSparrow deploys a new backdoor.

ESET says the China-linked cyberespionage group FamousSparrow is deploying a new backdoor dubbed "SparroWocky" against several Latin American countries. The APT began targeting Latin America almost exclusively beginning in mid-2025, and has deployed SparroWocky against "governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela." ESET notes that this "represents a rare occurrence among the China-aligned APT groups that we currently track, which are generally observed throughout various world regions within such an extended time frame." The researchers believe this heightened targeting of Latin America is a reaction to the United States's increased interest in the region, which potentially threatens China's long-term investments in Central and South America.

Attacks, Threats, and Vulnerabilities

New Check Point flaw lets hackers execute code with root privileges (BleepingComputer) Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems.

‘Doom Loop’: OpenAI and Microsoft Admits LLMs Are Destroying the Web and Built on Theft (404 Media) "Millions of people around the world will soon consider large models ‘hoovering up’ all their work to be an astonishing theft of unprecedented proportions."

Legislation, Policy, and Regulation

USA’s Venezuela takeover comes with bonus exposure to Chinese AI surveillance tech (The Register) Think tank points out that companies banned by Washington will help run the regime that Uncle Sam now controls

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Cybersecurity Operational Methods and Education Training (COMET) cohort (Virtual, USA, Aug 31 - Sep 28, 2026) COMET was established to provide relevant, up-to-date training to Maryland state and local government employees to elevate the ability of the workforce to identify and respond to the largest cybersecurity challenges facing the state and local government.

Uniting Women in Cyber 2026 (Tysons, Virginia, USA, Oct 8, 2026) At UWIC 2026, our theme Creative Cyber: Amplified Intelligence reflects the energy and evolution of cybersecurity today. Join us to explore how human ingenuity and AI come together to outpace emerging threats and build a more creative, resilient future.

AI Security Summit 2026: Runtime Trust (Virtual, Oct 21 - 22, 2026) AI agents no longer just request access. They take action. They plan, negotiate, and execute across your cloud and enterprise systems, often without a human in the loop. Traditional security answers one question: should this user have access? It has no answer for the one that matters now: should this agent be allowed to take this action, right now, in this context? That's the question AARM (Autonomous Action Runtime Management) was built to answer. Originally developed by Vanta and donated to the Cloud Security Alliance as an open, vendor-neutral specification, AARM defines how to intercept an agent's actions before they execute, evaluate them against context and policy, and stop the ones that shouldn't happen. Nearly 100 companies are already building on it, and CSA is now the permanent home stewarding where it goes next. Join CSA, Vanta, and Insecure Agents for the AI Security Summit 2026: Runtime Trust, a free, two-day virtual event on October 21–22, 2026, going deep on AARM alongside STAR for AI Level 2 and the fastest-moving, time-sensitive frontier of AI security shaping the year ahead.

[un]prompted II (Virtual and San Francisco, California, USA, Oct 27 - 29, 2026) [un]prompted is back for the second time, this October, in SF. Whether you’re a CISO Excel jockey or a researcher sniffing for the scent of bits, we see you as part of our wider AI security practitioner community. [un]prompted is an intimate, raw, and fun gathering for the professionals actually doing the work, from offense to threat hunting to program building to national policy. No fluff. No filler. Just sharp talks, real demos, and conversations that matter.

CyberSat 2026 Unclassified Program (Reston, Virginia, USA, Nov 2 - 3, 2026) Space systems now form the backbone of critical infrastructure – from energy grids to autonomous transportation. CyberSat is the only forum where the operators, officials, and engineers actively defending those systems meet for four days a year.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 09.18.26

Top stories.

Cisco patches a maximum-severity zero-day.

Gyazo data breach affects more than 23 million user records.

China's FamousSparrow deploys a new backdoor.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Events