Microsoft described CVE-2026-65660 as a CVSS 6.5 spoofing issue; researcher Dinh Ho Anh Khoa showed it is actually a code-injection flaw (CWE-94) enabling authenticated remote code execution, and CISA added it to the KEV catalog on September 25, 2026 after observed attacks. Apply the August 11 patch and audit your SharePoint 2016, 2019 and Subscription Edition servers.
On September 16, 2026, CISA released its first guide to cyber decoys — fake systems, accounts, and data that detect an attacker already present and using legitimate tools. Start with self-hosted honeytokens before considering a commercial platform.
On September 8, 2026, a joint advisory from the NSA, FBI and CISA described “industrial-scale distillation” of American frontier AI models by DeepSeek, Alibaba, Moonshot AI and three other Chinese players, routed through a gray market of proxies called “transfer stations”. For model providers it is a countermeasure playbook; for enterprises it is one more due-diligence question about where their dependencies come from.
On August 19, 2026, CISA added CVE-2026-64849, an unauthenticated SSRF in MLflow, to its Known Exploited Vulnerabilities catalog. Any exposed MLflow tracking server should move to 3.15.0 and drop unused webhooks before the September 2, 2026 deadline.
On August 18, 2026, the FBI, CISA and HHS updated their joint advisory on the Medusa ransomware: more than 500 critical infrastructure victims since 2021, up from 300 in March 2025. Defenders need to patch the exploited flaws and segment networks before the gang does it for them.
CISA added CVE-2026-33824, a remote code execution flaw in Windows IKE, to its Known Exploited Vulnerabilities catalog on August 18, 2026 — four months after Microsoft shipped the fix. Network teams must patch exposed IPsec gateways or block inbound UDP 500 and 4500 now.
On August 5, 2026, CISA added three critical vulnerabilities to its KEV catalog: CVE-2026-9198 in IBM Langflow (CVSS 9.8), CVE-2026-18576 in N-able N-central, and CVE-2026-34486 in Apache Tomcat. Federal agencies must patch immediately.
On August 3, 2026, CISA issued an urgent alert after attackers disrupted more than 30 community water systems in Minnesota within 48 hours. The attackers targeted internet-exposed programmable logic controllers (PLCs), changed passwords, and disconnected equipment from the network. Censys counts over 10,000 Rockwell, Siemens, and Schneider PLCs publicly accessible.
