Daily digest

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco released security updates for a maximum-severity vulnerability in Identity Services Engine that attackers are actively exploiting in the wild. The company did not release full technical details but confirmed in-the-wild exploitation ahead of patch availability.

Why it matters: ISE is a core network access control/802.1X component in many CMMC L2 environments; if deployed, patch immediately and review authentication logs for signs of compromise given active exploitation.

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft confirmed the September 2026 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials. Microsoft has published a temporary workaround while it investigates a permanent fix.

Why it matters: This directly threatens an Intune-managed Windows 11 fleet joined to on-prem or hybrid AD; test the September patch in a pilot ring and have the workaround ready before broad deployment to avoid mass login lockouts.

Google Pixel phones pwned in zero-click attacks

Google disclosed a high-severity Pixel Cellular Modem privilege escalation flaw (CVE-2026-58704, CVSS 8.0) that is under limited, targeted zero-click exploitation. CISA has given federal agencies just three days to patch under its binding operational directive process.

Why it matters: If any Pixel devices are enrolled in Intune for government use, they fall under the aggressive federal patch timeline; verify enrollment status and push the update immediately.

Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

Mandiant reported that an attacker hijacked an active AI coding-assistant session at a SaaS provider and used it to spread the Shai-Hulud worm across roughly 100 internal code repositories. The assistant had recommended a poisoned software package, and the recommendation was accepted before the worm stole repository secrets and source code.

Why it matters: This is a concrete supply-chain scenario for shops using AI coding assistants alongside Ansible/CI pipelines — audit AI-assisted code suggestions and secrets stored in repos, and restrict agent session permissions.

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security

A phishing-as-a-service kit called N0va is running campaigns against North American and European organizations that impersonate trusted services and abuse legitimate authentication flows to steal valid account credentials without deploying obvious malware. Researchers say a single compromised identity can cascade into access to sensitive data and cloud systems.

Why it matters: Reinforces the case for phishing-resistant MFA (FIDO2/certificate-based) and Conditional Access hardening in M365 GCC High tenants, since credential-flow abuse can bypass standard MFA prompts.

CISA decides weekly vulnerability bulletin isn't necessary anymore

CISA is retiring its long-running weekly vulnerability bulletin, effective September 28, as part of a shift from static CVSS scoring toward risk-based prioritization. The agency says the change reflects a move toward more actionable, context-driven vulnerability guidance.

Why it matters: Teams that rely on the weekly bulletin for POA&M and vulnerability-management evidence under NIST 800-171 should identify CISA's replacement feed/format now to avoid a gap in documented monitoring processes.

Beyond the town halls: Getting ready for CIRCIA before the clock starts ticking

A commentary piece argues that organizations covered by the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) have largely treated the coming reporting requirements as a future concern rather than building an actual compliance program now. It urges covered entities to establish incident-reporting workflows ahead of the rule's enforcement date.

Why it matters: CIRCIA reporting timelines will layer on top of existing CMMC/DFARS incident-reporting obligations; now is the time to map internal detection-to-notification workflows to the eventual CIRCIA clock.

Architecting a secure landing zone in the AWS European Sovereign Cloud

AWS published a reference architecture for building a secure landing zone within the new AWS European Sovereign Cloud, a physically and logically separate partition (aws-eusc) with its own control plane and identity services. The guidance covers account structure, identity, networking, and security tooling for the sovereign partition.

Why it matters: The landing-zone patterns AWS describes for its EU sovereign partition mirror concepts relevant to AWS GovCloud account/organization design — worth reviewing for landing-zone hardening ideas even outside the EU context.

AWS says wartime damage means some Middle East cloud resources are gone for good

AWS confirmed that Iranian strikes caused damage that overwhelmed regional redundancy in its Bahrain region and left one UAE Availability Zone permanently inaccessible, with some customer resources unrecoverable. AWS is working with affected customers on recovery options.

Why it matters: A reminder that even hyperscaler multi-AZ redundancy has real-world physical limits — validate that GovCloud DR/backup strategy doesn't assume regional resilience is unconditional.

Coast Guard, FBI boarded tanker after attack by 'foreign cyber actors'

U.S. Coast Guard and FBI personnel boarded an oil tanker in the Gulf of Mexico to verify the integrity of its operational and IT systems after the vessel was hit by a cyberattack attributed to foreign actors. The Coast Guard confirmed the incident but did not release additional technical details.

Why it matters: Illustrates ongoing state-linked targeting of OT/maritime infrastructure — a useful data point when briefing leadership on the broader threat landscape facing critical infrastructure sectors.

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

A critical vulnerability in Issabel Framework, an open-source unified communications PBX platform, is under active exploitation. CVE-2026-89026 (CVSS 9.8) stems from a hard-coded credential that allows unauthenticated attackers to execute arbitrary OS commands.