Cisco ISE Vulnerability ,Cisco Gateway Compromised, Revolut Breach Escalates

It was a brutal week for enterprise infrastructure and consumer trust alike. Cisco disclosed two actively exploited zero-days in as many days, Revolut’s data breach escalated into a public $3 million extortion attempt, and Spain logged what regulators believe is the first data breach carried out autonomously by an AI agent. Add in a hijacked HBO Max Reddit account, a supply-chain hit on marketing platform Brevo, and a fresh wave of ransomware claims, and it’s clear attackers aren’t slowing down as autumn sets in.

Cisco’s Identity Services Engine hit by a perfect 10.0 zero-day

Cisco rushed out emergency patches after confirming active exploitation of CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine (ISE) and ISE-PIC. The flaw sits in an API endpoint with insufficient authentication controls, letting an unauthenticated attacker bypass the management interface entirely — and potentially gain root-level command execution. CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to patch. (SecurityWeek)

…and a second Cisco zero-day hit its Secure Email Gateway

Just two days before the ISE bug surfaced, Cisco confirmed a separate actively exploited zero-day, CVE-2026-76461, a SQL injection flaw in Secure Email Gateway appliances. Cisco’s incident response team says it first spotted exploitation activity back in 2025 and has now shared indicators of compromise so admins can check whether they’ve already been hit. (Help Net Security)

Revolut breach turns into a public $3 million shakedown

Fintech giant Revolut confirmed that a hacker impersonating an Italian government agency tricked it into handing over customer data — including passports, driver’s licenses, verification selfies, and transaction histories — over a five-month period. This week a group calling itself “iamnotavillain” publicly demanded roughly $3 million in Monero, threatening to sell records tied to about 680 high-profile customers within 24 hours. (SecurityWeek)

Spain logs the first data breach allegedly executed by an AI agent

Spain’s data protection authority, the AEPD, says it received a breach notification describing an attack chain carried out autonomously by an AI agent built on a mainstream large language model. The agent reportedly scanned for vulnerabilities, logged in, found a flaw, and then modified personal data and accessed invoices — all without a human directing each step. Regulators are treating it as an early signal that AI is compressing attack timelines dramatically. (Reuters via The Star)

Hacked HBO Max Reddit account used to push malware ads

Attackers hijacked HBO Max’s verified Reddit account (u/hbomax) and ran 108 malicious ads over 48 hours as part of a campaign researchers are calling “PasteSwitch.” Victims were lured with a fake macOS app and pushed through ClickFix-style prompts that tricked them into pasting malicious commands into Terminal or PowerShell, delivering infostealers like MacSync and Amatera Stealer. (BleepingComputer)

Brevo supply-chain attack served malware to 100,000+ websites

Marketing platform Brevo confirmed attackers stole a hardcoded Cloudflare API key and used it to inject malicious scripts into its own site and widgets embedded across more than 100,000 customer websites. For roughly five and a half hours, visitors saw a fake “verify you’re human” prompt that led to a ClickFix attack, while logged-in WordPress admins risked having a backdoor plugin silently installed. (BleepingComputer)

IDScan’s 153-million driver’s license breach keeps growing

The fallout from identity-verification firm IDScan’s breach continued this week, with the company now facing multiple lawsuits after a dark-web marketplace called “Nexus” advertised over 153 million U.S. and Canadian driver’s licenses, plus millions of ID cards, travel documents, and medical cards. Investigative journalist Brian Krebs verified the data was real — even finding U.S. Defense Secretary Pete Hegseth’s license in the cache — and the FBI has opened an investigation. (BleepingComputer)

N0n ransomware group claims PayPal’s support vendor Transcom

The ransomware group N0n says it breached Transcom WorldWide, the company that runs PayPal’s customer support operations, and is threatening to leak 86.7 million connection records unless it’s paid off. Neither Transcom nor PayPal has confirmed the scope of the claim publicly. (DeXpose)

Same group hits the United Federation of Teachers

N0n also claimed a separate attack on the United Federation of Teachers, a major U.S. labor union, threatening to leak over 181,000 sensitive documents if its demands aren’t met. It’s part of a busy week for the group, which appears to be targeting large membership and support organizations for their bulk personal data. (DeXpose)

Panzer ransomware strikes a Paraguayan tech firm

The Panzer ransomware gang claimed responsibility for an attack on Inovapy, a technology company based in Paraguay, warning that sensitive data will be published unless a ransom is paid. It’s one of several claims this week from Panzer, which has been targeting victims across multiple countries in short succession. (DeXpose)

Ransomware disrupts a Midwest water treatment facility

A water treatment facility in the U.S. Midwest was hit by ransomware this week, disrupting operations and reportedly exposing sensitive data. The incident lands amid a broader wave of OT-focused warnings, underscoring how critical infrastructure remains a favored — and vulnerable — target. (Security Boulevard)

Critical Siemens PLC flaw could let attackers manipulate industrial controls

Siemens disclosed a critical vulnerability affecting multiple programmable logic controller (PLC) models that could allow unauthorized remote access and let attackers manipulate control systems. Patches are now available, and Siemens is urging all affected customers to update immediately given the risk to industrial operations. (Security Boulevard)

CISA pushes federal agencies to patch faster under BOD 26-04

This week’s Cisco ISE zero-day was folded into CISA’s ongoing enforcement of Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize patching based on real-world exploitation risk rather than treating all vulnerabilities equally. The directive also requires agencies to check whether they were compromised before a patch was even applied — a notable shift in how “patch and move on” incident response is being treated. (SecurityWeek)

Google plans to restrict on-device ADB access after malware abuse

Following a wave of Android malware abusing Wireless Debugging (ADB) to gain shell-level access without root privileges, reports this week detailed Google’s plans to tighten on-device ADB restrictions starting later in 2026. Security researchers have flagged that legitimate developer tools like Shizuku could be affected, even as the change aims to close a path abused by malware that silently enables debugging mode to take over infected phones. (DEV Community)

The growing threat landscape highlights why SPF, DMARC, DKIM, and strong cybersecurity defenses are essential for protecting organizations against phishing, spoofing, malware, supply-chain attacks, and data breaches.