A clearer view of today.

Cisco SD-WAN Manager authentication bypass is under active exploitation

Cisco says attackers are exploiting CVE-2026-76504, a critical unauthenticated API authentication bypass in Cisco Catalyst SD-WAN Manager that can grant admin-level access. Rapid7 reports that vendor updates are available, there is no workaround, and recommends emergency patching and checking affected systems for compromise.

Why it matters For operators of internet-facing SD-WAN Manager systems, patching alone is not a complete response: reported exploitation also warrants checking whether attackers already gained access.

What to watch next Rapid7 expects vulnerability checks in its October 1 content release; the source does not confirm their delivery.

Google reports rapid exploitation of an AI-discovered BeyondTrust flaw

Google Threat Intelligence Group says attackers exploited CVE-2026-1731, an unauthenticated command-injection flaw in BeyondTrust products, within four days of public disclosure; five additional clusters used it within seven days. The report says attackers escalated privileges, exfiltrated data, and deployed payloads including SNOWLIGHT, SPARKRAT, and cryptominers. GTIG also found that half of the vulnerabilities it attributed to AI discovery enabled remote code execution, compared with 26% of flaws found by other means.

What changed Observed exploitation expanded from one threat cluster within four days of disclosure to six within seven days.

Why it matters BeyondTrust customers faced demonstrated data theft and follow-on payload deployment, not merely a theoretical command-injection risk. The observed campaign makes exploitation evidence more decision-useful than the flaw's AI-discovery label.

OpenInfra Europe warns artifacts from breached JFrog instance may be compromised

OpenInfra Europe says attackers compromised its self-hosted JFrog Artifactory instance. It warned users who downloaded or installed artifacts from artifactory.nordix.org between August 28 and September 15, 2026, to stop using them, remove them from pipelines, and treat them as potentially compromised.

Why it matters Teams that obtained artifacts during the warning window need to interrupt their use in build pipelines; the notice does not establish that every downloaded package was altered.

AI coding agents exposed more than 13,000 company screenshots on GitHub

Glow Labs researchers say they found more than 13,000 internal images posted publicly on GitHub by developers at over 300 organizations, across more than 900 repositories. The screenshots reportedly include customer billing records; the report attributes the exposure to AI coding agents posting evidence of interface fixes in public repositories.

Why it matters The exposure reaches customers, not just developers: screenshots published in public repositories contain billing records, turning development evidence into a channel for disclosing business data.

Google says Gemini 4 Argon can identify and patch software vulnerabilities

Google announced Gemini 4 Argon and is initially making it available to trusted cyber defenders through its Fairwind Program. Google says the model can find, validate, and patch critical software flaws without human help, and reported finding a critical vulnerability exposing personal information in healthcare software; it did not identify the software or say whether the flaw was patched. Google says it is testing safeguards and plans a phased rollout.

What changed Google reports that Argon found a healthcare-software vulnerability missed by earlier frontier models. This is a specific vendor-reported result, not independent proof of general superiority.

Why it matters Hospitals cannot determine from this announcement whether they use the affected software or whether the reported personal-information exposure has been closed; the product and patch status remain undisclosed.

What to watch next Google says broader access will begin with paid API customers and Google AI Ultra subscribers after the initial defender rollout; no release date is provided.

OpenSSL DTLS flaw could disclose heap data or crash applications

OpenSSL disclosed CVE-2026-84782, a high-severity out-of-bounds read in DTLS retransmission handling. The CyberExpress reports that a remote peer could receive unintended plaintext heap memory during a handshake or trigger denial of service, and lists affected OpenSSL versions as 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2.

Why it matters Applications using OpenSSL's DTLS implementation face both confidentiality and availability risks during handshakes: a remote peer could receive unintended process memory or cause denial of service. The report does not establish the same exposure for ordinary TLS connections.