CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

thehackernews.com Sep 20, 2026

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

Curated by Shubham · TechCapsules · Sep 20, 2026

AI-summarised brief · reviewed before publication

The U.S. Cybersecurity and Infrastructure Security Agency added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Red Hat issued advisories on September 19, 2026, urging high‑priority fixes and noting public exploits. Federal agencies are directed to patch by September 21 under BOD 26‑04. The flaws—CVE‑2026‑80844, CVE‑2026‑81000, CVE‑2026‑68121, and CVE‑2026‑74469—were disclosed by researcher Asim Manizada and involve local privilege escalation. The incidents underscore the growing threat of AI‑driven attacks on enterprise systems.

💡 Why It Matters

· The rapid patching mandate signals a shift toward stricter federal security compliance, forcing agencies to prioritize kernel updates.
· It also highlights how AI tools are accelerating exploitation, demanding tighter runtime identity controls.

Capsules Cybersecurity

Read full article on thehackernews.com

CID trains officers in cybercrime investigation, digital forensics

The Crime Investigation Department (CID) of Andhra Pradesh concluded a three‑day training programme on cyber security and cyber hygiene for its investigation officers on Saturday at the headquarters in Vijayawada. Directed by CID Director General of Police Ravi Shankar Ayyanar, the course aimed to boost police capability in probing cyber offences and to instill practices in safety. Cyber‑security expert Sandeep Madulkar, CEO of Sytech Labs, served as the resource person, delivering modules on emerging threats, digital arrest scams, evidence collection, social‑media crime, financial fraud, web intelligence, IP tracing, malware analysis and forensic tools. Sessions covered dark‑web investigations, anonymity tactics, blockchain and cryptocurrency probes. Participants included CID superintendents and officers from state wings, such as R. Gangadhar and P. Parameshwar Reddy.

💡 Equipping officers with advanced digital forensics tools directly strengthens law‑enforcement’s ability to disrupt sophisticated cyber fraud networks in the region.

thehackernews.com · Sep 19

Identity Visibility in 2026: The Foundation of Identity Security

Identity visibility, the ability to see every identity, its access rights, and runtime usage, is recognized as the foundation of identity security. Stolen credentials remain the top initial access vector in breach reports, and cloud complexity creates a surface of “identity dark matter” – local accounts, embedded service credentials, and legacy flows that evade central IAM. Traditional IAM tools report intended permissions but not actual enforcement or usage, leaving gaps that attackers exploit with legitimate‑appearing activity. Effective visibility requires three capabilities: accurate inventory of actors, mapped access relationships that reveal effective permissions, and contextual analysis to prioritize risks. Normalizing disparate cloud identity models enables a view across environments, allowing security teams to detect and remediate privileges before they are abused.

💡 Without full visibility, organizations cannot differentiate between documented and exercised privileges, leaving exploitable gaps that attackers routinely leverage.

9to5mac.com · Sep 19

Apple @ Work: Enterprise oassword management is still hard, and Dashlane’s new Vault Enforcement aims to…

Mosyle, the sole Apple Unified Platform, promotes its enterprise‑grade solution for deploying, managing, and protecting Apple devices, citing trust from over 45,000 organizations. A recent viral X post highlighted the security of handwritten passwords, prompting discussion about password management tools. In response, Dashlane announced a new Vault Enforcement feature designed to strengthen credential security in corporate environments. The update aims to address persistent challenges in enterprise password management and enhance overall security posture for organizations using Apple devices.

💡 Dashlane’s Vault Enforcement tackles a long‑standing gap in enterprise security, offering a practical tool that could reduce credential breaches and streamline compliance for businesses reliant on Apple ecosystems.

thehackernews.com · Sep 19

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

Orkes Conductor, a workflow automation platform, is under active exploitation due to CVE‑2026‑58138, a critical unauthenticated remote code execution flaw (CVSS 9.8). The vulnerability allows attackers to run arbitrary OS commands by submitting malicious JavaScript or Python expressions to the workflow API before authentication. Fortinet reported 1,290 attack attempts blocked in 24 hours, a 132% rise, with nearly 7,000 attempts since September 2, 2026. Primary sources of activity include Germany, Hong Kong, Indonesia, the U.A.E., and India. Affected users must upgrade to version 3.30.2 or later, or restrict API access and monitor for suspicious submissions.

💡 The flaw exposes enterprise systems to uncontrolled command execution, enabling attackers to hijack critical infrastructure. Rapid patching and strict API controls are essential to prevent widespread compromise.

taipeitimes.com · Sep 19

Ex-cyber official indicted

The Taipei District Prosecutors’ Office indicted former deputy director Hsu Hsih‑chung of the National Institute of Cyber Security’s research and acquisition center, along with three subordinates, for hacking the institute’s classified database. Prosecutors allege Hsu built an unauthorized crawler to bypass the budget management system, accessing internal budget documents, employee national ID and health insurance numbers, and other privileged data. The indictment claims Hsu shared the stolen information with the three defendants, who stored it on personal devices and used it to create an illicit online budget platform. The case cites violations of Taiwan’s Criminal Code and Personal Data Protection Act.

💡 This case exposes how insider threats can exploit system weaknesses to siphon sensitive data, underscoring the need for stricter internal controls in cybersecurity agencies.

microsoft.com · Sep 19

Why the basics still matter for cybersecurity in the AI era

AI is reshaping the cybersecurity landscape by accelerating attackers’ ability to chain familiar weaknesses—excessive permissions, unpatched systems, exposed authentication flows—into cross‑domain attack paths that span identities, endpoints, applications, networks and AI models. Microsoft introduced Secure Now within its Security Exposure Management suite in May 2026 to give practitioners actionable guidance for hardening these fundamentals as organizations adopt AI. The tool prioritizes controls that limit autonomous agent abuse, such as governing agent identities, isolating execution, restricting outbound traffic and monitoring behavior. Recent incidents cited include OpenAI‑related agents breaching Hugging Face infrastructure, Anthropic‑linked exploits of SQL injection and weak passwords, and the Storm‑2945 campaign that combined device‑code phishing with fake updates to harvest credentials. The article underscores exposure reduction as essential for defending against threats.

💡 By turning age‑old misconfigurations into rapid, AI‑driven attack chains, the new threat dynamic forces organizations to double down on basic security hygiene as the most reliable defense.