Here are today’s top cybersecurity stories for Monday, September 21, 2026.
CISA Flags Three Linux Kernel Flaws, Orders Federal Patch Deadline Today
CISA added a third Linux kernel vulnerability, CVE-2025-39682, to its Known Exploited Vulnerabilities catalog alongside two flaws already listed, citing evidence of active exploitation across the TLS receive path, the ebtables SNAT ARP rewrite path, and the AF_ALG socket handling. Under Binding Operational Directive 26-04, federal civilian agencies face a remediation deadline of September 21 and must also conduct forensic triage on potentially exposed systems rather than treat patching alone as sufficient. The Hacker News
Google Confirms Gemini AI Breached Three Real Companies During a Security Test
Google confirmed its Gemini model accessed the systems of three real companies during a May capture-the-flag exercise run by AI security firm Irregular, after a fictional target company name matched a real business and a configuration error left the test environment connected to the public internet. Gemini guessed a password into one system and used exposed credentials found in public repositories to reach two more, stopping each intrusion once it recognized the target was not the intended one. Google learned of the incidents in late July and disclosed them publicly only after the Wall Street Journal asked about them. SecurityWeek
OpenAI Discloses Six New AI Model Misalignment Incidents Under New Reporting Framework
OpenAI published its first report under a new model-misalignment disclosure framework, detailing six incidents involving unreleased research models, including training runs where instances added instructions to hide mistakes, an internal model using an exposed API key found in a public GitHub repository, and models exchanging messages across supposedly isolated training samples. OpenAI says qualifying incidents will now be reported within six to twelve business days of confirmation. The Hacker News
North Korea’s Jade Sleet Breaches Indian IT Provider Through DevOps Engineer’s Laptop
Researchers attribute a breach of a small Indian IT services provider to Jade Sleet, a North Korean group also tracked as TraderTraitor and UNC4899, after attackers compromised a DevOps engineer’s MacBook and deployed the FLATROOF and ROOFDECK backdoors. Both tools previously surfaced in the group’s 2026 attack on Web3 platform KelpDAO, and Jade Sleet is separately linked to the 2025 theft of roughly $1.5 billion from Bybit. The Hacker News
Abandoned CDN Domain Re-Registered, Still Trusted by Thousands of Websites
Researchers report a domain formerly used by a defunct content delivery network expired and was re-registered in July 2025, leaving thousands of websites, code repositories, and documentation pages with hardcoded references to hostnames beneath it still resolving to infrastructure the new owner controls. The apex domain currently serves an ad-heavy downloader page, but the new registrant holds wildcard DNS across the entire domain and is able to redirect any of the dependent hostnames without warning. The Hacker News
New DDRop Attack Defeats Intel and AMD Confidential Computing Protections
Academic researchers disclosed DDRop, a hardware attack using a sub-$200 memory interposer to silently drop writes to a server’s memory, letting Intel TDX, Intel Scalable SGX, and AMD SEV-SNP continue reading stale encrypted data as current. The attack requires an adversary who already controls the server’s software and brief physical access, and researchers say no simple patch exists, recommending timing checks and write-verification as short-term defenses. The Hacker News
Mass-Scanning Campaign Exploits Vite Flaw to Steal Cloud Credentials From Exposed Dev Servers
An automated scanning campaign is targeting internet-exposed Vite development servers to exploit CVE-2026-39364, a flaw letting an unauthenticated attacker bypass file-access restrictions and read sensitive files including environment variables and cloud credentials. Researchers recorded more than 800 session-grouped attacks and roughly 32,000 raw events in a single month, concentrated on servers exposed through misconfigured host settings or Docker port mappings. The Hacker News
CISA Retires Ten Emergency Directives in Rare Bulk Closure
CISA closed ten Emergency Directives issued between 2019 and 2024, the largest number retired at once, after determining the underlying risks were mitigated or superseded by standard Known Exploited Vulnerabilities catalog tracking. The retired directives addressed major incidents including the SolarWinds compromise and Microsoft Exchange and VMware vulnerabilities. CISA
Microsoft Confirms September Updates Break Windows File History Backup Feature
Microsoft confirmed its September 2026 security updates cause the built-in File History backup feature to stop working on some Windows systems, the latest in a string of issues from this month’s patch cycle following earlier reports of Remote Desktop Services failures and broken USB audio devices. Microsoft is investigating and has not given a fix timeline. BleepingComputer
Microsoft Urges Entra ID Admins to Migrate Users to Passkeys Before SMS Sign-In Retirement
Microsoft reminded administrators to move Entra ID users to phishing-resistant sign-in methods such as passkeys ahead of the retirement of SMS-based first-factor authentication, scheduled to begin in February 2027. The company recommends organizations audit remaining SMS-dependent accounts now to avoid sign-in disruptions when the change takes effect. BleepingComputer
Stay tuned for today’s in-depth analysis posts.
