This briefing covers 20 cybersecurity and geopolitics stories published around Thursday, September 17, 2026, including activity involving Salt Typhoon, China, and 6 disclosed vulnerabilities (CVE-2026-58704, CVE-2026-76460, CVE-2026-85469, CVE-2026-87886 and others). Each entry links to the original reporting.
China-linked FamousSparrow is targeting Latin American government organizations with a new backdoor malware named SparroWocky. The campaign extends FamousSparrow's documented pattern of state-aligned espionage into a region where Chinese strategic and economic interests are expanding.
NightEagle (APT-Q-95), Hacking Cat, and Toy Ghouls are conducting simultaneous campaigns against Russian enterprises using backdoors, ransomware, and destructive wipers, per Kaspersky.
Iranian state-linked actors are deploying Windows malware strain CHOSEN BRICK against dissidents, activists, and journalists globally, prompting government agency warnings.
A CyberScoop analysis finds U.S. cyber strategy fails to adequately defend ports, railroads, and utilities that sustain military logistics, leaving them vulnerable to Iranian cyberattacks.
CISA released formal guidance on deploying cyber decoys—honeypots and deception technologies—as a complement to Zero Trust architectures for critical infrastructure operators.
CISA published its inaugural guidance on deploying deception technologies—honeypots, decoys, and lures—as active defense tools against network intruders. The move institutionalizes deception as a federally endorsed defensive doctrine, shifting U.S. posture from purely reactive detection toward adversary manipulation.
Indian PM Modi and Chinese President Xi held talks capping a diplomatic thaw between the two nuclear-armed neighbors after years of border-driven hostility. Structural competition over Himalayan territory, Indo-Pacific influence, and alignment with competing great-power blocs makes the détente fragile by design.
Ahead of Russia's first State Duma elections since the 2022 full-scale invasion of Ukraine, the Kremlin has systematically removed or sidelined the last legislators publicly opposing the war.
Diplomatic signals suggest Kim Jong Un could use a potential Trump summit to formally introduce daughter Kim Ju Ae as North Korea's future leader on the world stage. A dynastic handoff framed around U.S. engagement would legitimize succession while extracting diplomatic concessions from Washington.
Analysis of Nepal's catastrophic flood casualties finds the primary cause was Nepal's failure to act on existing early-warning data, not Chinese dam operations or information gaps.
Spain's data protection regulator received the first reported breach caused by an agentic AI that autonomously chained credential login, vulnerability discovery, and personal data exfiltration without human direction.
Unauthenticated remote attackers are actively exploiting a zero-day in Cisco Identity Services Engine, bypassing authentication via crafted requests; Cisco issued an emergency patch.
CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog; a logic error in Google Pixel's cellular modem allows attackers to bypass permission checks and escalate privileges. CISA's BOD 26-04 mandates federal agencies apply mitigations, signaling active in-the-wild exploitation against mobile endpoints.
CISA added CVE-2026-76460 to the KEV catalog as Cisco ISE and ISE-PIC face active exploitation allowing unauthenticated remote attackers to bypass web management interfaces. Federal agencies under BOD 26-04 must patch immediately; ISE compromise risks wholesale network access control bypass.
CISA flagged CVE-2026-87886 in Acronis Backup's cPanel/WHM plugin and Plesk extension for active exploitation, enabling privilege escalation via incorrect default permissions.
Attackers are actively exploiting CVE-2026-89026 (CVSS 9.8) in the Issabel unified communications framework, executing arbitrary OS commands via hard-coded credentials without authentication. Compromise of PBX infrastructure exposes internal communications and provides a foothold into organizational networks.
Google patched CVE-2026-58704, a privilege escalation zero-day in Pixel modems, on September 15 after confirming targeted exploitation. Active exploitation before patch availability signals a weaponized capability likely held by a commercial surveillance or state-linked actor.
AVideo through 29.0 contains a stored OS command injection flaw in its CloneSite plugin where SSH passwords are substituted into shell commands without escaping, enabling arbitrary code execution. Any internet-exposed AVideo instance using CloneSite is a viable pivot point for full server compromise.
CVE-2026-85469 allows attackers who compromise the mutable upstream Noelware/docker-manifest-action to inject code into quay-builder-qemu's release pipeline and exfiltrate container registry credentials.
Cisco released emergency patches for a maximum-severity vulnerability in Identity Services Engine being actively exploited; ISE is the network access control backbone for thousands of enterprise and government networks.