This Week in Cybersecurity: Week 37

The story of the week isn't a single vulnerability. It's that attackers are now using AI agents to run entire attacks with less and less human involvement, and this week gave us three separate, confirmed examples of it happening in the wild - including one where a Russian state-sponsored group used Anthropic's own Claude to automatically rewrite its malware every time security software caught it.

Alongside that, this was one of the busier patch weeks of the year: Microsoft shipped a record number of fixes, a maximum-severity GitLab flaw was under attack within hours of being disclosed, and a wave of the remote-access and edge-device software that IT teams and managed service providers rely on - N-able, Cisco, Citrix, Fortinet, JFrog, ConnectWise, MikroTik - all landed on the US government's list of flaws being actively exploited right now.

This roundup covers Monday 7 September through Sunday 13 September. Most of what follows is enterprise and IT-administrator territory rather than something you need to do to your own laptop this weekend - but a few items below do need your attention, and the AI-agent trend is worth understanding regardless of what you run.

What to act on#

Install this month's Windows updates#

Microsoft's September Patch Tuesday fixed a record 974 flaws (999 counting third-party CVEs folded in), and two of them are already being used in real attacks: CVE-2026-85880, a Windows ALPC bug that lets an attacker who already has some access escalate to full SYSTEM control, and CVE-2026-81963, a similar privilege-escalation flaw in the Windows Update Stack. Neither is a "click a link and you're owned" bug, but both are already part of an active espionage toolkit (more on that below). If Windows Update is set to automatic you're likely already covered; if you've been putting off a restart, this is the month to stop putting it off.

Update WeChat if you use it#

Researchers at Calif found a worm that could take over a WeChat account with zero clicks, just by placing a call to a phone that already has the attacker as a contact - one test device took over another mid-ring. There's no evidence of it being used against real users, Tencent quietly shipped a fix on both iOS and Android in late August, and the company also blocked the technique on its servers as a backstop. So the honest risk level here is low, but since the update already exists, updating to WeChat 8.0.77 (Android) or 8.0.76 (iOS) or later costs you nothing.

Treat your AI account logins like your bank login#

A researcher combed through a 7GB dump of data harvested by ordinary infostealer malware and found over 1,800 still-valid session tokens and API keys for accounts on Claude, ChatGPT, Gemini and similar services, gathered from nearly 6,000 infected machines. None of this required breaking MFA - the malware just stole the session token after the person had already logged in and passed MFA, and the token worked without needing a password or a code at all. The fix is the same one we keep repeating: move to passkeys wherever a service supports them, since a stolen session token is a much smaller problem than a stolen password when the underlying login can't be replayed the same way. If your organization issues API keys for AI tools, scope them tightly and rotate them like you would any other credential.

Be suspicious of "IT support" phone calls#

A group researchers call PREY-0058 is cold-calling executives - directors, VPs, senior staff - pretending to be internal IT help desk staff, then walking them through a fake login page that captures both their password and their MFA approval in real time. There's no malware involved, which is exactly why it works: it looks like a normal support call. If you get an unsolicited call asking you to log in to "verify" something, hang up and call your actual IT department back on a number you already have.

The week's biggest#

A Russian state-sponsored group used Claude to rebuild its own malware on the fly#

Anthropic disclosed that a group it tracks as GTG-20006, linked to the Russian APT29/Midnight Blizzard operation, built an automated pipeline where Claude monitored whether security tools were detecting its malware and then rewrote the code itself to slip past the detection, without a human re-tuning each version by hand. The campaign hit more than 20 organizations - government ministries, military intelligence bodies, embassies, defense contractors, and hotel guests compromised through manipulated Wi-Fi - across Ukraine, Europe, the Middle East and Asia. This is the detail that matters beyond the headline: it's not that an AI "hacked" anyone, it's that a manual step in an attacker's workflow (rewriting malware to dodge antivirus) got automated, which means that step now happens faster and needs less skilled staff on the attacker's side. Anthropic says it detected and banned the accounts involved and has published indicators for defenders.

Who's exposed: government agencies, defense contractors, diplomatic missions and similar high-value targets specifically, not a general consumer or small-business risk today. The broader implication - that AI tooling can now automate a link in the attack chain that used to require a skilled human - applies to everyone building defenses, not just this campaign's victims.

Microsoft's biggest patch batch on record, and two of the bugs are already part of a live espionage toolkit#

Beyond the general "update Windows" advice above, the more interesting story is what researchers found connecting this month's Windows zero-day to a browser bug from the week before. Four separate state-linked espionage groups - tracked as APT31, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket - were independently caught using the same exploit chain, dubbed BlueMoon, within days of each other. It strings together a Chrome V8 sandbox-escape bug with the Windows ALPC flaw Microsoft patched this week, so a victim who visits a malicious page gets code execution in the browser and then breaks out of the browser's sandbox entirely. Targets so far include NGOs, mining and commodity-trading firms, US aerospace companies, and manufacturing and government targets across Southeast Asia.

Who's exposed: organizations in the specific sectors researchers named above; this is targeted espionage tooling, not mass-market malware. The practical takeaway for everyone else is simply that keeping both your browser and Windows current closes both links in this particular chain.

A maximum-severity GitLab flaw was under attack within hours of disclosure#

CVE-2026-85706, a CVSS 10 path-traversal bug in GitLab's commits API, let an unauthenticated attacker read arbitrary files off a self-hosted GitLab server. GitLab patched it, and within hours - starting at 06:00 UTC the same day researchers went public - security firm watchTowr confirmed real exploitation attempts had already begun. GitLab has shipped fixes in versions 19.3.2, 19.2.6 and 19.1.8.

Who's exposed: organizations running self-managed GitLab Community or Enterprise Edition (versions 18.7 through 19.3), which is most companies that host their own GitLab rather than using GitLab.com. If that's your team, patch now rather than on your normal cycle - "hours to exploitation" is about as fast as this gets.

A wave of the software MSPs and IT teams rely on is now on the US government's actively-exploited list#

CISA's Known Exploited Vulnerabilities catalog grew considerably this week, and the pattern is worth noticing even if none of these specific products are yours: the remote-management and edge software that keeps businesses running is a favorite target precisely because compromising one vendor gives an attacker a foothold into every customer that vendor manages. This week's additions included N-able's N-central RCE flaw (CVE-2026-86218, CVSS 10.0), which N-able and CISA both describe as exploited in the wild, though security firm Huntress has said it can't independently confirm active exploitation from its own telemetry; Citrix NetScaler ADC/Gateway (CVE-2026-19490); Fortinet FortiOS (CVE-2025-25249, tied to over 3,000 compromised devices); Cisco's Secure Firewall Management Center (CVE-2026-20079 and CVE-2026-20316), which one attacker chained straight into a Qilin ransomware deployment; and a cluster of JFrog Artifactory bugs (CVE-2026-42016, CVE-2026-42018, CVE-2026-82329) that attackers chained together to plant backdoors, alongside newly added flaws in ConnectWise ScreenConnect and MikroTik RouterOS.

Who's exposed: businesses and MSPs running any of these specific products, and by extension their downstream clients if an MSP is compromised. This isn't a "your laptop" story; it's an "ask your IT provider or managed security vendor whether they've patched this" story.

A zero-day in the software behind thousands of online stores was actively exploited#

Adobe pushed an emergency fix for a maximum-severity flaw in Magento and Adobe Commerce, dubbed "StyleSmuggler", that attackers were already using to plant both a Linux backdoor and a PHP web shell on live stores - one compromised server was hit within 50 minutes of the first confirmed attack. Adobe shipped hotfixes and CISA gave federal agencies until September 11 to apply them.

Who's exposed: anyone running a Magento or Adobe Commerce store on an unpatched version. Shoppers aren't directly targeted, but a compromised store can mean stolen payment details or malware served to visitors, so if you run one, patch it now.

AI agents ran two separate real-world attacks with almost no human involvement#

Beyond the Claude malware story above, this week produced two more concrete examples of the same trend. A suspected Russian-speaking group used hundreds of AI agents - built on OpenAI's Codex and a DeepSeek model - to research, build, test and refine exploits for two PaperCut printing-software flaws (CVE-2026-81578, CVE-2026-82078), compromising over 440 systems across 395 organizations in 48 countries, mostly universities, with some breaches taking as little as seven minutes. Separately, Google's threat intelligence team described a financially motivated attacker who fed an AI coding assistant a single prompt and a set of instructions, then let it plan and run a mass credential-harvesting campaign against thousands of accounts in under six hours without further human input.

Who's exposed: organizations running vulnerable PaperCut instances (education institutions have been hit hardest) for the first case, and a broad mix of healthcare, government and media organizations for the second. The wider point applies to any organization: the time between a flaw being known and it being weaponized at scale keeps shrinking as attackers hand more of that work to AI agents.

Worth knowing about#

A 200-patch Android update, a new browser-based phishing trick, and a 119,000-site fake shop network. This week's ThreatsDay roundup covered Google's September Android security update, which fixes 200 flaws including a Wi-Fi memory-corruption bug that could allow remote code execution - a good reminder to keep your phone's security patches current. It also detailed a phishing technique that abuses legitimate Google services (Meet, Search, DoubleClick, Tag Manager) and disposable "blob URL" pages generated inside the victim's own browser to dodge link-scanning filters, and a fraud network called DoppelCart running over 119,000 fake online stores that copy real retailers' branding to steal card details.

A cPanel bug could let a hosting customer take over the whole server - but nobody's used it yet. A SQL-injection flaw in cPanel's email-tracking feature (CVE-2026-67401) would let anyone with a hosting account that has mail privileges run code as root on shared hosting. cPanel has already shipped fixed builds, and as of this week there's no sign of it being exploited or any public proof-of-concept code. If your business runs a website on shared cPanel hosting, ask your host whether they've applied the update.

An AI coding agent tool had a sandbox that agents could turn off themselves. DeepSeek Harness, an open-source tool for running AI coding agents with roughly 216,000 GitHub stars, had a flaw (CVSS 9.4) that let an agent disable its own file-sandboxing with a single command, due to a missing authentication check. It was already fixed by late August, but it's a useful reminder for anyone running AI coding agents on untrusted files: the project's own documentation says its sandboxing was never meant to guarantee real isolation.

Summary#

1. Update Windows this month - two of the patched flaws are already being used in active attacks, including a nation-state exploit chain.
2. Update WeChat if you use it, even though there's no confirmed exploitation yet.
3. Move to passkeys on any account that offers them, especially AI service accounts - stolen session tokens are turning stolen passwords and MFA codes into a non-issue for attackers.
4. Treat unsolicited "IT support" phone calls as suspicious by default; hang up and call back on a number you already have.
5. If you run self-hosted GitLab, patch immediately - this one was exploited within hours of disclosure.
6. If your business relies on an MSP or IT vendor using N-able, Cisco, Citrix, Fortinet, JFrog, ConnectWise or MikroTik products, ask them directly whether this week's flaws are patched.
7. AI agents ran three separate real-world attacks this week with minimal human involvement - a malware-rewriting campaign, a printing-software breach, and a mass credential-harvesting run - and that trend, more than any single CVE, is the one worth watching.

The week's CVEs#

Want help figuring out which of this week's stories actually apply to your business? Get in touch and we'll walk through it with you.

This roundup is for general informational purposes and isn't a substitute for guidance from your own IT or security team. Always verify vendor advisories directly before taking action on your own systems.