This weekly roundup covers a stark small-business cyberattack report out of the UK, a hardware flaw exposing Nintendo Switch owners to nearby attackers, the largest known seizure of AI deepfake porn websites, a candid conversation on AI's role in offensive security, new US legislation targeting elder fraud, and a fresh national threat-intelligence partnership in the UAE.  From consumer hardware to national policy, this week's developments show that exposure isn't limited to large enterprises or nation-state targets — small businesses, individual console owners, and everyday victims of fraud and non-consensual imagery are all squarely in scope, even as governments and industry move to close the gaps. 

The Cyber Express Weekly Roundup 

UK Small Businesses Face Higher Cyberattack Rates Than Global Peers, Hiscox Report Finds 

UK small firms are being hit by cyberattacks at a rate well above the global average, according to Hiscox's 10th annual Cyber Readiness Report. The survey of nearly 7,000 smaller businesses worldwide, including 1,000 in the UK, found that 38% of UK firms suffered a successful attack in the past year, compared with a 29% global average — the highest rate among all markets surveyed. Read more… 

Cyble Signs MOU with UAE Cyber Security Council to Boost National Threat Intelligence 

Cyble, an AI-native cybersecurity firm, has signed a Memorandum of Understanding with the UAE's Cyber Security Council to strengthen the country's national threat intelligence capabilities. Announced in Abu Dhabi in September 2026, the agreement centers on delivering advanced threat intelligence, early warning capabilities, and insights into emerging cyber risks facing government and critical infrastructure entities across the UAE. Read more… 

Nintendo Switch Flaw Let Nearby Attackers Run Code, Steal Data 

Nintendo has patched a flaw in the original Switch that let nearby attackers hijack its QR-code-based "Send to Smartphone" feature to run unauthorized code or steal data, including account information stored on the console. Tracked as CVE-2026-82079, the bug affected consoles on firmware older than version 23.0.0; the Switch 2 is unaffected. Read more… 

Manhattan D.A. Seizes 12 Deepfake Porn Websites in Largest Known Takedown of Its Kind 

The Manhattan District Attorney's Office has seized 12 websites allegedly used to create, sell, and distribute AI-generated deepfake pornography targeting roughly 1,200 real people without their consent. Announced by D.A. Alvin L. Bragg Jr., it's described as the largest known seizure of AI-generated celebrity deepfake websites to date, and the investigation is ongoing. Read more… 

Rahul Singh Choudhary on AI's Growing Role in Cryptanalysis and Offensive Security 

In the latest episode of Security Pill Season 2.0, The Cyber Express interviewed cybersecurity analyst Rahul Singh Choudhary about how AI is reshaping cryptanalysis, vulnerability research, and penetration testing. The conversation opens with a key question: has AI moved from merely assisting security research to actively participating in it — particularly around the cryptographic assumptions underpinning wallets, exchanges, and smart contracts? Read more… 

US House Passes GUARD Act to Boost Law Enforcement Fight Against Elder Fraud, Crypto Scams 

The U.S. House of Representatives has passed the bipartisan GUARD Act (H.R. 2978) on September 15, 2026, aimed at strengthening law enforcement's ability to combat elder financial fraud and cryptocurrency scams. Co-led by Representatives Josh Gottheimer, Zachary Nunn, and Scott Fitzgerald, the bill now heads to the Senate. Read more… 

Weekly Cybersecurity Takeaway 

This week's developments span the full spectrum of cyber risk — from small UK businesses absorbing a disproportionate share of attacks, to a hardware-level flaw putting console owners at physical-proximity risk, to AI tools being weaponized for non-consensual imagery at unprecedented scale.   Meanwhile, policy responses are accelerating on multiple fronts: US lawmakers are moving to arm local investigators against crypto-enabled elder fraud, and the UAE is deepening its national threat-intelligence posture through public-private partnership.  Taken together, the stories point to a widening gap between the speed of exploitation — whether by scammers, deepfake operators, or nearby attackers exploiting hardware — and the pace of institutional response, even as that response visibly picks up. 

💾

Cisco has released a fix for a maximum-severity flaw in its Identity Services Engine (ISE) platform after confirming the bug was already being exploited by attackers. The vulnerability, tracked as CVE-2026-76460, carries a perfect CVSS score of 10.0 and was patched by Cisco on September 16, 2026.  The flaw sits in an API within Cisco Identity Services Engine and stems from inadequate authentication checks on an API endpoint. Because of this weakness, an unauthenticated attacker could send a specially crafted request to that endpoint and slip past ISE's web-based management interface entirely, gaining unauthorized access to the device without needing valid credentials. 

CISA Adds CVE-2026-76460 to Its Exploited Vulnerabilities List 

Given that Cisco confirmed active exploitation of CVE-2026-76460, the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, a designation reserved for bugs already being weaponized in real-world attacks.  Cisco ISE has long served as one of the most widely deployed network access control tools in enterprise environments, helping organizations manage security policies centrally, confirm the identities of users and devices, and govern who and what can reach different parts of a network. That central role is precisely what makes a bypass of its authentication so dangerous, according to security researchers. 

Experts Warn of Ransomware and Lateral Movement Risk 

John Strand, owner of Black Hills Information Security, echoed the urgency, recommending that affected organizations patch immediately and disconnect ISE instances from direct internet exposure. Strand also warned that the bug could plausibly be leveraged in a ransomware attack.   Even so, he noted that relatively few ISE deployments appear to be directly exposed to the open internet, which limits the number of organizations at risk from an opportunistic, internet-facing attack. His larger concern is what happens after attackers are already inside a network: "I'd be more concerned about it as a post-exploitation lateral movement opportunity.   An attacker gets into the environment through something else, discovers a vulnerable ISE internally, and uses that to expand access or compound the damage." 

Signs of Compromise and Recommended Checks 

Cisco's advisory notes that successful exploitation can hand attackers root-level command execution, meaning they could potentially erase or mask evidence of their intrusion. The company is advising administrators to cross-reference network and firewall logs from outside the affected device to spot unusual activity, including unexpected data transfers to external addresses. Suspicious usernames in the access logs are cited as one possible indicator of compromise, and Cisco recommends checking every node in a distributed deployment. 

Affected Products and Fixed Releases 

The vulnerability affects Cisco ISE and ISE Passive Identity Connector regardless of how a device is configured. No workarounds exist, though Cisco suggests using infrastructure access control lists to restrict management traffic as a temporary mitigation. Fixed releases are available for versions 3.1 through 3.5, including 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Version 3.0 has already reached the end of software maintenance, so organizations still running it are advised to migrate to a supported release.  The issue was discovered during a Cisco Technical Assistance Center support case, and the advisory was published in final form on September 16, 2026. 

The Thinkng Bull cyberattack targeted the Seoul-based math academy headquartered in Daechi-dong. The attack has exposed the personal information of students and parents, drawing scrutiny from South Korea's data protection authorities.   The National Math Academy, which runs roughly 80 branches across the country, disclosed the breach to parents on September 17, confirming that an unidentified hacker had infiltrated its exam reservation website. 

Details of the Thinkng Bull Cyberattack 

According to the academy, the intruder informed staff that they were "securing all data," language that led Thinkng Bull to conclude there was a high likelihood that the personal details of every parent and student who had booked exams through the site had been compromised.  The exam reservation platform held sensitive registration data, including students' names, schools, grade levels and dates of birth, along with parents' phone numbers. In response, the National Math Academy took the reservation site offline and filed a report on the breach with the relevant government authorities.   The academy also said it was compiling documentation to request a formal police investigation into the intrusion. 

Academy's Response and Warnings to Parents 

Following the cyberattack on Thinkng Bull, the academy issued a direct warning to parents about the risk of follow-on scams. It noted that the stolen data could be used for "improper purposes" and cautioned that phone calls or text messages from unfamiliar numbers should be treated as potential voice phishing attempts, urging families to "respond calmly" rather than share further details. Parents were also asked not to hand over any personal information or click on unfamiliar links.  Thinkng Bull apologized for the incident, stating it "deeply" regretted the concern caused and expressed hope that no parents or students would suffer actual harm as a result. The academy said the exam reservation website would remain suspended until it completed measures designed to prevent a similar breach from happening again. 

Regulatory Oversight 

South Korea's Personal Information Protection Commission confirmed that Thinkng Bull reported the leak at approximately 9:00 p.m. on September 17. As of the latest updates, the exact number of affected individuals had not yet been determined.   A commission official said the agency was still verifying the facts of the case, including whether any legal violations occurred, and that the timing of any further investigation would depend on the outcome of that review. 

Background on Thinkng Bull 

Thinkng Bull is known as an advanced math program aimed at elementary school students, with a curriculum that allows children in the 4th through 6th grades to complete three years of middle school math material in 13 months.   The academy was founded in 2005 as a single location in Daechi-dong and has since expanded to more than 80 branches nationwide, including one in Gangnam District's Daechi neighborhood. 

What Comes Next? 

The cyberattack on Thinkng Bull adds to a string of data breaches affecting private education providers in South Korea, raising fresh questions about how academies safeguard the personal records of minors collected through online registration systems.  With the Personal Information Protection Commission still reviewing the incident, further details — including the scope of the breach and any regulatory penalties — are expected to emerge as the investigation proceeds.   In the meantime, the National Math Academy has advised affected families to remain alert to unsolicited contact and to avoid sharing additional personal data until the situation is resolved. 

Iranian cyber actors are using a malware family known as HEAVYGRAM, also tracked as CHOSEN BRICK, to target dissidents, journalists, and opposition groups worldwide, according to a recent FBI FLASH report and a joint advisory from the UK National Cyber Security Centre (NCSC), the US FBI, and the Netherlands' General Intelligence and Security Service (AIVD). The FBI assesses that the malware is deployed on behalf of the Government of Iran's Ministry of Intelligence and Security (MOIS) to collect intelligence, conduct data leaks, and cause reputational harm to targets. The joint advisory adds that Iran almost certainly uses cyber activity to support repression of individuals seen as threats to the regime.

Who Is Being Targeted by Iranian Cyber Actors

The victim profile includes Iranian dissidents, journalists opposed to Iran, members of organizations with views countering Government of Iran narratives, and other individuals the Iranian government perceives as threats. The joint advisory notes that CHOSEN BRICK has been used against individuals in the UK, US, and Netherlands since at least 2025, and that personal details of some victims have appeared on pro-Iranian leak sites, increasing risks to their personal safety. In some cases, Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals abroad who are seen as enemies of the regime.

Social Engineering and Delivery

Iranian cyber actors rely heavily on social engineering to deliver their malware. Actors communicate with targets through platforms such as Telegram, WhatsApp, and Instagram, often posing as individuals known to the target or as technical support from the messaging platform. The joint advisory notes that actors research targets in advance to appear credible, and often initiate contact through a target's work device before shifting to personal devices if the initial delivery attempt fails or risks detection. Victims are persuaded to download files disguised as legitimate applications, including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, or files appearing to be MRI scan results. The FBI notes that some victims downloaded AnyDesk and provided access strings, while others downloaded malware masquerading as a program installer. The malware targets only the Windows operating system.

Persistence and Telegram Command and Control

Once installed, the malware achieves persistence by adding registry keys, most often within the Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, so it runs automatically at user login. It also adds exclusions to Microsoft Defender antivirus to evade detection. The malware then connects to Telegram command-and-control infrastructure, with each victim device linked to a unique Telegram Bot ID to prevent cross-contamination between victims. Through Telegram, the malware can enumerate running processes and system information, capture screen content, enable the microphone to record audio, copy Telegram and WhatsApp data from browsers, download additional files, delete files, steal email content, and wipe the computer system. Files and data are exfiltrated through the Telegram bot and cloud object stores such as VultrObjects and StorjShare. Recent variants use HTTPS/SOCKS5 proxies to obscure the use of Telegram bots.

FBI Recommendations

The FBI recommends caution regarding communications from unknown individuals, keeping devices updated, downloading software only from trusted sources, enabling antivirus software, using strong unique passwords with multi-factor authentication, and reporting suspicious messages. The NCSC, FBI, and AIVD jointly recommend phishing-resistant multi-factor authentication, application allowlisting, email scanning security features, and endpoint and network monitoring. Organizations concerned about a potential HEAVYGRAM or CHOSEN BRICK infection are advised to contact their IT providers and check both corporate and personal devices, since the actors also target individuals outside their workplace systems.

The European Commission has adopted the EU KIDS Act, a proposal that would introduce new age restrictions and safety requirements for online platforms used by children across the European Union. The proposal would prevent social media platforms from allowing children under 13 to access their services and establish an EU-wide minimum age of 15 for minors to open accounts independently.

The EU KIDS Act would also shift the burden of proof to online service providers, requiring them to demonstrate that their services are safe by design and appropriate for younger users.

Commission President Ursula von der Leyen said the proposal is intended to give parents greater control over how children use digital services.

“Today, our children are engaging with the most sophisticated technologies ever created. Technology that was never created with their wellbeing in mind. Our KIDS Act is reversing the burden of proof - it is for platforms to show they are safe by design. And we put parents back in the driving seat, giving them the tools to help their children navigate a safer online world,” von der Leyen said.

EU KIDS Act Sets New Social Media Age Limits

Under the EU KIDS Act, children between 13 and under 15 would not be able to create autonomous social media accounts. Instead, they could use mini accounts managed through a parent or guardian's account, with access limited to age-appropriate social media and video-sharing services.

These mini accounts would include safeguards such as restricted social contacts and screen time of up to one hour per day.

Children between 3 and under 13 would not be permitted to access social media. They could, however, use specially designed child-friendly video-sharing services through guardian-managed accounts. Parents would also receive tools to restrict an adult device to those services when it is given to a child, with exposure limited to a maximum of one hour per day.

Safety-by-Design Rules Target Addictive Features

The proposal would introduce safety-by-design obligations for online services offering social media, video sharing, online video games, AI companions and chatbots to users under 18.

The proposed rules would prohibit addictive features and profiling-based recommendation feeds that can draw minors toward harmful content. Infinite scrolling without stopping points, reward mechanisms and push notifications during sleeping hours would also be restricted.

The proposal would further prohibit unsolicited contact from strangers. AI companions and chatbots would have to be turned off by default and could not simulate interpersonal relationships in ways that create emotional dependency.

Minor profiles would be private by default, while geolocation, camera and microphone access would be turned off. Platforms would also need to provide tools allowing minors to block or mute users, manage their time and control, tune and reset recommender systems.

Privacy-Preserving Age Assurance Proposed

The EU KIDS Act would require online services and app stores to use age assurance tools. The proposal points to the EU age verification app as one possible approach, with the system designed not to retain identity documents or biometric data.

Social media and video-sharing platforms would be expected to perform age verification when users create new accounts. For existing accounts, providers would estimate a user's age using reasonable indicators, such as the account creation date or credit card details.

EU Plans Faster Enforcement

The proposal would require very large online platforms to prove that their services are safe by design. Providers would submit compliance plans to the European Commission and an independent auditor, which would assess new services, features or functionalities.

If the Commission identifies shortcomings based on an auditor's report, it could require providers to propose corrective measures. The enforcement framework would build on existing structures under the Digital Services Act and Artificial Intelligence Act.

For noncompliance, the proposal includes expedited enforcement procedures under which the Commission should conclude investigations within 90 days.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said the proposal would allow children to use digital services while increasing safeguards and accountability for platforms.

“With our EU KIDS Act, we make sure our children can enjoy their rights online - to learn, stay connected and explore. We also give parents the tools to accompany their kids to navigate a safe digital world. All of this by keeping the pressure high on platforms, because they must prove their services do not harm,” Virkkunen said.

EU KIDS Act Moves to Parliament and Council

The legislative proposal has now been submitted to the European Parliament and the Council for examination and adoption.

The proposal follows recommendations from the European Commission's Special Panel on Child Safety Online, which included more than 60 experts from areas including civil society, education, public health, child psychiatry and technology.

The Commission said public support for stronger online protections is also growing. According to the 2026 Special Eurobarometer on the Digital Decade, 92% of Europeans consider strengthening protection for children and young people online a top policy priority.

A newly documented security flaw in Parallels Desktop, identified as CVE-2026-90894 and nicknamed "ParaShells," could let any local account on a Mac escalate to full root control of the host machine, according to researchers at JFrog.  The risk is greatest on developer machines, where something as ordinary as a compromised Homebrew formula or a malicious npm preinstall script could serve as the entry point for escalating from a standard user to complete system control.   Shared computers with multiple local accounts — think university labs or office workstations — face similar exposure, said Yuval Moravchick, who leads JFrog's vulnerability research team.  Once an attacker reaches root, Moravchick said, they can swap out system software, access other users' files, and maintain persistence through launchd. 

Inside the ParaShells Exploit Chain 

CVE-2026-90894 is an argument-injection bug confirmed to affect Parallels Desktop for Mac version 26.4.0 running on Apple silicon. Earlier releases haven't been ruled out, but JFrog's team didn't test them.  Three conditions have to line up for ParaShells to work: the vulnerable version of Parallels needs to be installed, though no virtual machine actually has to be running; the prl_disp_service — which launches automatically as root via its daemon — must be active, along with its accompanying socket at /var/run/prl_disp_service.socket; and the attacker needs the ability to execute code under any low-privileged local account.  Moravchick described the mechanics as a combination of weaknesses stacking together: a Unix socket left world-writable, a client-authentication scheme that verifies peer credentials instead of checking a Team ID, and an argument-injection flaw in how the software unpacks appliance files. "The chain is short," he said. "A world-writable Unix socket, a login that trusts peer credentials rather than a Team ID, and an appliance unpack path that builds tar arguments using Qt string splitting." A stray quote character in the parent path allows the attacker to inject the flag "–use-compress-program=", causing macOS's tar utility to execute the attacker's script with root privileges. 

Disclosure and Fix for CVE-2026-90894 

JFrog reported the ParaShells vulnerability to Parallels' parent company, Alludo, which patched the issue in Parallels Desktop version 27.0.0, released in early September 2026. The company published its technical write-up two weeks after the patch shipped, but withheld the one-line proof-of-concept script it had developed to demonstrate the exploit.  Moravchick recommended that organizations identify every Mac running Parallels Desktop, restrict local account permissions on those systems, and update to version 27.0.0 or later to close off CVE-2026-90894. 

The U.S. House of Representatives has passed the bipartisan GUARD Act, legislation aimed at strengthening law enforcement efforts against elder financial fraud, cryptocurrency investment scams and other financial crimes targeting older Americans. The bill, H.R. 2978, passed on September 15, 2026, and now heads to the Senate.

The GUARD Act, or Guarding Unprotected Aging Retirees from Deception Act, was co-led by Representatives Josh Gottheimer, Zachary Nunn and Scott Fitzgerald. The legislation would provide state, local and Tribal law enforcement agencies with additional resources to investigate fraud, track stolen funds and pursue criminals involved in increasingly complex financial schemes.

GUARD Act Targets Elder Financial Fraud and Crypto Scams

Under the GUARD Act, law enforcement agencies could use existing federal grant funding to investigate elder financial fraud, general financial fraud and pig butchering crypto scams.

The funding could support the hiring of analysts and other experts, as well as specialized training for investigators handling complex and often transnational financial crimes.

The bill would also clarify that federal law enforcement agencies can assist state, local and Tribal law enforcement partners and fusion centers with blockchain tracing tools and related technology. The goal is to help investigators follow the movement of funds and identify individuals involved in cryptocurrency-related scams.

The legislation also directs the Treasury Department, FinCEN and federal partners to report to Congress on the scale of financial scams in the United States. The report would examine how much Americans lose each year, how many scams are linked to overseas actors and organized crime, and the effectiveness of existing enforcement efforts.

‘Pig Butchering’ Scams Under Focus

The legislation specifically addresses pig butchering crypto scams, a form of financial fraud in which criminals build trust with victims before persuading them to put money into fraudulent investment opportunities.

The term refers to the process of building up a victim's confidence and encouraging larger investments before the criminals steal the funds.

According to the information provided with the legislation, the FBI's 2025 Internet Crime Complaint Center report recorded $20.9 billion in total internet crime losses in 2025, a 26% increase from 2024. Cryptocurrency-related losses reached $11.37 billion across 181,565 complaints, while investment fraud accounted for more than $8.6 billion in losses.

Bill Moves to Senate

Gottheimer said the legislation would give investigators tools and resources to pursue fraudsters, recover stolen money and address criminal networks operating from overseas.

Nunn said the bill followed concerns raised by an Iowa sheriff's deputy about local officers lacking the tools needed to track criminals and recover victims' money.

The GUARD Act has received support from organizations including AARP, the Iowa State Police Association, the Financial Technology Association, Consumer Bankers Association, America’s Credit Union Association, Digital Chamber, National Police Association, Crypto Council for Innovation and Iowa Bankers Association.

With House passage complete, the legislation now moves to the Senate for consideration.

European Commission President Ursula von der Leyen has proposed an Emergency Security Protocol that would allow any European Union member state to trigger a coordinated response to security incidents including cyberattacks, sabotage and drone incursions. The proposal was announced during von der Leyen’s 2026 State of the Union address in Strasbourg, where she called for a new European security strategy in response to what she described as rising threats across the bloc. Recent incidents in Denmark, Lithuania and Poland, along with an attempted drone attack in Leipzig, were cited as examples of the changing security environment.

Emergency Security Protocol Would Bring EU Governments Together

Under the proposed Emergency Security Protocol, a single member state could trigger the mechanism, prompting all 27 EU governments to convene. The proposed framework would be designed to coordinate a European response, deter further escalation and mitigate the consequences of an incident. Von der Leyen presented the mechanism as a European counterpart to NATO’s Article 4, which allows alliance members to consult when the territorial integrity, political independence or security of a member is threatened. The EU proposal, however, was presented as a mechanism for incidents that fall below the threshold of armed aggression but still pose a national security threat. The proposal does not yet specify what decisions would follow such a meeting or whether the mechanism would create predetermined responses to specific types of incidents.

Cyberattacks and Hybrid Threats Drive Security Push

The Emergency Security Protocol comes as the EU considers how to respond to a broader range of hybrid threats. Von der Leyen cited cyberattacks, sabotage, arson and drone incursions as threats that are increasing across Europe. She argued that existing EU institutions and decision-making processes have not kept pace with the changing security environment. As part of the proposed European security strategy, she called for a European counter-hybrid playbook and greater agreement on how member states should respond to incidents that threaten national security without amounting to conventional armed aggression. The EU already has mutual-assistance and solidarity provisions. Article 42(7) of the Treaty on European Union provides for mutual assistance when a member state is the victim of armed aggression, while Article 222 of the Treaty on the Functioning of the European Union contains a separate solidarity provision.

EU Security Council Also Proposed

Alongside the Emergency Security Protocol, von der Leyen proposed creating a European Security Council focused on the security of the continent. The proposed format would include EU leaders and partners such as Canada, Norway, Ukraine and the United Kingdom. The initiative is intended to provide a broader forum for discussions on European security as the bloc reassesses how it responds to emerging threats. The Commission is also expected to outline further details through its forthcoming European security strategy.

Decision-Making Questions Remain

The proposed mechanism comes as questions remain over how quickly the EU can reach collective decisions during security crises. Many decisions under the bloc’s common foreign and security policy require unanimity, meaning individual governments can block measures supported by other member states. EU sanctions are also adopted unanimously. Von der Leyen did not specify whether the proposed protocol would change those decision-making rules, establish agreed responses in advance or primarily provide a framework for consultation. She also announced a European Instrument for Strategic Enablers, covering capabilities including air and missile defence, strategic transport, air-to-air refuelling, space systems and cyber capabilities. The initiative is intended to be aligned with NATO. The Emergency Security Protocol, European security strategy and proposed European Security Council form part of a wider effort outlined in the 2026 State of the Union address to strengthen coordination around Europe’s changing security environment. Further details are expected as the Commission develops its proposed security strategy.