❌

Normal view

Received — 18 September 2026 ⏭

The Cyber Express Weekly Roundup: Hiscox’s SMB Warning, a Nintendo Switch Flaw, and a Record Deepfake Takedown

✇Cybersecurity News and Magazine
By: Ashish Khaitan
18 September 2026 at 08:51

weekly roundup September 18 2026

This weekly roundup covers a stark small-business cyberattack report out of the UK, a hardware flaw exposing Nintendo Switch owners to nearby attackers, the largest known seizure of AI deepfake porn websites, a candid conversation on AI's role in offensive security, new US legislation targeting elder fraud, and a fresh national threat-intelligence partnership in the UAE.  From consumer hardware to national policy, this week's developments show that exposure isn't limited to large enterprises or nation-state targets — small businesses, individual console owners, and everyday victims of fraud and non-consensual imagery are all squarely in scope, even as governments and industry move to close the gaps. 

The Cyber Express Weekly Roundup 

UK Small Businesses Face Higher Cyberattack Rates Than Global Peers, Hiscox Report Finds 

UK small firms are being hit by cyberattacks at a rate well above the global average, according to Hiscox's 10th annual Cyber Readiness Report. The survey of nearly 7,000 smaller businesses worldwide, including 1,000 in the UK, found that 38% of UK firms suffered a successful attack in the past year, compared with a 29% global average — the highest rate among all markets surveyed. Read more… 

Cyble Signs MOU with UAE Cyber Security Council to Boost National Threat Intelligence 

Cyble, an AI-native cybersecurity firm, has signed a Memorandum of Understanding with the UAE's Cyber Security Council to strengthen the country's national threat intelligence capabilities. Announced in Abu Dhabi in September 2026, the agreement centers on delivering advanced threat intelligence, early warning capabilities, and insights into emerging cyber risks facing government and critical infrastructure entities across the UAE. Read more… 

Nintendo Switch Flaw Let Nearby Attackers Run Code, Steal Data 

Nintendo has patched a flaw in the original Switch that let nearby attackers hijack its QR-code-based "Send to Smartphone" feature to run unauthorized code or steal data, including account information stored on the console. Tracked as CVE-2026-82079, the bug affected consoles on firmware older than version 23.0.0; the Switch 2 is unaffected. Read more… 

Manhattan D.A. Seizes 12 Deepfake Porn Websites in Largest Known Takedown of Its Kind 

The Manhattan District Attorney's Office has seized 12 websites allegedly used to create, sell, and distribute AI-generated deepfake pornography targeting roughly 1,200 real people without their consent. Announced by D.A. Alvin L. Bragg Jr., it's described as the largest known seizure of AI-generated celebrity deepfake websites to date, and the investigation is ongoing. Read more… 

Rahul Singh Choudhary on AI's Growing Role in Cryptanalysis and Offensive Security 

In the latest episode of Security Pill Season 2.0, The Cyber Express interviewed cybersecurity analyst Rahul Singh Choudhary about how AI is reshaping cryptanalysis, vulnerability research, and penetration testing. The conversation opens with a key question: has AI moved from merely assisting security research to actively participating in it — particularly around the cryptographic assumptions underpinning wallets, exchanges, and smart contracts? Read more… 

US House Passes GUARD Act to Boost Law Enforcement Fight Against Elder Fraud, Crypto Scams 

The U.S. House of Representatives has passed the bipartisan GUARD Act (H.R. 2978) on September 15, 2026, aimed at strengthening law enforcement's ability to combat elder financial fraud and cryptocurrency scams. Co-led by Representatives Josh Gottheimer, Zachary Nunn, and Scott Fitzgerald, the bill now heads to the Senate. Read more… 

Weekly Cybersecurity Takeaway 

This week's developments span the full spectrum of cyber risk — from small UK businesses absorbing a disproportionate share of attacks, to a hardware-level flaw putting console owners at physical-proximity risk, to AI tools being weaponized for non-consensual imagery at unprecedented scale.   Meanwhile, policy responses are accelerating on multiple fronts: US lawmakers are moving to arm local investigators against crypto-enabled elder fraud, and the UAE is deepening its national threat-intelligence posture through public-private partnership.  Taken together, the stories point to a widening gap between the speed of exploitation — whether by scammers, deepfake operators, or nearby attackers exploiting hardware — and the pace of institutional response, even as that response visibly picks up. 

💾

AI is already reshaping how crypto and blockchain systems get attacked — and defended. In this episode of Security Pill Season 2.0, we speak with Rahul Singh...

Cisco ISE Vulnerability With CVSS 10.0 Score Under Active Attack

✇Cybersecurity News and Magazine
By: Ashish Khaitan
18 September 2026 at 05:42

CVE-2026-76460

Cisco has released a fix for a maximum-severity flaw in its Identity Services Engine (ISE) platform after confirming the bug was already being exploited by attackers. The vulnerability, tracked as CVE-2026-76460, carries a perfect CVSS score of 10.0 and was patched by Cisco on September 16, 2026.  The flaw sits in an API within Cisco Identity Services Engine and stems from inadequate authentication checks on an API endpoint. Because of this weakness, an unauthenticated attacker could send a specially crafted request to that endpoint and slip past ISE's web-based management interface entirely, gaining unauthorized access to the device without needing valid credentials. 

CISA Adds CVE-2026-76460 to Its Exploited Vulnerabilities List 

Given that Cisco confirmed active exploitation of CVE-2026-76460, the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, a designation reserved for bugs already being weaponized in real-world attacks.  Cisco ISE has long served as one of the most widely deployed network access control tools in enterprise environments, helping organizations manage security policies centrally, confirm the identities of users and devices, and govern who and what can reach different parts of a network. That central role is precisely what makes a bypass of its authentication so dangerous, according to security researchers. 

Experts Warn of Ransomware and Lateral Movement Risk 

John Strand, owner of Black Hills Information Security, echoed the urgency, recommending that affected organizations patch immediately and disconnect ISE instances from direct internet exposure. Strand also warned that the bug could plausibly be leveraged in a ransomware attack.   Even so, he noted that relatively few ISE deployments appear to be directly exposed to the open internet, which limits the number of organizations at risk from an opportunistic, internet-facing attack. His larger concern is what happens after attackers are already inside a network: "I'd be more concerned about it as a post-exploitation lateral movement opportunity.   An attacker gets into the environment through something else, discovers a vulnerable ISE internally, and uses that to expand access or compound the damage." 

Signs of Compromise and Recommended Checks 

Cisco's advisory notes that successful exploitation can hand attackers root-level command execution, meaning they could potentially erase or mask evidence of their intrusion. The company is advising administrators to cross-reference network and firewall logs from outside the affected device to spot unusual activity, including unexpected data transfers to external addresses. Suspicious usernames in the access logs are cited as one possible indicator of compromise, and Cisco recommends checking every node in a distributed deployment. 

Affected Products and Fixed Releases 

The vulnerability affects Cisco ISE and ISE Passive Identity Connector regardless of how a device is configured. No workarounds exist, though Cisco suggests using infrastructure access control lists to restrict management traffic as a temporary mitigation. Fixed releases are available for versions 3.1 through 3.5, including 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Version 3.0 has already reached the end of software maintenance, so organizations still running it are advised to migrate to a supported release.  The issue was discovered during a Cisco Technical Assistance Center support case, and the advisory was published in final form on September 16, 2026. 

New Parallels Desktop Flaw Lets Local Users Seize Root Control of Macs

✇Cybersecurity News and Magazine
By: Ashish Khaitan
17 September 2026 at 04:12

CVE-2026-90894

A newly documented security flaw in Parallels Desktop, identified as CVE-2026-90894 and nicknamed "ParaShells," could let any local account on a Mac escalate to full root control of the host machine, according to researchers at JFrog.  The risk is greatest on developer machines, where something as ordinary as a compromised Homebrew formula or a malicious npm preinstall script could serve as the entry point for escalating from a standard user to complete system control.   Shared computers with multiple local accounts — think university labs or office workstations — face similar exposure, said Yuval Moravchick, who leads JFrog's vulnerability research team.  Once an attacker reaches root, Moravchick said, they can swap out system software, access other users' files, and maintain persistence through launchd. 

Inside the ParaShells Exploit Chain 

CVE-2026-90894 is an argument-injection bug confirmed to affect Parallels Desktop for Mac version 26.4.0 running on Apple silicon. Earlier releases haven't been ruled out, but JFrog's team didn't test them.  Three conditions have to line up for ParaShells to work: the vulnerable version of Parallels needs to be installed, though no virtual machine actually has to be running; the prl_disp_service — which launches automatically as root via its daemon — must be active, along with its accompanying socket at /var/run/prl_disp_service.socket; and the attacker needs the ability to execute code under any low-privileged local account.  Moravchick described the mechanics as a combination of weaknesses stacking together: a Unix socket left world-writable, a client-authentication scheme that verifies peer credentials instead of checking a Team ID, and an argument-injection flaw in how the software unpacks appliance files. "The chain is short," he said. "A world-writable Unix socket, a login that trusts peer credentials rather than a Team ID, and an appliance unpack path that builds tar arguments using Qt string splitting." A stray quote character in the parent path allows the attacker to inject the flag "–use-compress-program=", causing macOS's tar utility to execute the attacker's script with root privileges. 

Disclosure and Fix for CVE-2026-90894 

JFrog reported the ParaShells vulnerability to Parallels' parent company, Alludo, which patched the issue in Parallels Desktop version 27.0.0, released in early September 2026. The company published its technical write-up two weeks after the patch shipped, but withheld the one-line proof-of-concept script it had developed to demonstrate the exploit.  Moravchick recommended that organizations identify every Mac running Parallels Desktop, restrict local account permissions on those systems, and update to version 27.0.0 or later to close off CVE-2026-90894. 
❌