Company
Google's cybersecurity research unit tracking state-sponsored and criminal threat actors, publishing analysis on malware, phishing, and attacker infrastructure.
Attackers altered files on AOMEI's update servers in windows of five to ten minutes between May and July 2026 to push a backdoor to Backupper installs. AOMEI has reported fixing its servers, but the researchers say that does not remove the backdoor from machines already hit.
Reality
BeyondTrust says a suspected China-nexus actor has exploited Remote Support flaw CVE-2026-102764 since late August. SaaS customers were patched on October 8, but self-hosted installs without automatic updates must be updated by hand.
Perspective Coverage
8 publishersReality
CERT-In said on October 15 that AI agents under test read business records on live Indian systems. No victim detected the access, and CERT-In calls the weaknesses behind it ordinary: exposed credentials and loose cloud roles.
Perspective Coverage
10 publishersReality
iVerify has disclosed P7 DarkSword, iPhone spyware that scans for crypto wallets and polls its operators for new orders every 15 seconds. It gets at wallet data through the phone's own stores, so protecting the device is now part of protecting the coins.
Reality
Fitch expects the possibly AI-assisted breaches at nine South Korean banks to bring penalties, compensation costs and higher security spending. No material losses have appeared yet, so the early cost lands on bank budgets while incident counts in Korea and Japan keep rising.
Reality
iVerify disclosed P7 DarkSword, a reworked variant of a leaked iOS exploit kit for iPhones on iOS 18.4 to 18.7 that steals keychain and crypto-wallet data. The commercial chain leaked onto a second-hand market, where financially motivated operators have been buying it since late 2025.
Reality
Mandiant and Google traced a September 2026 campaign exploiting NetScaler bug CVE-2026-88772, CVSS 9.5, to root on appliances with no login. From there the intruders drop web shells and a Python tunneler that reaches into victims' internal networks to steal credentials.
Perspective Coverage
21 publishersReality
Google Threat Intelligence Group counted 10,740 vulnerability disclosures in August, more than double the monthly figure at the start of 2026. Exploitation is rising more slowly, so the first call on any budget reopened this quarter is triage capacity.
Reality
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
LevelBlue says attackers are exploiting NetScaler flaw CVE-2026-88771, rated 9.5, to create a hidden superuser account and plant web shells. The patch closes the injection but removes neither, so already-exposed appliances need a compromise check.
Reality
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
Attacker server logs show the Coruna iOS WebKit kit compromising a live iPhone's browser in six seconds, two months after Google published its teardown. It fired with no tap from the user, on a phone still running iOS 15.8.3.
Reality
ShinyHunters is again mass-exploiting Oracle PeopleSoft flaw CVE-2026-35273, defeating firewall rules by URL-encoding a single character. Anyone who filtered the endpoint instead of applying Oracle's June 10 patch should assume exposure.
Perspective Coverage
8 publishersReality
Mandiant says ShinyHunters has planted web shells on dozens of Oracle PeopleSoft systems by URL-encoding one character to get past firewall rules. Employers that treated June's stopgap as the fix now have to patch and also look for any access the attackers left behind.
Reality
ShinyHunters is exploiting an unpatched CVSS 9.8 pre-login flaw in Oracle PeopleSoft, encoding one URL character to slip past WAF rules matching the raw path. Mandiant has confirmed JSP web shells on dozens of systems.
Reality
Google says UNC6671 split its extortion into Redact, Pink, Helix and Falcon on shared infrastructure while still working finance, legal and med tech. It averages 1.5 new victims a day.
Reality
Google's threat intelligence team ties three suspected Russian clusters to abuse of Google OAuth, app passwords and device linking. MFA completes normally, so consent telemetry is the control.
Reality
The firm says intruders reached its cloud platforms in July and took names, birth dates and Social Security numbers. Google attributes the campaign to BlackFile, a Com affiliate with four extortion brands.
Reality
Security · September 1, 2026 · Confirmed2 publishers
Invest · September 11, 2026 · Confirmed3 publishers
Security · September 16, 2026 · Confirmed3 publishers
Leadership · September 16, 2026 · Confirmed2 publishers
Security · September 8, 2026 · Confirmed3 publishers
Product · August 21, 2026 · One report1 publisher