The Daily Zero-Day

Executive Summary

Today's edition of The Daily Zero-Day (September 23, 2026) highlights a rapidly evolving threat landscape where autonomous AI malware frameworks, cloud supply chain attacks, and sophisticated social engineering converge. With Microsoft issuing a massive patch cycle covering nearly 1,000 vulnerabilities, and critical supply chain surfaces like HashiCorp and GitLab facing active abuse, organizations face unprecedented pressure. Autonomous C2 implants, AI chatbot poisoning campaigns, and sprawling infostealer trends underscore the urgent need for robust telemetry, strict access management, and proactive posture management across enterprise infrastructure.

Top Intelligence Briefings

Cloud & Supply Chain Security

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors have leveraged this specific cloud deployment vector at scale to target infrastructure pipelines.

Actionable Takeaway: Audit third-party Terraform providers and Go modules in your deployment pipelines; restrict downloads to pinned, verified internal registries.

Autonomous Threat Intelligence

The Closed Quorum: Inside the first reported autonomous AI C2 implant

CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a critical paradigm shift in how AI-integrated malware operates independently in compromised environments.

Actionable Takeaway: Implement advanced behavioral anomaly detection to catch self-governing routines and unexpected internal C2 traffic loops.

DevSecOps Vulnerabilities

A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

The private email address GitLab provides for filing issues by email acts as a functional credential. Anyone who intercepts or discovers it can email a patch that GitLab automatically commits in your name and triggers associated CI/CD pipelines.

Actionable Takeaway: Rotate personal GitLab issue email tokens immediately and enforce branch protection rules alongside strict commit verification.

Enterprise Patch Management

Microsoft Plugs Nearly 1,000 Security Holes

Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, representing one of its single largest coordinated software patch deployments to date.

Actionable Takeaway: Prioritize deployment based on active exploitation telemetry, focusing heavily on critical remote code execution vectors across Windows components.

Threat Intelligence & Campaigns

Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign

Threat actors are actively poisoning ChatGPT, Gemini, and Google AI Overview answers by seeding the web with malicious links and data, optimizing content to trick users into trusting fabricated guidance.

Actionable Takeaway: Educate employees on AI-generated hallucinations and poisoned reference links, implementing web filtering to block known malicious sources.

Quick Hits & Advisories

Data Privacy: Data Broker Radaris Loses Domains in Privacy Fight over persistent refusal to honor personal data removal requests.
AI Safety Research: New paper explores Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment.
Cryptanalysis: GPT-6 Astra Breaks an Old Enigma Message in a stunning display of advanced LLM computational capability.
Regional Threat Intelligence: UAE, Saudi Arabia Face Onslaught of Increasingly Complex Cyberattacks, absorbing half of Gulf region incidents.
Data Breaches: Massive Student Loan Breach Exposes 2.5M Records, threatening individuals with long-term exposure.
Watering Hole Operations: Watering Hole Attacks Push ScanBox Keylogger via APT TA423 reconnaissance frameworks.
Consumer Security: Review what is real and fake when Looking for free Robux? Here’s what’s real, and what’s a scam.
SMB Cybersecurity: The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive details rising pressures on resource-constrained teams.
Malware Tracking: Cisco Talos introduces CAIRN: Frontier tracking for AI-integrated malware research toolkit.
Phishing Vectors: Learn How device code phishing gives scammers access to your account through deceptive authorization flows.
Credential Theft: Fake Claude Max giveaway hides a Google account phishing trap utilizing fake browser overlays.
Credential Leaks: LimeLeads - 17,838,396 breached accounts added to breach databases from a defunct B2B marketing database.
Database Exposures: Burger King Russia - 3,155,792 breached accounts documented from prior system exposures.
Threat Reports: SANS covers Macfinger ClickFix campaign and ISC Stormcast For Wednesday, September 23rd, 2026.
Identity Security: AWS blog highlights Supporting ASD’s multi-factor authentication campaign: Why MFA matters more than ever.
Cloud Logging: AWS details Transforming Bedrock Guardrails events into OCSF with CloudWatch for security teams.
Phishing Defense: Cofense Expands AI-Driven Phishing Defense Platform to Advance Secure Behavior Management.
Behavioral Risk: Lee Martin writes on Beyond Human Risk: A Better Way to Build Secure Behavior.
Dark Web Trends: ASEC publishes Ransom & Dark Web Issues Week 4, September 2026 featuring Metaencryptor activity.
Infostealer Metrics: ASEC releases the August 2026 Infostealer Trend Report on new distribution channels.
Gaming Malware: Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums.
Consumer Fraud: Bitdefender exposes Fake shops target shoppers across Europe with fake Samsung deals, counterfeit goods and World Cup scams.
Global Advocacy: UN Reports Citing Citizen Lab Submissions Published across international bodies.
Refugee Submissions: Submission to the Immigration and Refugee Board of Canada detailed by Citizen Lab.
Software Advisories: CERT Polska flags Vulnerability in WEBCON BPS software (CVE-2026-92419).
Fraud Operations: CERT Polska analyzes Inside a multi stage toll fraud operation targeting Poland.
Frameworks: CIS releases CIS Community Defense Model v3.0: Turning Threat Intelligence Into Action.
Hardening Standards: CIS Benchmarks September 2026 Update published with full changelogs.
Third-Party Advisories: CIS warns of Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution.
Edge Infrastructure: CIS highlights A Vulnerability in F5 BIG-IP Access Policy Manager Could Allow for Remote Code Execution.