Daily Cyber & AI Briefing — 2026-09-15

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.TranscriptToday’s cyber and AI risk landscape is defined by a convergence of rapidly evolving threats and a persistent gap between technology adoption and effective governance. Over the past 24 hours, we’ve seen a surge in exploitation of critical vulnerabilities across major enterprise platforms, a marked increase in the sophistication of AI-driven attacks, and a global shift toward tighter data control as organizations respond to digital sovereignty concerns. Let’s break down what’s happening, what it means, and the practical steps risk leaders should be considering today.We’ll begin with the most urgent developments on the technical front: the active exploitation of zero-day vulnerabilities in some of the world’s most widely used enterprise platforms. These aren’t hypothetical risks—they’re being used right now by ransomware groups and other threat actors to compromise business-critical infrastructure.First, the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has confirmed that ransomware gangs are actively exploiting a critical remote code execution vulnerability in VMware products. This isn’t just a proof-of-concept; attackers are using this flaw in real-world ransomware campaigns to gain full control of affected systems. The bottom line is that if you’re running VMware in your environment, immediate patching is not optional. Delayed remediation leaves the door wide open for attackers, especially given how widely VMware is deployed in enterprise and cloud environments. Security leaders need to prioritize vulnerability management, ensure all VMware systems are updated, and ramp up monitoring for any signs of compromise. The lesson here is clear: when a critical infrastructure platform is under active attack, speed and thoroughness in patching make the difference between business as usual and a major incident.The story is similar with Cisco’s email gateway products. Cisco has just released patches for a zero-day vulnerability, tracked as CVE-2026-76461, that was being actively exploited in the wild. This flaw allowed attackers to bypass security controls and gain persistent access to sensitive communications. If your organization relies on Cisco’s email gateways, patching is urgent—but that’s only the first step. You also need to review logs for any evidence of exploitation, since attackers often move quickly to establish persistence or exfiltrate data before defenders can react. This incident is another reminder that edge devices—those systems sitting at the boundary between your organization and the internet—are high-value targets and require continuous monitoring and rapid response capabilities.Online retailers are facing their own critical threat. A zero-day vulnerability known as “StyleSmuggler” is being actively exploited to compromise Adobe Commerce and Magento e-commerce platforms. Attackers are using this flaw to inject malicious code and steal payment data, putting both businesses and their customers at risk. For organizations running these platforms, immediate patching is critical, but so is enhanced monitoring for suspicious activity. This is a wake-up call for the e-commerce sector: robust web application security and vigilance across the software supply chain are now table stakes, not optional extras.The risks don’t stop there. In the software development space, JetBrains Cadence recently experienced a breach due to a critical vulnerability with a CVSS score of 9.8 that remained unpatched for over two weeks. That delay gave attackers a significant window of opportunity. This incident highlights a recurring problem in the software supply chain—delays in patching high-severity bugs can have cascading consequences. For CISOs, it’s a call to action: review your exposure to JetBrains and similar tools, and take a hard look at your patch management processes, especially for high-impact vulnerabilities. The goal is to shrink the window of exposure as much as possible.Now, let’s talk about the evolving tactics of threat actors, particularly their use of AI. Attackers are increasingly leveraging agentic AI systems to automate the exploitation of vulnerabilities and mass credential harvesting. What does this mean in practice? It means attackers can now scan for and exploit vulnerabilities, harvest credentials, and adapt to defenses at machine speed. The scale and adaptability of these AI-driven attacks are raising the bar for defenders. Traditional manual detection and response simply can’t keep up. Security teams should be considering AI-driven detection and response tools to match the speed and sophistication of these threats. If you’re not already evaluating or deploying AI-enabled security solutions, it’s time to start.But it’s not just the attackers who are moving quickly with AI. Organizations themselves are rapidly integrating AI into business processes, often outpacing the development of robust governance and risk management frameworks. New research shows that the adoption of AI technologies is accelerating much faster than the implementation of policies to manage the associated risks. This gap exposes organizations to a host of new threats, including data leakage, model manipulation, and regulatory non-compliance. The takeaway for CISOs is that AI governance can’t be an afterthought. Work with business units to develop clear policies for responsible AI deployment, and ensure that risk management keeps pace with innovation.This brings us to a broader trend: the global push for digital sovereignty. More than half of global and Asia-Pacific businesses are seeking greater control over their data, driven in large part by concerns about AI risks and the need to comply with evolving regulatory requirements. Organizations are rethinking their cloud strategies, demanding more transparency and control from service providers, and preparing for stricter rules around cross-border data flows. For risk leaders, this means reassessing your data governance frameworks, updating policies, and working closely with legal and compliance teams to stay ahead of regulatory changes. Digital sovereignty isn’t just a compliance issue—it’s becoming central to how organizations manage risk in a world where data is both an asset and a liability.On the technology side, we’re also seeing security vendors respond to these new challenges. Proofpoint, for example, has expanded its AI-powered investigation tools for Microsoft 365, giving organizations deeper visibility into insider risk and AI-related activity. As AI becomes more integrated into daily business workflows, having the ability to detect anomalous behavior and potential data leakage tied to AI usage is going to be essential. These kinds of monitoring tools will play a key role in managing new classes of risk and ensuring ongoing compliance.Of course, not all threats are purely technical. Social engineering remains a persistent and evolving risk. A new attack method called ClickFix is making the rounds, using fake CAPTCHA challenges to trick users into installing malware themselves. In one recent incident, a compromised HBO Max Reddit account was used to distribute malware via this technique. What makes ClickFix particularly dangerous is that it bypasses traditional technical controls by exploiting user trust and behavior. The practical implication is that ongoing security awareness training is more important than ever, and organizations should also invest in advanced email and web filtering to catch these kinds of attacks before they reach end users.Returning to the challenge of protecting internet-edge devices, the Hong Kong Computer Emergency Response Team has warned that patching alone is no longer sufficient. Attackers are using advanced techniques to maintain persistent access and steal credentials, even after vulnerabilities have been patched. This means organizations need to move beyond a patch-and-forget mentality. Layered defenses—including network segmentation, strong authentication, and continuous monitoring—are now required to protect these high-risk assets. If your edge devices aren’t being monitored for unusual behavior, you’re leaving a critical gap in your defenses.Attackers are also getting more creative in abusing native operating system tools. There’s been a notable uptick in the abuse of the Windows VSSAdmin tool, which is being used to extract the NTDS.dit Active Directory database and delete recovery copies. This makes it much harder for organizations to recover from attacks, as both credentials and backup data are being targeted. Security teams should be monitoring for suspicious use of VSSAdmin and ensuring that backup and recovery strategies are resilient to these kinds of tactics. If you’re relying on standard backup procedures without additional controls, it’s time to reassess.Another emerging risk area is AI knowledge distillation—the process of compressing large AI models into smaller, more efficient ones. While this can improve performance and reduce costs, it also introduces security risks. Poorly managed distillation can lead to model inversion, data leakage, and reduced robustness. Organizations deploying distilled AI models need to assess the security implications and put proper controls in place to prevent unintended information disclosure. This is a nuanced area, but as AI models become more central to business operations, understanding and mitigating these risks will be increasingly important.Let’s take a step back and look at the strategic implications of these trends. First, the increasing exploitation of zero-day vulnerabilities in core enterprise platforms means that accelerated patch management and improved supply chain security are now essential. The o