TL;DR
Microsoft shipped 974 patches in its largest-ever batch; GitLab CVSS 10 flaw saw in-the-wild probes within hours of disclosure; Anthropic disrupted seven China-based labs running industrial-scale Claude distillation attacks, while separately detecting Russia-linked cyber-espionage targeting 20+ government entities.
Executive Summary
- Microsoft released 974 security patches, its largest single batch ever, addressing Windows and related software vulnerabilities; AI is accelerating vulnerability discovery but experts warn coverage remains incomplete.
- GitLab path-traversal flaw CVE-2026-85706 (CVSS 10.0) saw in-the-wild exploitation attempts within hours of public disclosure, now listed in CISA's KEV catalog.
- Anthropic identified and disrupted industrial-scale illicit distillation attacks against Claude from seven China-based AI labs including Alibaba, DeepSeek, and Moonshot. ⚠
- Russia-linked cyber-espionage group deployed Claude to target 20+ government, intelligence, diplomatic, and defense organizations; Anthropic detected and disrupted the campaign.
- CISA added five actively exploited vulnerabilities to its KEV catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS.
Top Threats Today
1. Microsoft’s Record Patch Batch Addresses 974 Vulnerabilities
Severity: HIGH Affected: Government, Technology
Microsoft released updates to address at least 974 security holes in Windows operating systems and related software, marking the largest single patch batch in company history [1]. Microsoft states that artificial intelligence is helping accelerate vulnerability discovery, though security experts caution that many vulnerabilities may remain unpatched [1]. Specific CVE details from this batch include CVE-2026-69730, CVE-2026-69829, CVE-2026-81963, and CVE-2026-85880 [1].
Sources:[1] Krebs on Security
Recommended Action
- Prioritize deployment of the Microsoft September 2026 patches across all Windows systems, with particular focus on mission-critical infrastructure
- Monitor patch deployment logs and validate installation across your estate within 72 hours
- Review Microsoft’s advisory for any CVEs affecting your specific software versions and deploy in priority order
2. GitLab CVSS 10.0 Path Traversal Exploited Within Hours of Disclosure
Severity: HIGH Affected: Technology
GitLab Community Edition and Enterprise Edition contain a path traversal vulnerability (CVE-2026-85706, CVSS 10.0) that allows unauthenticated attackers to read arbitrary files from the GitLab server [3]. The flaw exists in the repository commits API due to improper path confinement and missing authentication enforcement [3]. In-the-wild probes began within hours of public disclosure [2], and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 11, 2026, with federal remediation required by September 14, 2026 [3].
Sources:[1] The Hacker News[2] The Hacker News[3] CISA KEV
Recommended Action
- Apply GitLab security patches immediately if you operate Community or Enterprise Edition instances
- Audit GitLab access logs for suspicious repository commits API requests from unauthenticated sources
- If patching is delayed, restrict network access to GitLab instances to authenticated users only
- Review any files accessed via the repository commits API for potential exposure
3. Anthropic Disrupts Industrial-Scale Claude Distillation Attacks from Seven China-Based Labs
Severity: HIGH Affected: Technology
Anthropic identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (also known as Zhipu), and MiniMax [1]. Knowledge distillation is a legitimate training technique, but in this case the attacks were conducted at scale without authorization to extract Claude’s model capabilities [1].
Sources:[1] The Hacker News
Recommended Action
- Review API usage logs for abnormal query patterns or volumetric anomalies that could indicate model extraction attempts
- Implement rate-limiting and behavioral analysis on API endpoints to detect distillation activity
- Monitor for unauthorized access tokens or credential misuse tied to AI service accounts
4. Russia-Linked Cyber-Espionage Campaign Weaponizes Claude Against 20+ Government Entities
Severity: HIGH Affected: Government, Defense
Anthropic detected and disrupted a Russia-linked cyber-espionage group that deployed Claude as a tool in hacking operations targeting more than 20 government, intelligence, diplomatic, and defense organizations [1]. The campaign was successfully disrupted by Anthropic before broad impact could be achieved ⚠[1].
Sources:[1] The Record
Recommended Action
- Alert government and defense personnel to the risk of state-sponsored AI tool abuse in spear-phishing and reconnaissance
- Review inbound communications (email, messaging) for unusual requests that may have been AI-generated or optimized
- Implement additional authentication and verification protocols for sensitive requests, particularly those asking for access, credentials, or systems information
5. CISA Adds Five Actively Exploited Flaws to KEV Catalog
Severity: HIGH Affected: Technology
CISA added five vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog [1]. These include CVE-2026-84869 in ConnectWise ScreenConnect (improper privilege management and missing authorization, allowing file transfer and execution without authorization) [2]; CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory (incorrect authorization and improper authentication, respectively, both leading to privilege escalation or exposure of sensitive resources) [3][4]; and CVE-2026-86060 in MikroTik RouterOS (improper neutralization of argument delimiters allowing privilege escalation) [5]. Federal remediation deadlines range from September 13 to September 25, 2026 [2][3][4][5].
Sources:[1] The Hacker News[2] CISA KEV[3] CISA KEV[4] CISA KEV[5] CISA KEV
Recommended Action
- Identify and inventory all instances of ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS in your environment
- Apply patches or workarounds by the federal remediation deadline for your sector
- For ScreenConnect, restrict access to remote sessions and review file transfer logs for suspicious activity
- For Artifactory, audit token usage and authentication mechanisms, ensuring proper scope validation
- For RouterOS, review policy masks and access controls for unauthorized modifications
Today’s Action Checklist
- ☐ URGENT: Deploy Microsoft September 2026 patches across Windows infrastructure within 72 hours
- ☐ URGENT: Patch GitLab Community/Enterprise Edition immediately to remediate CVE-2026-85706
- ☐ URGENT: Identify and remediate ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS instances by CISA federal deadlines
- ☐ Review GitLab access logs for unauthorized commits API requests; audit files accessed
- ☐ Alert security teams and government partners to Russia-linked AI-assisted cyber-espionage targeting government/defense sectors