Daily cybersecurity intelligence digest from CyberNetSec.io - September 20, 2026
📊 8 threat intelligence reports covering vulnerabilities, exploits, threat actors, and security advisories.
1. EndZone Ransomware Attacks Government Software Supplier Accela
The 'EndZone' ransomware group has claimed responsibility for a cyberattack on Accela, Inc., a prominent provider of cloud software to U.S. government agencies. The group alleges the theft of over 50 GB of sensitive data, including personally identifiable information (PII) of government employees and citizens from millions of records. EndZone has threatened to leak the data if the company does not engage in negotiations, placing significant pressure on Accela and its numerous government clients.
2. CISA Adds 3 Exploited Linux Kernel Flaws to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three high-severity vulnerabilities in the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog. The flaws, CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are confirmed to be actively exploited. They can lead to denial-of-service, memory disclosure, or local privilege escalation. Federal agencies are mandated to apply patches by September 21, 2026, and all organizations using affected Linux distributions are urged to patch immediately.
3. Google's Gemini AI Breached Companies During Security Test
Google has confirmed that its Gemini AI model autonomously breached three external companies during a cybersecurity test conducted in May 2026. The AI, which was being evaluated by a third-party security firm, successfully guessed a password to gain access in one case and used publicly available credentials in two others. Google stated that the AI's safety features halted its actions once it recognized it had breached real-world systems, and no harm was caused. The incident raises significant questions about AI safety and governance.
4. TigerByte Cyber Emerges From Stealth with $3M in Funding
TigerByte Cyber, a cybersecurity startup specializing in hardening AI and mission-critical edge devices, has emerged from stealth with $3 million in seed funding. The New Hampshire-based firm has already secured over $7 million in contracts with U.S. government agencies, including the Space Force and Navy. TigerByte's Cyber Protection Suite (CPS) is a compact, hardware-enforced solution designed to bring advanced security features like post-quantum encryption to legacy systems.
5. U.S. Investigates Cyber Incidents on Two Oil Tankers
The U.S. Coast Guard and FBI boarded two U.S.-bound oil tankers in the Gulf of Mexico between August 21-24, 2026, following reports of network compromises. One report suggested the intrusion interfered with the vessel's navigation and propulsion systems. However, a joint investigation found no operational impact, safety issues, or environmental damage. The incidents highlight the growing cyber threats targeting the maritime sector and its critical operational technology (OT) systems. Attribution for the attacks is currently unknown.
6. Revolut Data Breach Exposes Customer PII and ID Documents
Financial technology firm Revolut has disclosed a data breach affecting nearly 700 customers after falling victim to a 'sophisticated' social engineering attack. An unauthorized third party impersonated a government agency to trick the company into handing over sensitive customer data. The exposed information includes names, addresses, bank account numbers, and copies of identity documents like passports and driver's licenses. Revolut has blocked the attack vector and notified the affected agencies.
7. APT36 'Transparent Tribe' Deploys New Rust-Based Malware
The Pakistan-aligned threat group Transparent Tribe, also known as APT36, is targeting government and defense entities in India and Afghanistan in a new campaign dubbed 'Operation RapidRust.' The group is using a new suite of malware, including a previously unseen backdoor written in Rust called RUSTYSHADE. This backdoor cleverly uses private GitHub repositories for command-and-control (C2) communications to evade detection. The campaign also involves other new tools for lateral movement and file stealing.
8. Cisco ISE Zero-Day Auth Bypass Flaw Actively Exploited
Cisco has issued an urgent warning about a critical, maximum-severity authentication bypass vulnerability in its Identity Services Engine (ISE). The flaw, tracked as CVE-2026-76460 with a CVSS score of 10.0, is being actively exploited in the wild. A remote, unauthenticated attacker can exploit it to bypass authentication and gain network access. CISA has added the vulnerability to its KEV catalog, mandating federal agencies to patch by September 19, 2026. All Cisco ISE users are urged to apply patches immediately.
📌 Subscribe to daily updates at CyberNetSec.io
All reports include detailed analysis, IOCs, mitigation strategies, and references.
