Wala Abushaar

Cybersecurity Professional | GRC | Security Operations | Information Security • Sharing my cybersecurity journey and industry insights.

[BleepingComputer @BleepinComputer]

‼️ BREAKING: Microsoft’s September 2026 Patch Tuesday fixes a record-breaking 966 flaws.

⚠️ 2 actively exploited zero-days
🔴 105 total Critical flaws, including:
💥 81 remote code execution
⬆️ 20 privilege escalation

➡️ Learn more: https://t.co/K0G1SNh6hd

[The Hacker News @TheHackersNews]

‼️ Two Windows zero-days are being exploited in the wild.

Microsoft patched them alongside a record 974 vulnerabilities. Both flaws can let authorized attackers elevate privileges locally to SYSTEM, and CISA has added them to its KEV catalog.

Read: https://t.co/xb5srFgHbX

[Wala Abushaar @WalaAbushaar]

Third-party vendors can introduce cybersecurity, compliance, and operational risks.

A strong TPRM lifecycle helps organizations manage those risks from initial assessment through termination and off-boarding.

🔐 Identify → Assess → Mitigate → Monitor → Offboard

#GRC #TPRM

[BleepingComputer @BleepinComputer]

ConnectWise warns of new ScreenConnect flaw without patch
https://t.co/0GMf6Bh2t1

https://t.co/0GMf6Bh2t1

[BleepingComputer @BleepinComputer]

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
https://t.co/nX1khZOg0N

https://t.co/nX1khZOg0N

[BleepingComputer @BleepinComputer]

Microsoft says some users can’t open the Teams desktop client
https://t.co/qQDfq5t5XT

https://t.co/qQDfq5t5XT

[The Hacker News @TheHackersNews]

‼️ WARNING - Attackers are exploiting a Chrome V8 zero-day.

CVE-2026-85046 allows arbitrary code execution inside the browser sandbox via a crafted HTML page. Google fixed it in Chrome 152.0.7977.82/.83.

How the V8 type confusion works: https://t.co/oi8DcrCAQG

[CISA Cyber @CISACyber]

Isolation is a key #CIFortify defense strategy. Our new guidance w/@FBI & partners helps orgs plan effective comms during changes in service availability to limit impact + reduce panic while aligning w/security & containment efforts. Read here 👉 https://t.co/BLmTJjzJRQ

[The Hacker News @TheHackersNews]

⚠️ Fake software installers disable Windows Update and weaken Microsoft Defender.

The active campaign has compromised organizations across seven sectors. Each download keeps the same filename but changes the payload hash.

Inside the attack chain: https://t.co/2zO8Jao3Tz

[Wala Abushaar @WalaAbushaar]

Cybersecurity is more than technical controls.

Understanding frameworks, standards, controls & regulations is essential for effective GRC.

NIST • ISO 27001 • CIS Controls • PCI DSS • COBIT • GDPR

#Cybersecurity #GRC #InfoSec #RiskManagement

[The Hacker News @TheHackersNews]

🚨 TerminalFix turns a fake Cloudflare CAPTCHA into a reverse tunnel inside the victim’s network.

Microsoft says the ClickFix variant tricks users into running PowerShell, then deploys a backdoor that can route traffic to other hosts visible from the infected machine.

Read: https://t.co/2gKovT76S9

[The Hacker News @TheHackersNews]

⚠️ Aurora ransomware operators gave Cursor AI credentials or an existing route into victim networks.

The agent handled exploitation tasks against 10 targets, including network scanning, privilege checks, NTLM relay attempts, and certificate attacks.

Read: https://t.co/CLQItINyfw

[CISA Cyber @CISACyber]

🛡️ We added 2 PaperCut NG/MF vulnerabilities to our KEV Catalog: CVE-2026-81578, a missing authentication for critical function vulnerability, and CVE-2026-82078, an unsafe reflection vulnerability. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org.

[BleepingComputer @BleepinComputer]

Massive DDoS attack disrupts Norway’s government digital services
https://t.co/o1pBO90R4n

https://t.co/o1pBO90R4n

[The Hacker News @TheHackersNews]

🔥 FBI shuts down Chinese hacking platforms tied to intrusions at NASA, the Fed, and U.S. Senate.

QScan exploited vulnerable IoT devices, while QTRouter hid attack traffic behind compromised devices, commercial proxies, and VPSs.

How it worked: https://t.co/MDk69PGdnw

[BleepingComputer @BleepinComputer]

Microsoft Teams now lets admins block external bots from meetings
https://t.co/9nNHHVlFQD

https://t.co/9nNHHVlFQD

[The Hacker News @TheHackersNews]

‼️ A critical Keycloak flaw could let attackers take over any account.

CVE-2026-18963 lets an unauthenticated attacker reset a user’s password without the emailed action token, including for admin accounts.

Read more: https://t.co/AW9mFGSX4U

[BleepingComputer @BleepinComputer]

Microsoft warns of max severity Entra ID flaw exploited in attacks
https://t.co/iZ4cgqap3T

https://t.co/iZ4cgqap3T

[SecurityWeek @SecurityWeek]

Critical GitLab Flaw Exploited Shortly After Disclosure https://t.co/T60yDgibXq

[The Hacker News @TheHackersNews]

🚨 Four Critical Flaws Under Active Exploitation:

• macOS CVE-2026-65400
• SharePoint CVE-2026-55040
• vCenter CVE-2026-59310
• Microsoft IKE CVE-2026-33824

Reported attacks include Monero mining, persistent access, and Babuk-derived ransomware.

Read: https://t.co/O6WRpXB4Di