The Email Gateway Was Rooted by an Email (09/15/2026)

An email security appliance exists to read every message before a person does, which means it processes untrusted input by design and at volume. The Cisco flaw being exploited today turns that job into the delivery mechanism, and the appliance ends up running the attacker’s commands as root.

Top 5 Critical Security Alerts

1. A Cisco Email Gateway Zero-Day Is Being Exploited for Root

Cisco patched CVE-2026-76461 in Secure Email Gateway after attacks in the wild, a flaw that permits command execution as root on the appliance itself. Every message inbound to the organization passes through this device, so an attacker who owns it sits ahead of every mail-based control you have and behind none of them. Sophos has independently confirmed active exploitation, which removes any argument for treating this as a scheduled change. The Hacker News has the CVE, BleepingComputer has the exploitation, and Sophos has the telemetry.

Operator Note: After patching, treat the appliance as suspect rather than fixed, and check for configuration changes, new administrative accounts, and mail routing rules you did not create.

2. CISA Confirms Ransomware Crews on the VMware Flaw

CISA warned that ransomware groups are now exploiting a critical remote code execution vulnerability in VMware vCenter. A hypervisor management platform is the shortest path from one foothold to every workload in the estate, and ransomware operators reach for it precisely because encrypting at that layer removes the guest-level protections entirely. The move from disclosed to ransomware-operated is the transition that changes your recovery assumptions. BleepingComputer has the warning.

Operator Note: Confirm your backup system cannot be reached with the same credentials that administer your hypervisor, because that single dependency is what turns an outage into a payment decision.

3. Apple Ships a Record Volume of Patches

Apple released what researchers are calling a record-setting number of fixes across its platforms. Volume changes the operational problem rather than the technical one, since nobody is reading the full list and the useful triage is identifying which of them touch code paths reachable without user interaction. Consumer-grade update habits are doing most of the work in any organization without managed device deployment. The Register has the scale.

4. Microsoft Ships an Emergency Fix for Its Own Update

Microsoft released an out-of-band patch to correct the Remote Desktop Services failures introduced by its September updates, which we flagged yesterday as confirmed. An emergency fix for a security update is the scenario that makes people slow down their patch cycle, and the honest reckoning is that the delay this causes will outlast the outage. Separately Microsoft confirmed an Excel update is breaking copy and paste. Infosecurity Magazine has the emergency patch and BleepingComputer has the Excel regression.

5. A Chrome and Windows Zero-Day Chain Delivers GRIMWEDGE

China-linked operators chained zero-days in Chrome and Windows to deploy a backdoor tracked as GRIMWEDGE. A browser flaw for initial execution paired with an operating system flaw for escape is the standard shape of a capable intrusion set, and holding two at once indicates either serious research investment or a supplier. Nothing about the user’s behavior features in this chain at any point. The Hacker News has the analysis.

Additional Security Alerts

Threat Intelligence

• Iranian operators are running Telegram-controlled malware against dissidents and journalists: The same reporting describes fake MRI scan results used as the lure against one target, which is a pretext built from somebody’s medical anxiety. The Hacker News and The Record
• BambooToken is using MQTT for command and control: The protocol is built for industrial telemetry and sits on allow lists in plenty of environments, which is the reason to pick it. The Hacker News
• A WordPress admin plugin backdoored 1,500 sites: A malicious build of Admin Menu Editor Pro reached installations directly, in the same week WordPress announced automated pre-distribution review. BleepingComputer

Incidents and Advisories

• CenterPoint Energy confirmed customer data was stolen: The electric and gas utility acknowledged the theft after a dark web post, which is the sequence that tells you the attacker set the disclosure timetable. BleepingComputer
• Acronis warns of active exploitation in its cPanel backup plugin: Backup tooling holds credentials to everything it protects, so a flaw there is a credential problem before it is an availability one. BleepingComputer
• NIST finalized guidance on protecting identity and access tokens: The publication lands in a month where replayable tokens have shown up in three separate stories. NIST

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.