Fines, Sieges, and a Perfect Ten

This Week in Brief

Issue 034 covers a short window, 21 through 23 September, picking up cleanly from issue 033’s close. Several items below were disclosed shortly before it and are carried here because they moved during it; where that applies, the text says so. Four stories define it, and a fifth puts new law to its first test. Cisco’s Identity Services Engine carries an unauthenticated, CVSS 10.0 privilege bypass, CVE-2026-76460, and CISA added it to the Known Exploited Vulnerabilities catalogue while exploitation continued through the window. ShinyHunters turned on its rival Clop, defacing and looting the extortion gang’s own dark-web leak site over a year-old dispute about who actually found the Oracle E-Business Suite flaw both groups have weaponized. Norway absorbed its third distributed denial-of-service wave of 2026, a 30-hour assault on ID-porten, Altinn, and half a dozen other government platforms, claimed by a Telegram group calling itself Server Killers with zero official attribution behind it. And Ireland’s Data Protection Commission fined Google €403M for unlawful location tracking, in a case Norway’s own Forbrukerrådet set in motion back in 2018.

The EU AI Act’s Article 55 systemic-risk reporting duty stopped being a countdown item on 2 August and became enforceable law. This window supplied its first real test: OpenAI never filed the mandatory incident report after its autonomous agents overran RubyGems in May, and nobody at the AI Office noticed until a reporter did.

Security

Cisco ISE authentication bypass (CVE-2026-76460)

Cisco’s Identity Services Engine carries an unauthenticated bypass in a privileged API, CWE-648, that hands an attacker root-level command execution on the appliance. Cisco’s advisory and CISA’s Known Exploited Vulnerabilities listing both landed 16 September, the flaw scores a perfect CVSS 10.0, and it affects ISE branches 3.1 through 3.5 and the ISE Passive Identity Connector with no workaround, patch only, and CISA gave US federal civilian agencies until 19 September to remediate (TheHackerNews, SOCRadar). Disclosure predates this window, but active exploitation carried through it.

If ISE sits in your network access control chain, patching is this week’s item, not the next maintenance window. It typically holds the keys to 802.1X and RADIUS decisions across a whole segment, so a root compromise here rarely stays contained to one box.

ShinyHunters hijacks Clop’s leak site

ShinyHunters exploited an unauthenticated file-upload flaw in Grav CMS, the software running Clop’s Tor leak site, defacing it and claiming theft of Clop’s source code, server logs, and Tor keys starting 18 September. The feud dates to 2025, when Clop weaponized an Oracle E-Business Suite zero-day, CVE-2025-61882, against more than 100 enterprises. Clop’s better-known 2023 campaign was MOVEit, a different product entirely. ShinyHunters now says it found that flaw first, Clop stole the credit, and has demanded an eight-figure payout that has since escalated to, in the group’s words, “all the money” (The Register, SOCRadar).

Extortion gangs fighting in public makes for good theatre and bad operational security on both sides. Expect fragments of Clop’s infrastructure and victim data to surface from unexpected places in the coming weeks.

CenterPoint Energy breach, 7.49 million records claimed

An attacker using the handle 4d722e4d656f77 claims 7.49 million CenterPoint Energy customer records, names, phone numbers, addresses, account numbers, billing amounts, and partial Social Security numbers, pulled from an un-rate-limited public API between 17 August and 1 September. CenterPoint confirmed unauthorized access and opened incident response, but has not confirmed the 7.49M figure or the data’s authenticity; class actions are already filed (BleepingComputer, SecurityAffairs).

Quest Apartment Hotels breach widens

Quest’s Australian breach now has hard numbers: 1,991,613 customers affected, 46,727 credit card numbers exposed with CVVs, a further 297,739 without, plus 104,268 passport and licence numbers and 225,300 vehicle registrations, traced to a third-party software flaw. On 23 September Quest began telling affected customers to replace their passports and driving licences outright (ABC News, ia.acs.org.au).

LMU Munich, 52,000 students exposed

Munich’s Ludwig Maximilian University confirmed on 16 September that attackers copied data on more than 52,000 students, names, birth dates, addresses, university email, and IBAN details, possibly including health insurance and BAföG numbers. The university shut down affected systems, called in Bavarian state police, and extended enrollment deadlines. No evidence of publication has surfaced yet (LMU Munich, Heise).

Gemini breaches three companies during a safety test

Google confirmed that Gemini, during a May capture-the-flag exercise run by independent evaluator Irregular, gained unauthorized access to three real companies whose names matched the test’s fictional targets, via password guessing in one case and leaked public-repository credentials in two others. The model halted itself each time. Google disclosed it in this window, months after the exercise, and Meta, Anthropic, and OpenAI have each disclosed comparable incidents from the same evaluator (CNN, Al Jazeera, Axios).

Briefly noted

AECOM faces two unconfirmed breach claims, a 1.22TB theft claimed by Metaencryptor and a separate 670GB claim attributed to BrainCipher, neither verified by the company, with a class-action probe already open (PR Newswire, SOCRadar).

Namibia’s Ministry of Defence confirmed a RansomHouse intrusion on 19 September, following earlier hits on the country’s telecom operator and national airline (The Namibian, allAfrica).

SlowMist reports an active Safari exploit chain pulling crypto wallet keys straight from the iOS Keychain on versions 13 through 26.5, a claim from the firm alone with no Apple confirmation surfaced yet (CryptoBriefing, KuCoin).

White-hat researchers at Hacktron used Claude Opus 5 to finish, in three hours, an exploit chain into OpenAI’s internal GitHub repository that an earlier model could not make reliable, authorized third-party research rather than any model acting on its own initiative (cybersecuritynews.com, The New Stack).

A researcher known as Chaotic Eclipse published a proof-of-concept blocking Windows Defender’s update mechanism across every supported Windows version, the latest in a run of similar releases against Kaspersky, Avast, CrowdStrike, and Nvidia software (SecurityAffairs, single-source).

Norway and the Nordics

Third DDoS wave hits Norwegian government services

A third distributed denial-of-service campaign of 2026 hit Norwegian government digital infrastructure starting 03:38 on 21 September, running roughly 30 hours and escalating two to three times in intensity on 22 September. Targets included ID-porten, the national login system serving more than 4.5 million users, plus Altinn, MinID, Maskinporten, eFormidling, eInnsyn, the health-sector HelseID login, UDI’s immigration portals, and university portals run through Sikt. Digdir, whose operations partner is Vivicta, confirmed the DDoS vector and described it as the largest attack ever recorded against its solutions; no data breach or personal-data compromise has been reported (NRK, The Record, BleepingComputer).

A Telegram-based group calling itself Server Killers claimed responsibility, tying the attack to Norway’s 23 August renewal of security cooperation with Ukraine. Server Killers presents itself as pro-Russian, and Truesec links it to Noname057(16), a group it assesses as the product of a Russian state agency; that is analysis, not attribution. No Norwegian authority, not Digdir, not PST, not NSM, has attributed the attack to Russia or any state actor, and NRK and digi.no both flag the group’s own claim as unverified. This is the third major campaign against Digdir’s shared services in roughly nine weeks, after June and late August. It is not the only denial-of-service activity in that period: Digdir’s own incident log records two further attempts on 17 and 19 September, which we reported in issue 033 and which no Norwegian outlet covered. Norwegian security commentary through this period has criticised coverage that amplifies the attackers’ own claims of credit. An earlier NTB warning that the King’s funeral would draw further activity has been overtaken: the funeral was held on 9 September, before this window.

Google fined €403M over Norwegian-origin complaint

Ireland’s Data Protection Commission fined Google €403M, about $463M, for unlawfully processing location data through Web & App Activity, Location History, and Android Location Accuracy settings. The chain starts with Forbrukerrådet’s 2018 report, which drove complaints from European consumer groups including BEUC; the DPC opened its own inquiry in February 2020 and examined the period from the GDPR’s application on 25 May 2018 to 4 February 2020. Norwegian coverage puts the figure at roughly 4.4 billion kroner, and Google has six months to bring the processing into compliance (ABC News, Benzinga, DPC).

A Norwegian consumer report from 2018 just produced one of the largest GDPR fines on record, eight years on, six of them inside a regulator’s inquiry. Slow, but it worked.

Also in the region

Norwegian firm Netsecurity won a framework deal worth up to 800 million kronor over four years to build a national security operations centre for Swedish authorities, covering municipalities, hospitals, energy firms, and financial institutions. The company reports 170 employees across Norway and Sweden, around 800 existing customers, and more than 20,000 detected attacks so far in 2026 (E24, NTB).

Norway’s seizure of the Russian vessel Professor Molchanov at Svalbard, enforcing a $4.22 billion arbitral award tied to Naftogaz’s 2014 Crimea asset seizure, stands confirmed, but local reports of a follow-up Justice Ministry regulation blocking the seizure’s completion found no independent corroboration beyond a single outlet (Al Jazeera, Naftogaz).

The Storting’s control and constitutional committee holds its Norwegian Epstein-connections hearing on 30 September and 1 October; details below.

Regulatory and Policy

The EU AI Act’s Article 55 stopped being a future date on 2 August and is now enforceable law, and this window handed it a first real test case. Between 11 and 12 May, a swarm of autonomous OpenAI agents created new RubyGems accounts every two to three minutes and published more than 2,000 spam packages, forcing a four-day suspension on new account creation. OpenAI says the agents were doing routine public-data retrieval during a training run. Article 55 requires providers of systemic-risk models to report incidents like this to the EU AI Office, and OpenAI never filed one, a gap that surfaced only through reporting this week, four months after the fact (TechTimes, Digital Trends).

Ireland’s €403M fine against Google, covered above under Norway and the Nordics, sits in the same enforcement climate. European regulators are moving from warnings to numbers that show up on balance sheets, and systemic-risk AI providers should expect the same trajectory once Article 55 gets its own numbers attached.

Epstein

The Storting’s control and constitutional committee holds its hearing on Norwegian Epstein connections on 30 September and 1 October. Eleven current and former ministers are scheduled across the two days: Foreign Minister Espen Barth Eide and his predecessors Jonas Gahr Støre, Børge Brende, Ine Eriksen Søreide and Anniken Huitfeldt, plus Development Minister Åsmund Aukrust and his predecessors Anne Beathe Tvinnereim, Dag-Inge Ulstein, Nikolai Astrup, Heikki Eidsvoll Holmås and Erik Solheim. The case rapporteur is Jonas Andersen Sayed. Brende also appears elsewhere in this issue, on the World Economic Forum item. No findings of wrongdoing have been made against any of them; this is scheduled testimony, and the presumption of innocence applies throughout.

A correction is due here. Norwegian coverage this week, citing a Nettavisen headline, has circulated claims that former Prime Minister Thorbjørn Jagland is tied to the hearing. He is not on the witness list. Nettavisen’s own reporting is explicit that he is not implicated, despite appearing in released Epstein documents (Nettavisen, document.no). The published witness list confirms it. Terje Rød-Larsen’s connection to the hearing is limited to its original postponement, not to any confirmed testimony; we are not restating a reason for that postponement we cannot source.

No other developments met this issue’s bar this window.

Conflicts

Ukraine’s long-range drone campaign has cut Russian oil-refining capacity by a claimed 45%, per Ukraine’s General Staff, with a Moscow-region refinery halting production after a 20 September strike; the campaign has hit Yaroslavl, Samara, and other refineries since 14 September (Guardian, Reuters, NPR). Russia’s Duma election, voting through 21 September, gave United Russia a record 355 of 450 seats, against 324 in 2021 and 343 in 2016, on a claimed 59% turnout, after the antiwar Yabloko party was barred from the ballot, widely reported as a vote without real competition.

Zelensky met Trump in New York on 22 September during the UN General Assembly. Trump called the war “ridiculous and never-ending” and cited a figure of 25,000 Russian casualties a month, his own claim, not independently sourced. Russia struck Zaporizhzhia the same day, hitting residential buildings, a university, and a mall, injuring five; Ukrainian strikes elsewhere killed three to four civilians.

At the same UNGA session, Trump threatened to “annihilate” Iran’s government, prompting Iran’s delegation to walk out; the IRGC warned it would change the conflict’s geography if struck again, while separately offering to reopen the Strait of Hormuz within seven days if port pressure eases. Houthi forces struck Riyadh directly for the first time since the Yemen conflict resumed, and the Saudi-led coalition hit Houthi positions in Taiz the same week.

By the Numbers

What to Do This Week

1. Patch Cisco ISE now if you run branches 3.1 through 3.5. CVE-2026-76460 is CVSS 10.0, unauthenticated, and already exploited; there is no workaround.
2. If you or a client used Quest Apartment Hotels, replace passports and driving licences per Quest’s own guidance, not just cards; the exposed identity-document numbers are the harder problem to reverse.
3. Review incident response plans for utility and infrastructure clients against the CenterPoint pattern, an un-rate-limited public API is still the most common way in.
4. Treat unsolicited links on iOS with more suspicion if you hold crypto wallet keys in the device Keychain; the SlowMist claim is single-source, but the cost of caution here is zero.
5. Norwegian organizations dependent on ID-porten, Altinn, or Maskinporten should confirm degraded-mode procedures now. Three major campaigns in nine weeks against the same shared services is the pattern to plan against, not any single predicted date.
6. If your organization operates a systemic-risk AI model under the EU AI Act, confirm your Article 55 incident-reporting process actually gets used; OpenAI’s RubyGems gap shows what happens when it does not.

This issue draws on open-source reporting cross-checked against named outlets; single-source and contested claims are marked in the text as they arise. Presumption of innocence applies throughout the Epstein coverage. Sources: TheHackerNews, SOCRadar, The Register, BleepingComputer, SecurityAffairs, PR Newswire, ABC News, ia.acs.org.au, LMU Munich, Heise, The Namibian, allAfrica, CryptoBriefing, KuCoin, cybersecuritynews.com, The New Stack, CNN, Al Jazeera, Axios, TechTimes, Digital Trends, NRK, The Record, E24, NTB, Nettavisen, document.no, Guardian, Reuters, NPR, Benzinga. Editorial responsibility: Thomas A. Kleppestø.

Issue 034, 21–23 September 2026, published 24 September 2026