This is your security briefing for Wednesday the 16th of September 2026, drawn from the BlueTeamSec community on infosec.pub. A busy one today, with 14 stories to get through.
The UK Government Digital Service announced that passkey authentication has been rolled out to over 23 million users of GOV.UK One Login. Passkeys use device-based biometrics or PINs, providing phishing-resistant authentication and eliminating credential stuffing risks. Yesterday saw several CISA vulnerabilities flagged as being related to this rollout.
Information security researchers at Russia's T-Bank released Bombini, an open-source eBPF-based security monitoring agent for Linux. Written in Rust, it uses kernel-level hooks to provide visibility into system events and outputs telemetry in JSON. One for defenders running Linux infrastructure who want kernel-level telemetry without the vendor lock-in.
AWS published an article on their Deception Benchmark for evaluating AI models in cybersecurity contexts. The focus is on the trade-off between false positives and false negatives when integrating AI into security operations. Worth a look if you're assessing AI tools for your security stack and need a framework to measure trustworthiness.
Sergio Albea wrote up practical guidance on threat hunting with JA4 and JA4S TLS fingerprinting. Unlike legacy JA3 hashes, JA4 provides structured, readable fingerprints of client and server TLS behaviour that can identify malicious tooling and anomalous connections. The article includes KQL queries for extracting these fingerprints from network logs, which should save some time if you're already collecting that telemetry.
A Chinese-speaking threat actor using the alias 'Miku' operated a Singapore-based server to coordinate six simultaneous campaigns, according to research published by volrant136. Open directories exposed tooling, logs, and configurations revealing targeting of 2,500 LLM API gateways globally, Vietnamese and Pakistani government infrastructure, and a Mexican billing platform compromised via SQL injection. This follows similar infrastructure exposure incidents we've covered in recent weeks.
Socket's Threat Research Team uncovered a malicious Twitch browser extension that exfiltrated OAuth tokens from approximately 30,000 Chrome and 552 Firefox users. The extension, marketed as 'Twitch Enhanced Viewer | JeetBot', captured authorisation headers and forwarded them to proxy servers controlled by a Russian commercial bot service, granting full account access without passwords or two-factor authentication.
The Squid Cache project disclosed a request smuggling vulnerability affecting versions 3.3 through 7.5. The flaw, tracked as CVE-2026-61642, exploits malformed Transfer-Encoding headers to bypass security controls and poison caches by injecting content at arbitrary URLs. Squid deployments acting as reverse proxies are particularly exposed.
Researchers from KU Leuven, ETH Zurich, Durham University, and Google disclosed DDRop, a hardware-level attack using a low-cost memory interposer to silently drop memory writes and compromise confidential computing platforms. The attack bypasses memory encryption in Intel TDX, Intel SGX, and AMD SEV by exploiting the absence of hardware freshness counters, enabling memory replay attacks and plaintext dumps. Intel and AMD classify physical DRAM attacks as out-of-scope, with no complete mitigation available without architectural changes.
Fortra published an update on CVE-2026-62832, known as LegacyHive. It's a privilege escalation vulnerability in Windows Profile Service that uses registry hive confusion via race conditions. Researchers confirmed the flaw allows cross-user execution redirection by swapping registry hives, though it doesn't provide a complete one-click escalation in its current public form. We saw CISA flag a related vulnerability yesterday.
Gen Threat Labs disclosed CVE-2026-51990, a one-click remote code execution vulnerability in Sogou Input Method's Windows application. The vulnerability was actively exploited by threat group UNC3569 to deploy the GRAYRABBIT backdoor, leveraging protocol injection and an outdated Chromium component with disabled sandboxing to achieve silent system-level compromise. This is another in the series of vulnerabilities flagged by CISA yesterday.
OFFZONE Moscow is an international cybersecurity conference, and their YouTube channel hosts recordings of talks and workshops spanning offensive and defensive research. This is a video repository rather than a specific disclosure, but worth bookmarking if you're looking for technical content from Russian-speaking researchers. The videos feature autogenerated dubbing.
A researcher published Silverseal, a proof-of-concept framework demonstrating bootkit-based persistence on Linux systems. The framework replaces the GRUB bootloader with a Rust-based bootkit that loads a kernel rootkit, establishing control before the OS fully initialises. This highlights advanced post-exploitation techniques targeting Linux via boot-level compromise.
Internet Initiative Japan discovered PIVOTPIPE, a new .NET-based malware that reimplements Cobalt Strike Beacon functionality with custom loaders, obfuscation, and evasion techniques. The malware employs AMSI bypass, indirect syscalls, and sleep masking to evade detection, and supports extensive command and control for remote access and lateral movement. Development artifacts suggest it's under active development and already being used in live attacks.
And finally, Whispergate released a Mythic C2 framework profile that uses Microsoft Graph API to route command and control traffic through Microsoft Teams channels. The tool masks malicious traffic as legitimate Teams activity, using OAuth2 authentication and encrypted payloads posted to Teams channels. If your organisation uses external Teams federation, flag this one.
That's all for today. The articles are the work of their original authors — the analysis here was automated. We'll be back tomorrow with the next roundup.