Cybersecurity briefing — September 6, 2026.

Anthropic has begun locking users out of Claude accounts after it found that compromised login sessions were abused by infostealer malware. The incident highlights how attackers increasingly target “session” artifacts and browser states rather than only stealing credentials. For defenders, it’s a reminder to enforce stronger session protections, monitor suspicious authentication flows, and shorten session lifetimes where feasible.

Source: Help Net Security

Attackers are actively exploiting two recently disclosed PaperCut vulnerabilities to steal credentials and escalate access in education-sector intrusions. Reported chaining enables authentication bypass and a remote code execution path, supporting reconnaissance and command execution. Organizations using PaperCut should prioritize patching, review for indicators of exploitation, and tighten access around print systems that are often overlooked in asset inventories.

Source: The Hacker News

HPE has released fixes for critical remote code execution vulnerabilities in AOS-CX that can be triggered by sending crafted packets to the affected service. The key risk is that exploitation can be performed without authentication and may yield elevated privileges. Network teams should validate patch rollouts quickly, confirm exposure of the management/edge components, and review traffic logs for unusual probing patterns.

Source: SecurityWeek

A critical Elementor Pro WordPress vulnerability (tracked as CVE-2026-32475) has been linked to real-world exploitation involving arbitrary file upload via a form-submission handler. With a CVSS score of 9.8, the bug’s exploitability makes it a high-priority target for web defenders. Site owners should patch immediately, then scan for web shells and other artifacts consistent with uploaded payloads.

Source: SecurityWeek

JetBrains says attackers exploited a recently disclosed critical vulnerability in TeamCity to breach its environment, and it is now urging Cadence users to revoke or rotate credentials and secrets used for Cadence executions. This is a concrete reminder that supply-chain-adjacent CI/CD components remain high-value targets. Teams should inventory which credentials are used by build/workflow systems and apply “least privilege” and compartmentalization to reduce blast radius.

Source: The Hacker News

CERT Polska reports attackers are hijacking MikroTik routers through Internet-exposed SSH, gaining full administrative control without authentication. The activity reportedly began at least September 2, underscoring how quickly internet-facing device issues can become operationalized. Administrators should restrict SSH exposure to trusted networks, disable unnecessary services, and audit for unauthorized configuration changes or new accounts.

Source: The Hacker News

OpenAI announced Daybreak for Frontline Defenders, committing $1 billion in subsidized access to cybersecurity tools, training, and technical support for under-resourced defenders protecting essential services. While the initiative is positive, it also signals continued commercialization and scale-up of AI-enabled security capabilities. For organizations, the practical takeaway is to watch for new model-assisted workflows and ensure controls, data handling, and evaluation are aligned with operational risk.

Source: Security Affairs