Weekly from SecurityWeek Cybersecurity News Summary provides a succinct overview of key developments that may not be covered entirely in isolation but are nonetheless relevant to the broader threat landscape.
This curated summary highlights key stories about vulnerability disclosures, new attack vectors, policy updates, industry reports and other notable events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
The Microsoft Threat Report estimates that phishing will triple as exploit windows shrink
Microsoft’s Digital Defense Report 2026 (covering July 2025 to June 2026) says AI has reduced the average time from vulnerability discovery to weaponization to well under 24 hours, with a record of around 72,000 CVEs expected this year. Phishing increased from 7% to 23% of initial access vectors in Microsoft incident response cases, Teams vishing increased by 502%, and ransomware blasts against enterprises increased by nearly 16%. Government agencies were the most affected, accounting for 27% of observed activity.
Kiteworks publishes over 100 safety advisories in a single day
Kiteworks released over 100 Safety instructions on September 30 and covers its core platform, Email Protection Gateway, Secure Data Forms and MFT Server. A dozen are classified as critical, mostly Email Protection Gateway errors that can lead to account takeover, code execution, or access to internal network resources. Dozens more are classified as “high severity.” The most common issues are information disclosure and arbitrary code execution, followed by privilege escalation.
Smuggled headers turned iCloud into an email spoofing tool
This was announced by SEC Consult researcher Timo Longin two iCloud vulnerabilities This allows attackers to send emails from any icloud.com address and the messages pass SPF, DKIM and DMARC checks. Both resulted from differences in the way two parts of Apple’s outbound email pipeline parsed messages, resulting in a forged From header escaping sender verification. The first issue was reported in May 2024, but Apple’s initial fix was incomplete and was not fully fixed until December 2025. Apple paid a bug bounty of $15,000.
Poper Blocker’s hidden interpreter siphons AI conversations
Bay Area Labs researchers found that Poper Blocker, a featured Chrome ad blocker extension with more than 2 million users, collects full browsing history and conversations from ChatGPT, Claude, Gemini and Google’s AI mode once users are pushed to accept data sharing. The capture logic is downloaded from the provider’s server and executed by a custom interpreter within the extension, allowing the operator to change what is captured and where it is sent without pushing an update.
GitHub Security Lab implements AI task flows on Android apps
GitHub Security Lab says Android-focused taskflows have been revealed for its open source AI security agent 24 vulnerabilities in Android applications. Examples include an OsmAnd bug that allows any installed app (even one without permissions) to silently change the navigation app’s settings to reveal the user’s location and routes, and two Wikipedia app bugs that chain an account takeover via a malicious deeplink. The researchers note that the AI often misjudged severity and reported unrealistic problems, leaving the results still requiring human review.
Two US airmen sentenced to prison for BEC attacks
It was Chijioke Timothy Odimegwu and Harafat Mogaji, two men from Delaware who were serving in the US Air Force at the time sentenced to 111 and 78 months in prison respectively. Working with co-conspirators for nearly two years, they captured employees’ email credentials and used spoofed emails to redirect business payments. They stole more than $1.68 million from an Iowa victim and more than $720,000 from an Ohio victim. They were also ordered to pay restitution totaling $1.36 million.
The vulnerability allows Cloudflare Containers users to peek at other customers’ data
Cloudflare has patched a flaw in containers (and the sandboxes built upon them) reported by Accomplish researcher Oren Yomtov that allowed a Workers Paid customer to recover leftover data from disk blocks that other customers’ containers had used on the same host. Because reallocated memory blocks were not zeroed out, researchers found residual material in 18 out of 24 locations, including directory structures, database pages, and full SQLite databases, although they were unable to target a specific victim. Cloudflare found no evidence of malicious exploitation.
Fake AI advisory committee invitations used by Chinese cyber spies
Proofpoint described in detail TA419a new China-allied espionage group that posed as former White House OSTP Deputy Director Lynne Edwards Parker and economist Heidi Crebo-Rediker in July 2026 to spy on AI policy experts at U.S. think tanks, universities and law firms. Targets who responded to the initial innocuous outreach were redirected to a fake OneDrive page that routes the Microsoft 365 login through an Adversary-in-the-Middle (AitM) proxy and collects session cookies even when MFA is used. The group also posed as Anthropic employees in February 2026.
Related: In other news: Ransomware developer convicted, Plugin4Shell AI attack, critical SAP flaw
Related: In other news: Clop leak site takeover, Docker botnet hunts AI keys, water utility compromise
