Confidential · 06 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-06 (Sunday)¶
Window: last 24–48h (Sep 5–6). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 84Top actor QilinM&A L30D $94.5M
Number of the day12years PostgreSQL's logical-decoding feature carried CVE-2026-6471 (PostGREShell) before it was patched August 13; replication-role database access was all an attacker needed to achieve OS-level RCE as root and plant a persistent superuser backdoor, affecting every PostgreSQL release from 9.4 through 18. SecurityWeek
💼 M&A ACTIVITY¶
No new cybersecurity M&A deals confirmed in the Sep 5–6 weekend windowMediumCybersecuritymarket quiet; no announcements tracked via SecurityWeek, Return on Security, or Help Net Security. SecurityWeek's August roundup is expected the week of Sep 7 and may surface late-August deals. mWISE (Sep 15–17, Atlanta) is the next likely deal-announcement cluster.
L30D summary (Aug 7 – Sep 6): 12 deals tracked in August 2026; disclosed-value highlights: Visa → BioCatch $2.4B (behavioural biometrics/fraud detection); Zenity $125M Series C (AI agent governance); Obsidian Security $100M+ Series D (SSPM/identity); CyberCatch $94.5M all-cash (compliance AI); Oligo Security $60M Series C (runtime/AI application security). No new September deals yet; post-Labor Day quiet continues. SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
McKesson / ShinyHunters — Sep 9 data-publication deadline 3 days out; $55M demand unanswered; no public settlement signalCriticalHealthcare & Life SciencesAs of Sep 6, McKesson has not confirmed payment or resolution. ShinyHunters has not published the claimed 284M-record Snowflake exfiltration (attack window Aug 21–25, vishing → Okta SSO → multi-SaaS pivot). The initial Sep 1 negotiation deadline passed without public McKesson engagement; the Sep 9 publication deadline is the operative threshold. 🟥 The 284M-record count is ShinyHunters' own characterisation; unique-individual figure TBD. SecurityWeek · Malwarebytes
SilentRansomGroup — three US AmLaw law firms claimed in three days; attorney-client privilege data at riskHighProfessional & Business ServicesSilentRansomGroup posted Holland & Knight (Sep 1), Greenberg Traurig (Sep 2), and Katten Muchin Rosenman (Sep 3) on its DLS in rapid succession. All three are major US-headquartered Am Law 100 or Am Law 200 firms with significant M&A, IP, regulatory, and litigation practices. The group has threatened data publication unless contact is made. 🟥 All three DLS claims; data scope and authenticity unverified. Contact with sensitive corporate, litigation, and government-facing client data is the primary risk. DeXpose / Greenberg Traurig · RedPacket / Katten Muchin · HookPhish / Holland & Knight
Boston Scientific — Day 13 recovery; no new adverse network activity since Aug 25; mid-September full-restoration estimate unchangedHighHealthcare & Life SciencesIndustrials & ManufacturingNo material change from Sep 5. Shipping capabilities restored for the majority of product lines at major distribution centres globally; Cork manufacturing remains at reduced capacity. The Piper Sandler mid-September restoration estimate stands. 🟥 Threat actor and attack method not disclosed; no confirmed data exfiltration. Hospital procurement planners for elective cardiac procedures should continue contingency sourcing. Boston Scientific · SecurityWeek
Rhysida / Berlin Senate — Sep 20 state election 14 days out; 30 BTC (~EUR 2M) auction active; election data confirmed not in exfiltrated setHighGovernment & Public SectorNo change in auction status. Berlin interior administration has confirmed election-infrastructure data is not in the claimed 5.79TB dataset. The auction continues to function as pre-election information-environment disruption regardless of data authenticity. 🟥 Data scope and sample authenticity unverified. Cybernews · BankInfoSecurity
Panzer ransomware — 16 victims across 11 countries since August 5; emerging RaaS on trajectory toward Tier-1MediumGovernment & Public SectorPanzer, a double-extortion RaaS that activated its leak site August 5, has claimed 16 victims across Thailand (3), Italy (2), Indonesia (2), Serbia (2), and seven others in 31 days. Sectors: technology (4), manufacturing (3), government (2), agriculture, energy, education, retail. Sep 3 victim: Dinas Komunikasi dan Informatika (Indonesian government entity). Panzer offers an 80/20 affiliate split and supports Windows, Linux, VMware ESXi, and FreeBSD ransomware builds. CISA has not yet issued an advisory; the group warrants monitoring at Tier-2. 🟥 All DLS claims; unverified. gbhackers · DeXpose / Dinas · SOCRadar / DL E&C
🔓 CRITICAL VULNERABILITIES¶
Citrix NetScaler CVE-2026-19490 (CVSS 9.3) — unauthenticated auth bypass now actively exploited; BOD 26-04 federal deadline Sep 9CriticalTechnology & SoftwareAttackers began targeting CVE-2026-19490 in the wild as of September 4 following public PoC release. The flaw affects NetScaler ADC and Gateway configured as AAA virtual servers or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) — an unauthenticated remote attacker can bypass authentication entirely, depending on firmware version and SAML configuration. Previdian observed 10 exploitation attempts from six IPs across Australia, Germany, Japan, and the US. CISA added CVE-2026-8452 (a separate NetScaler flaw, Aug 26) with BOD 26-04 deadline Sep 9; organizations should treat CVE-2026-19490 as equally urgent. Patch immediately — no workaround available. BleepingComputer · Rapid7 · Help Net Security
CrowdStrike FalconFlank — zero-day PoC published Sep 3; SYSTEM-level privilege escalation via Falcon's Office macro remediation; no CVE, no patchHighTechnology & SoftwareResearcher Chaotic Eclipse published a working PoC exploiting CrowdStrike Falcon Sensor's Office malicious-macro remediation workflow to spawn a SYSTEM-level command prompt on Windows 11 25H2 and Windows Server 2025. Kevin Beaumont independently confirmed the escalation is real. CrowdStrike has not confirmed the vulnerability, assigned a CVE, or shipped a fix; it advises disabling the "Microsoft Office File Suspicious Macro Removal" setting as an interim mitigation. The attack requires a local foothold but no Falcon-specific credentials. BleepingComputer · The Hacker News · SOCRadar
PostGREShell CVE-2026-6471 (CVSS 7.2) — 12-year PostgreSQL replication-to-RCE path; patched August 13; many deployments still unpatchedMediumTechnology & SoftwareThe flaw, present since logical decoding was introduced in PostgreSQL 9.4 (2014), lets any account carrying the REPLICATION attribute load arbitrary OS libraries via a logical decoding plugin, achieving code execution as the OS account running the server and planting a persistent superuser backdoor. Affected: all versions 9.4 through 18. Patched: 18.6, 17.11, 16.15, 15.19, 14.24. Interim mitigation: strip REPLICATION from accounts that do not need it; restrict pg_hba.conf; block outbound SMB/NFS from database servers. SecurityWeek · The Hacker News
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
CISA + G7 Cyber Security Working Group — "Preparing for the Post-Quantum Era: A Call to Action" published Sep 5; five-priority framework for PQC transitionHighGovernment & Public SectorThe joint advisory outlines five priorities: raise awareness of quantum risk; develop national PQC strategies; advance R&D for quantum-safe technologies; foster public-private partnerships; and ensure OT/IoT are not left out of scope as PQC adoption scales. The advisory is procedural rather than incident-driven but signals the G7 is treating PQC transition as a coordinated geopolitical-security priority, not an academic exercise. NIST's final PQC standards (FIPS 203/204/205, Aug 2024) are the baseline for the transition; the advisory urges governments to accelerate implementation timelines against a 2030 "harvest now, decrypt later" threat window. CISA PQC · CISA Blog
CISA emergency directive — IoT device patching and inventory; Sep 5MediumGovernment & Public SectorCISA issued an emergency directive for organisations using vulnerable IoT devices, emphasising immediate patching, asset inventory, and risk isolation for unpatched devices. Specific device classes not named in available summaries; directive appears to target the long tail of embedded devices that rarely receive emergency patch attention. Security Boulevard OT Digest
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Qilin — rank 1 confirmed; YTD 546; pace unchanged; Sep 9 McKesson watch for ShintyHunters remains the headline deadlineCriticalGovernment & Public SectorNo new high-profile Qilin victims confirmed in the Sep 5–6 window. ATF major-incident claim (Aug 26) remains under DOJ investigation. YTD: 546; L3M: 335. 🟥 ATF claim unverified. Ransomware.live
SilentRansomGroup — confirmed as active US law firm extortion actor; three Am Law claims Sep 1–3HighProfessional & Business ServicesSilentRansomGroup appears to operate a targeted law-firm vertical, systematically posting large US firms with complex client data. The three-claim cluster in 72 hours is consistent with a coordinated campaign against a specific sector, not opportunistic individual attacks. The group's MO (DLS listing + contact-or-publish ultimatum) mirrors established RaaS playbooks. No CISA advisory yet.
Panzer ransomware — 16-victim, 11-country surge in 31 days; cross-platform builds; Tox-based affiliate recruitmentHighGovernment & Public SectorPanzer is now the fastest-emerging new RaaS since Gunra. Cross-platform builds (Windows, Linux, ESXi, FreeBSD) and a competitive 80/20 affiliate split position it for rapid scale. The Sep 3 Indonesian government victim indicates no sector or geography restriction. Monitor DLS for frequency acceleration — the threshold from Tier-2 to Tier-1 watch is 40+ victims/quarter at this pace. gbhackers · Security Arsenal
AI-assisted agentic ransomware — Unit 42 case study confirms <10-hour enterprise compromise using frontier LLMs; 50+ MITRE ATT&CK techniquesMediumTechnology & SoftwarePublished Sep 2–3, Unit 42's investigation into the first documented end-to-end agentic ransomware attack (AI agents executing every step, from API recon through CI/CD hijack, cloud-key exfiltration, and encryption) is now the reference case for this threat class. The attack compressed what normally takes two weeks of human red-team effort into under 10 hours. Notable: AI agents repurposed the victim's own cloud AI services mid-attack. Unit 42 · The Register
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
The CrowdStrike FalconFlank zero-day converts the enterprise's primary endpoint-defence layer into an escalation path — a structural inversion that state actors and post-compromise operators will systematically attempt to exploit before a patch ships.CriticalTechnology & SoftwareFalconFlank's PoC enables SYSTEM-level privilege escalation on fully patched Windows 11 and Windows Server 2025 by abusing CrowdStrike Falcon's own Office macro remediation workflow. No CVE, no CVSS, no patch as of Sep 6. For a state-level actor — or a ransomware operator who has already achieved a local foothold — the existence of a working PoC in the public domain means the window to exploit it before CrowdStrike patches is live now, not theoretical. Every hour CrowdStrike does not ship a fix is an hour during which the PoC is publicly available, tested, and replicable. The interim mitigation (disabling macro remediation) is available and should be applied today. BleepingComputer · The Hacker News
The G7 post-quantum call to action frames PQC adoption as a coordinated geopolitical-security obligation, not a vendor roadmap — the operative threat is the 2030 "harvest now, decrypt later" window, and every week without PQC is a week of retrospective cryptographic exposure to China.HighGovernment & Public SectorThe advisory is joint Five Eyes plus G7 — a signal that the post-quantum transition is now treated with the same alliance-coordination intensity as critical-infrastructure protection. The operative intelligence risk: state actors (foremost China, which has the world's most advanced quantum computing programme alongside its largest signals-intelligence collection footprint) are already archiving encrypted communications from government, financial, and defence networks for decryption once sufficiently capable quantum hardware exists. An enterprise or government entity that does not begin migrating key exchange and signing algorithms now is incurring a retrospective exposure liability that cannot be patched after 2030. CISA · White House EO on PQC
SilentRansomGroup's coordinated targeting of three Am Law firms in 72 hours is the clearest indication yet that a ransomware operator has explicitly prioritised attorney-client privileged data as a separate, higher-value extortion commodity.HighProfessional & Business ServicesGreenberg Traurig, Holland & Knight, and Katten Muchin Rosenman collectively hold privileged communications, litigation strategy, M&A deal documents, and regulatory filings for hundreds of Fortune 500 and government clients. A group that publishes this data does not merely breach a law firm — it potentially pierces attorney-client privilege for every client whose matter is in the exfiltrated files. The reputational and legal-liability exposure for affected firms is structurally different from a healthcare or retail breach. Law firm clients with active litigation, ongoing M&A transactions, or pending regulatory proceedings should be assessing whether their counsel's matter files are in scope. DeXpose · HookPhish
McKesson's Sep 9 silence is itself an intelligence signal: either a private resolution is in progress at or above $55M, or a healthcare-data publication of 284M records in the next 72 hours will trigger the largest US healthcare breach notification event of 2026.HighHealthcare & Life SciencesEither outcome reshapes the structural economics of US healthcare extortion. A disclosed payment sets a $55M price floor for the next attacker targeting a major US healthcare distributor — and every distributor knows who the other McKesson-scale players are. A publication triggers state AG enforcement actions, class actions in multiple jurisdictions, OCR breach investigation, and Senate Commerce Committee scrutiny. The vishing+Okta+Snowflake attack chain is now documented and repeatable; ShinyHunters demonstrated it at scale in 2024 against Snowflake customers, and the McKesson operation shows the methodology survives platform security improvements. SecurityWeek · ExZec Cyber
M&A activity
Socure → Fravity—
Brinqa → PlexTrac—
Munich Re (via HSB) → $575M—
Fortinet → Virtue AI—