Confidential · 23 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-23 (Wednesday)¶
Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 92Top actor QilinM&A L30D $500M
Number of the day4CISA added four actively exploited, unauthenticated, remote-code-execution vulnerabilities (all CVSS ≥9.8) to its KEV catalog in a single day, all sitting at or managing the network edge. CISA
💼 M&A ACTIVITY¶
IT Solutions Technology Partners acquired STACK Cybersecurity Sep 22 (Undisclosed).MediumPhiladelphia-based MSP IT Solutions buys Detroit-metro MSSP/AI-enablement firm STACK Cybersecurity, adding cybersecurity governance/compliance and AI-adoption capabilities and expanding its Michigan footprint — another services roll-up in a month dominated by them. This run's mandatory 72h M&A sweep ran all six query families (~36 searches); see the M&A sweep clause in the run record for the full per-family breakdown.
L30D summary (Aug 24 – Sep 23): 14 deals tracked, still only one company-adjacent priced figure — Palo Alto Networks → Console (Sep 1, ~$500M reported by TechCrunch, unconfirmed by the company). Biggest by strategic weight: Quorum Cyber → Ontinue and CyberMaxx → Avertium (both Sep 16, Microsoft-MDR consolidation), S&P Global → OpenZeppelin (Sep 17, onchain security) and NetSPI → Synack (Sep 2, offensive-security platform merger). Consolidation theme unchanged: services and MDR roll-ups dominate by count — Fortress SRM, Amivero, INE, RedTrace, Ontinue, Avertium, MSP Corp and now STACK Cybersecurity span MSSP, training and Microsoft-MDR consolidation, none disclosing a price. SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
ShinyHunters claims it compromised the FBI itself Sep 22 — 2–3TB of current/former-employee and applicant data via a claimed Oracle PeopleSoft zero-day — in stated retaliation for a May 2026 FBI bulletin that detailed the group's tactics; the FBI has not confirmed the claim.HighThe group gave reporters a sample file said to cover roughly 5,000 employees and says it wants the bulletin retracted, not payment. The FBI's only statement is that it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov" and is investigating. Treat as an unverified extortion-actor claim, not a confirmed incident, however unusual the target — added to the signals watchlist as a retaliation-not-ransom motive worth tracking. BleepingComputer · Nextgov/FCW
🔓 CRITICAL VULNERABILITIES¶
CISA added four unauthenticated, actively exploited, network-edge vulnerabilities to KEV on Sep 22 in a single batch, all CVSS ≥9.8, federal remediation due Sep 25: CVE-2026-94127 (F5 BIG-IP APM, CVSS 9.8, heap buffer overflow via OAuth-configured virtual servers), CVE-2026-85102 (Check Point Quantum VPN, CVSS 9.8, certificate-validation bypass enabling unauthenticated RCE), CVE-2026-93616 (Check Point Security Management Server, CVSS 9.8, pre-auth path traversal to arbitrary code execution, exploited since ~Jul 23) and CVE-2026-93952 (Arista VeloCloud Orchestrator, CVSS 10.0, improper input validation letting an unauthenticated attacker invoke privileged internal functions).CriticalAll four sit at or manage the network edge and are remotely reachable without credentials — an unusually concentrated single-day KEV batch worth treating as one incident for patching prioritization, not four unrelated ones. CISA KEV · Check Point advisory · The Hacker News (Arista)
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
No new CISA/FBI/NSA/NCSC advisory or law-enforcement takedown beyond the KEV catalog update above.MediumThe FBI's only public statement this window is that it is investigating the ShinyHunters claim covered under Breaches — not a policy action in its own right.
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
N0n keeps expanding: FinSoft/Kolibri, an Uzbek retail back-office software vendor (10+ client retail chains' data claimed), and AFRICA-TECH, a Malian IT-services/document-processing firm, both listed Sep 22 — its claimed victim count now past a dozen in under three weeks.HighThis run's mandatory case follow-up sweep checked all four open N0n cases (AstraZeneca Türkiye and Inter, both past-deadline; Fanatics, deadline today; STOKR, past-deadline) — no leak, sale, or company confirmation observed on any as of today. SOCRadar · RedPacket Security
SilentRansomGroup listed Clark Hill, a Detroit-headquartered Am Law-adjacent firm, Sep 22 — a fourth law-firm target from this group since Sep 1Medium(Holland & Knight, Greenberg Traurig, Katten Muchin Rosenman), reinforcing the legal-sector vertical-specialization pattern already on the signals watchlist. No company confirmation; SRG's model relies on social engineering rather than encryption. GalaxyWarden
Two smaller DLS listings Sep 22: secp0 claimed NAI Earle Furman, a southeastern-US commercial real-estate brokerage (1.36M-path file-server snapshot claimed), and Termite claimed Sealcon, a Colorado cable-management manufacturer.MediumIndustrials & ManufacturingNeither company-confirmed. DeXpose · RedPacket Security
Veradigm has begun notifying affected individuals and offering credit monitoring for its confirmed Sep 8 breach, per HIPAA Journal — a consequence, not a change in the underlying claim status; The Gentlemen still has not published or sold the 3.5M patient records it claims.MediumHealthcare & Life SciencesHIPAA Journal
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
Trump told the UN General Assembly Sep 22 the US "may have to blow up another one, Pickaxe Mountain" while also claiming Iran's nuclear-weapons pursuit has "already ended" — then, hours later, envoys Witkoff and Kushner held a three-hour, Qatar-mediated meeting with Iran's foreign minister focused on reopening the Strait of Hormuz.HighThe rhetoric-versus-diplomacy split is a negotiating posture, not a signal of imminent strikes: Iran's stated conditions are lifting the US naval blockade and releasing frozen assets, and Trump says another meeting is expected soon. This is the strongest signal yet of a possible near-term Hormuz reopening track, but "near future" talks mean weeks, not days — material for shipping-insurance and energy-logistics exposure, not yet a resolved risk. Axios · Israel Hayom
The Sep 24 Trump-Xi Washington summit agenda has hardened around trade/tariffs, rare earths, Taiwan arms and AI, with China's rare-earth export-control suspension expiring Nov 10 — the real leverage deadline behind the summit's cordial framing.HighBeijing suspended enforcement of six export-control measures (rare earths, lithium batteries, diamonds) until Nov 10, 2026; whether it extends, replaces, or lets the suspension lapse is undecided, and case-by-case licensing on advanced-chip/AI items already continues regardless. Portfolio exposure to rare-earth-dependent supply chains (defense, EV, semiconductors) should treat the seven weeks to Nov 10 as the real window to diversify or lock supply, not assume Sep 24 resolves it. Bloomberg · Pillsbury Law
A $14B US arms sale to Taiwan remains unapproved ahead of the summit, with Trump publicly calling it a potential "negotiating chip" — an explicit break from Washington's traditional posture of treating Taiwan security commitments as separate from trade negotiations.MediumChina is reportedly pressuring against announcing the deal before Sep 24. Defense-sector and Taiwan-adjacent semiconductor-supply-chain holdings should watch the summit outcome: a further delay would be read by markets as new US flexibility on Taiwan. AEI
Correction on framing: multiple named wire sources (AP, Politico) describe Wednesday's US-China AI-incident notification channel as a US proposal still awaiting Trump-Xi sign-off at the Sep 24 summit, not a finalized agreement as Tuesday's coverage suggested.MediumTreat it as pending confirmation rather than settled until the summit outcome is known. AP via ABC News
Travel advisories: checked against Five Eyes sources (US State Dept, UK FCDO, Australia Smartraveller, Canada travel.gc.ca) — Iran remains Do Not Travel / Level 4 equivalent across all four, Bahrain remains essential-travel-only on UK/Canada guidance, no level change to any of the 9 tracked countries this window. The only new artifact is a Sep 19 US Virtual Embassy Iran reaffirmation alert, a restatement rather than a level change.
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—