19 SEP 2026 · 15:00 MDT · ACTIVE EXPLOITATION: Pixel CVE-2026-58704 and two Linux kernel flaws are in KEV; Fortinet reports exploitation of Orkes Conductor CVE-2026-58138. Latest brief → · PM archive →
19 SEP 2026 · 06:00 MDT · AI EVALUATION BOUNDARY: Google confirmed a Gemini security test unintentionally reached three real organizations; entities were notified and procedures revised. Latest brief → · AM archive →
18 SEP 2026 · 15:00 MDT · AVIATION RESILIENCE: NATS attributes major UK disruption to a software defect—not a cyberattack—and is testing a permanent fix. Latest brief → · PM archive →
18 SEP 2026 · 06:00 MDT · AUTHORIZED AI-ASSISTED SECURITY RESEARCH: OpenAI reportedly remediated a third-party identity and repository-access chain disclosed through its bug-bounty program. Latest brief → · AM archive →
17 SEP 2026 · 15:00 MDT · PUBLIC-SECTOR AI GOVERNANCE: Federal Register removed Qwen-powered search; data-routing details remain undisclosed and no compromise is confirmed. Latest brief → · PM archive →
17 SEP 2026 · 06:00 MDT · ACTIVE EXPLOITATION: Cisco ISE CVE-2026-76460 and Acronis cPanel/Plesk plugin CVE-2026-87886 require immediate update and compromise review. Latest brief → · AM archive →
16 SEP 2026 · 15:00 MDT · AI AGENT + INFRASTRUCTURE: New reporting extends the Hugging Face activity timeline; Anthropic’s proposed 2.16-GW Australian campus remains planned, approval-pending capacity. Latest brief → · PM archive →
16 SEP 2026 · 06:00 MDT · AI-AGENT INCIDENT: Spain’s data-protection authority disclosed an ongoing investigation into a reported agent-linked breach. Technical causation and complete scope remain unresolved. Latest brief → · AM archive → · AI/HPC →
15 SEP 2026 · 06:00 MDT · SEV 1 STATUS CHANGE: CISA now records Cisco Secure Email Gateway CVE-2026-76461 as used in ransomware campaigns. Apple’s September 14 security releases are also tracked without blanket exploitation claims. Latest brief → · AM archive → · AI/HPC →
14 SEP 2026 · 15:00 MDT · SEV 1: CISA added actively exploited Cisco Secure Email Gateway CVE-2026-76461; Cisco provides fixed software and no workaround. Actor and ransomware attribution remain unknown. Latest brief → · PM archive → · AI/HPC →
12 SEP 2026 · 06:00 MDT · CISA KEV UPDATE: Active exploitation affects JFrog Artifactory CVE-2026-42016/CVE-2026-42018 and ConnectWise ScreenConnect CVE-2026-84869. Local brief → · GavinLujan.com master archive →
10 SEP 2026 · 15:00 MDT · GAVINLUJAN.COM PRIMARY: Active edge response continues; wider AI-agent boundary failures and reported subsea-cable preparation elevate governance and resilience. Latest brief → · AM archive → · AI/HPC →
07 SEP 2026 · 15:02 MDT · AFTERNOON UPDATE: Active MikroTik RouterOS exploitation requires exposure removal, patching and compromise review. Semiconductor-IP allegations and proposed Patagonia capacity are tracked with explicit evidence limits. Latest brief →
07 SEP 2026 · 05:57 MDT · MORNING UPDATE: Liquid Network halted transactions after a roughly $320M federation-wallet withdrawal. Berlin grid events remain under physical investigation, while EU receipt of OpenAI’s incident report is confirmed. Latest brief →
06 SEP 2026 · 15:00 MDT · AFTERNOON REVIEW: No material new cyber event or verified AI/HPC status change was identified. Active edge remediation and the morning converged-resilience priorities remain in force. Latest brief →
06 SEP 2026 · 06:00 MDT · MORNING UPDATE: Germany’s reported anti-sabotage response joins cyber and physical infrastructure resilience. OpenAI’s reported acknowledgment of the wiki incident strengthens the case for agent telemetry, scoped authority and transparent incident disclosure. Latest brief → · AI/HPC dashboard →
05 SEP 2026 · 15:02 MDT · AFTERNOON UPDATE: Berlin activated a crisis response after stolen government data was published. A separate reported 1 GW Telangana AI-campus plan is tracked as announced capacity—not operational or benchmarked. Latest brief → · AI/HPC dashboard →
05 SEP 2026 · 06:00 MDT · MORNING UPDATE: Confirmed C‑Track file exposure across multiple court jurisdictions added as shared-platform risk. Switchvox and SonicWall remain critical edge-response priorities. Full evidence and proposed guidance →
05 SEP 2026 · 06:00 MDT · PM UPDATE: Reported AI-agent boundary failures and documented data-center water/power scrutiny added with evidence-state labels. Switchvox remains the critical operational priority. Full evidence and proposed guidance →
05 SEP 2026 · 06:00 MDT · MORNING UPDATE: Sangoma Switchvox CVE-2026-9586 is actively exploited and in CISA KEV. Cisco critical network-fabric patches and Plex updates are separately tracked without claiming exploitation. Full evidence and proposed guidance →
05 SEP 2026 · 06:00 MDT · PM UPDATE: Multinational action disrupted Sality command infrastructure; residual infected endpoints still require hunting, isolation, reimaging and credential response. Full evidence and proposed guidance →
05 SEP 2026 · 06:00 MDT · AFTERNOON DELTA: Guildma/Astaroth localized delivery analysis and September Windows Server baseline-reboot planning added. Read authoritative brief →
05 SEP 2026 · 06:00 MDT · SEV 1: Active Proxmox VE 7 exploitation and the Virtualizor update-channel incident elevate virtualization/HPC control-plane response. Read authoritative brief →
ZIAWOLF // SEC INTEL
Current threat signal
A decision-ready view of the latest authoritative ZiaWolf Threat Intelligence Brief. Full provenance, archive and source register are maintained at GavinLujan.com.
PAPERCUT ACTIVE EXPLOITATION
A patch is not an all-clear.
SEV 1 CRITICAL · REDCONFIDENCE · HIGHSTATUS · NEW CISA KEV LISTING / ACTIVE EXPLOITATIONNEXT UPDATE · 03 SEPTEMBER 2026 · 15:00 MDT
PaperCut Release 3 remains the priority. CISA refreshed catalog metadata without adding entries. Microsoft’s TerminalFix analysis documents fake CAPTCHA instructions leading to user execution, persistence and a reverse tunnel; the full brief contains safe detection and containment guidance.
ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505 Server Software Component.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Restrict PaperCut management access and install Release 3; hunt before closure. Isolate HPC control planes, harden identities and scheduler APIs, sign software artifacts, monitor storage/fabric egress, and validate power, cooling, provider and model continuity.