Week of September 7, 2026: Boston Scientific's Cyber Hit and CISA's China AI Warning

Security leaders tracked material disclosures from Boston Scientific and Nutex Health, a joint CISA-NSA-FBI advisory on industrial-scale AI knowledge distillation by Chinese firms, and active exploitation of flaws in Cisco Secure Firewall Management Center, MikroTik RouterOS, and N-able N-central. CISA also pushed out a record-setting Patch Tuesday response alongside an updated insider threat guide during the same seven-day span.

Boston Scientific says cyber incident will hurt Q3 and full-year results

Boston Scientific updated its Form 8-K on September 7, 2026, regarding the cybersecurity incident first identified on August 25, 2026, that disrupted manufacturing, order processing, and shipping worldwide. The company said sterilization facilities had resumed operation and most manufacturing had restarted, with distribution centers processing orders at or above normal levels. Despite that recovery, Boston Scientific said the incident was likely to materially affect third-quarter and full-year 2026 results, making it unlikely to meet previously issued net sales growth and adjusted EPS guidance. (SEC EDGAR / Boston Scientific Corporation)

Nutex Health confirms attacker published stolen hospital data

Nutex Health Inc., which operates 28 hospital facilities in 12 states, disclosed on September 10, 2026 that the unauthorized party behind its previously reported cybersecurity event had published the allegedly stolen data on its own website. The company said it was still downloading and analyzing the material to determine its scope and authenticity, a process expected to take several weeks, and that its prior materiality assessment had not changed. Several purported class action complaints tied to the incident were already pending in federal court in Texas. (SEC EDGAR / Nutex Health Inc.)

CISA, NSA, FBI warn of China-based AI distillation campaigns

CISA, the NSA, and the FBI released a joint advisory on September 8, 2026 warning that China-based AI companies were running industrial-scale knowledge distillation campaigns to extract capabilities from U.S. frontier AI models. The agencies named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as having extracted billions of tokens across millions of requests from models including Claude, GPT, Gemini, and Grok since at least late 2024. The advisory urged AI companies to detect anomalous usage patterns, alter responses to suspected distillation attempts, and share intelligence across providers. (CISA)

Cisco Secure Firewall Management Center flaws exploited by state and ransomware actors

Cisco Talos confirmed on September 10, 2026 that state-sponsored and financially motivated actors were actively exploiting two Cisco Secure Firewall Management Center flaws, CVE-2026-20079 and CVE-2026-20316, both disclosed earlier in 2026. Talos detailed three intrusion clusters, including activity it attributed to the Russian state-sponsored group Sandworm and an actor believed linked to Qilin ransomware, deploying web shells, reverse shells, credential-harvesting implants, and ransomware against unpatched FMC devices. Cisco urged customers to apply existing hotfixes immediately, ahead of a broader hardening release planned for the week of September 16. (Help Net Security)

MikroTik RouterOS chain exploited to hijack routers without authentication

Researchers at CERT Polska disclosed six RouterOS vulnerabilities to MikroTik and reported on September 7, 2026 that attackers were actively exploiting two of them, dubbed MikroTrick, to take full control of internet-exposed devices without authentication. The Shadowserver Foundation counted at least 122,500 MikroTik devices with SSH reachable from the internet in a single 24-hour scan window. MikroTik shipped fixes in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, and CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, 2026. (Help Net Security)

N-able patches N-central zero-day after customer warning of in-the-wild exploitation

N-able shipped an emergency hotfix on September 5, 2026 for CVE-2026-86218, a pre-authenticated remote code execution flaw in its N-central remote monitoring and management platform used widely by managed service providers. N-able's public advisory described the bug as responsibly disclosed with no confirmed exploitation, but a separate customer notice called it a zero-day already observed being exploited in the wild, spanning hosted and on-premises deployments across the Americas, APAC, and Europe. CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on September 8, 2026. (Help Net Security)

September Patch Tuesday brings record fix count and two Windows zero-days

Microsoft's September 2026 Patch Tuesday delivered a record number of fixes, including two actively exploited zero-days. CVE-2026-81963, a privilege escalation flaw in the Windows Update Stack affecting Windows 11 and Windows Server 2025, was confirmed as the first exploited zero-day in that component. CVE-2026-85880, a privilege-escalation bug in the Windows Advanced Local Procedure Call affecting Windows 10 and older Server versions, was also under attack. Researchers flagged a DNS flaw, CVE-2026-69730, as a wormable successor to SigRed, alongside roughly 20 other wormable-class bugs needing priority attention. (Help Net Security)

CISA refreshes Insider Threat Mitigation Guide for hybrid work and AI risks

CISA released an updated Insider Threat Mitigation Guide on September 9, 2026, first published in 2020, adding content on hybrid and remote work, AI used to manipulate or deceive employees, access control, visitor screening, and managing adverse employee separations. The agency said the guide gives organizations a current look at insider threats and practical steps to develop or enhance an insider threat program, and encouraged security and HR professionals at organizations of any maturity level to use it to assess and strengthen their existing programs. (CISA)