Week of September 14, 2026: Cisco Email Gateway Zero-Day and CenterPoint Energy Breach

Security leaders spent the week of September 14, 2026 working through an actively exploited Cisco Secure Email Gateway zero-day, a CenterPoint Energy breach disclosed to the SEC, and a joint UK-US-Dutch advisory on Iranian CHOSEN BRICK spyware targeting dissidents and journalists. CISA also finalized new federal token-security guidance with NIST, ran its tenth Cyber Storm exercise, and added several actively exploited flaws, including in Acronis and Parallels software, to its watch lists.

Cisco patches Secure Email Gateway zero-day under active exploitation

Cisco confirmed that attackers had exploited a zero-day SQL injection flaw, CVE-2026-76461, to compromise Secure Email Gateway appliances running AsyncOS Software versions 16.5, 16.0, and 15.5 and earlier, as well as the cloud-delivered Secure Email Cloud service. The vulnerability let an unauthenticated attacker send a crafted email containing SQL statements that led to root-level command execution. Cisco pointed administrators to fixed releases 15.5.5-014, 16.0.4-302, and 16.5.0-780, and advised checking mail_logs for malicious entries. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Monday, September 14, and ordered federal civilian agencies to remediate by September 17. (Help Net Security)

CenterPoint Energy confirms customer data breach, files SEC 8-K

CenterPoint Energy confirmed that an unauthorized third party accessed customer data through an external system after a hacker claimed online to have stolen 7.49 million lines of customer records, including names, phone numbers, addresses, account numbers, driver's license numbers, and partial Social Security numbers. The Houston-based utility, which serves about 7 million customers across Indiana, Minnesota, Ohio, and Texas, filed an SEC Form 8-K on September 14 stating it was working with outside experts to determine the scope and intended to notify affected customers and regulators as required by law. Service delivery remained unaffected. (Help Net Security)

ParaShells flaw in Parallels Desktop allows root escalation on Macs

Security researchers at JFrog disclosed CVE-2026-90894, dubbed ParaShells, a Parallels Desktop for Mac flaw that let any local user obtain root privileges on the host system. The argument-injection bug combined a world-writable Unix socket, weak peer-credential authentication, and a tar command built through Qt string splitting, letting an attacker's script run as root during appliance extraction. The issue affected Parallels Desktop for Mac version 26.4.0 on Apple silicon. Parallels maker Alludo fixed it in version 27.0.0, released at the start of September 2026, and JFrog published technical details two weeks later without releasing its proof-of-concept script. (Help Net Security)

Iranian CHOSEN BRICK malware targets dissidents and journalists

The UK's National Cyber Security Centre, the FBI, and the Netherlands' AIVD issued a joint advisory warning that Iranian state cyber actors have used malware called CHOSEN BRICK to target dissidents, activists, and journalists in the UK, US, and Netherlands since at least 2025. Attackers build rapport with victims over WhatsApp or Telegram before sending disguised files, such as fake Norton Antivirus, Telegram, or Adobe Flash Player installers, to infect Windows devices. The malware can log processes, capture screenshots, enable the microphone, pull messaging app data, steal emails, delete files, and download further payloads, communicating with operators through dedicated Telegram bots per victim. (Help Net Security)

CISA runs Cyber Storm X with 2,000 participants on critical infrastructure

CISA hosted Cyber Storm X, a four-day national cybersecurity exercise marking the tenth exercise in the 20-year history of the Cyber Storm program, bringing together 2,000 participants from government and industry across more than two hundred organizations. This year's scenario involved a nation-state adversary targeting the transportation systems sector, including rail and ports, along with the water and wastewater systems sector, letting participants test response plans, practice coordination, and strengthen information sharing. CISA said it would work with participating organizations to capture lessons learned in a public after-action report following the exercise. (CISA)

Acronis Backup plugin flaw exploited against cPanel and WHM servers

Acronis warned that a Linux privilege escalation vulnerability, CVE-2026-87886, affecting its backup extensions for cPanel, WebHost Manager, and Plesk was being exploited in limited, targeted attacks against cPanel and WHM deployments, with no signs yet of active exploitation on Plesk. The flaw stems from insecure file permissions and lets an authenticated attacker achieve local privilege escalation without user interaction, in low-complexity attacks. Acronis pushed updates the prior week and urged administrators to immediately install Acronis Backup plugin for cPanel and WHM version 1.9.3 HF3 or the Plesk extension version 1.8.11. (Help Net Security)

CISA adds actively exploited Google Pixel flaw to KEV catalog

CISA added CVE-2026-58704, a Google Pixel Improper Authorization Vulnerability, to its Known Exploited Vulnerabilities catalog on September 16 based on evidence of active exploitation. The addition fell under Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize remediation of high-risk, actively exploited vulnerabilities on internet-facing assets that could grant full control after exploitation. CISA reiterated that while the directive applies only to federal agencies, it encourages all organizations to adopt risk-based vulnerability management and remediate catalog entries quickly, and continues to accept nominations of exploited vulnerabilities through its KEV nomination form. (CISA)