WEEK OF SEPTEMBER 7, 2026

CISA added seven CVEs on Sep 2 (two SonicWall SMA1000 zero-days reportedly forming an attack chain — SonicWall's third appearance in five weeks; JFrog Artifactory improper authentication exploited to forge admin tokens; Sangoma Switchvox delivering reverse shells; Kestra, Starlette, and LiteLLM — developer and AI infrastructure again) after cataloging both PaperCut zero-days on Aug 31. Elementor Pro exploitation and Langflow/Rails credential-probing continue. All nine are current-year flaws under active attack. Confidence is high.

A large phishing campaign impersonating remote-management tools now spans 46 countries with the US the top target; the Shai-Hulud npm credential worm's haul grew to 469 credential locations; China-linked Fire Ant hijacks Cisco routers to steal credentials and blind logging. Significant activity, but all evidence sits in one source class this week, so the two-source rule holds the signal steady. Confidence is medium.

Nutex Health, Park Dental Partners, and NovoCure all filed Item 1.05 8-Ks this window — three material cybersecurity incidents against a baseline of roughly one per week — providing the public-disclosure source class that, with incident reporting, satisfies the two-source rule for a raise. Thomson Reuters' C-Track court platform breach was publicly disclosed Sep 2 (intrusion ran March–June), potentially exposing SSNs and sealed documents across twelve jurisdictions; Aurora ransomware operators used AI-assisted tooling against ten targets. Confidence is medium: disclosure lag limits week-level precision.