Weekly Threat Report – September 18, 2026

Weekly Threat Report: Cyber Threats Aren’t Slowing Down

This week’s threat landscape marks a measurable shift in the scale and speed of AI-assisted attacks — with documented evidence that one attacker using commercial AI models can now execute what previously required a specialist team, reaching hundreds of organizations simultaneously. At the same time, the infrastructure organizations rely on most — firewall management platforms, identity verification providers, and core Windows systems — is being actively targeted across multiple simultaneous campaigns.

Here’s what you need to know:

See What You’ve Missed

Single Attacker Uses Hundreds of AI Agents to Breach 395 Organizations

Threat intelligence firm GreyNoise confirmed that a single attacker armed with commercial AI models, OpenAI’s Codex and a DeepSeek model, built, tested, and deployed a swarm of autonomous agents that compromised 440 servers belonging to 395 distinct organizations across 48 countries, in a campaign that peaked at eleven breaches in twenty-six seconds.

Cisco Secure Flaw Exploited by Sandworm, Qilin Ransomware, and Credential-Theft Cluster

Cisco Talos confirmed that CVE-2026-20079, a maximum-severity authentication bypass in Cisco Secure Firewall Management Center, is being actively exploited by three distinct threat actor clusters, including Russia’s Sandworm APT deploying Cyclops Blink, and a Qilin ransomware affiliate conducting extensive Active Directory reconnaissance before encrypting endpoints.

Schedule a meeting with our Solutions Advisors to see where your cyber resilience sits! — Secure Your Organization Today

IDScan Confirms 153 Million Driver’s License Scans Stolen

Identity verification company IDScan confirmed that hackers accessed customer data stored in its cloud platform, in an incident tied to a massive database containing more than 153 million driver’s license scans advertised for sale on the dark web.

Microsoft September Patch Tuesday: 974 Vulnerabilities

Microsoft’s September 2026 Patch Tuesday addressed 974 vulnerabilities including two actively exploited zero-days, both added to CISA’s KEV catalog on September 8 with a September 22 federal remediation deadline.

Product Recommendation

Cyber Risk Report for Enterprise Security

Cyber threats are constantly evolving, putting businesses at risk of data breaches, fraud, and compliance violations. Our Cyber Risk Report provides a thorough evaluation of your digital infrastructure, helping you identify vulnerabilities, assess potential risks, and implement robust security measures.

LEARN MORE

Service Highlight

The threats in this week’s report share a defining characteristic: they move faster than any patching cycle, quarterly assessment, or manual review process can track.

RSI Security’s Continuous Digital Safeguard Services provide the continuous monitoring, threat detection, and proactive risk management needed to identify exposure across infrastructure, identity systems, and third-party relationships — before an AI-speed campaign, a nation-state actor, or a compromised vendor turns a gap into an incident.

Learn More About Our CDSS Service

What to Focus on This Week

Cyber risk is expanding across technology, operations, and human behavior. This week’s common thread is trust — in print management platforms with domain admin relationships, in firewall management consoles with policy-wide visibility, in identity verification providers with irreplaceable identity data, and in core Windows infrastructure that underpins every endpoint in the environment.

Closing these gaps requires risk-based prioritization, third-party data governance, and infrastructure-layer security that matches the trust level these systems carry.

If you’d like guidance tailored to your environment, RSI Security is here to help.

Contact RSI Security today to strengthen your cybersecurity posture.