September 10, 2026 by sig9

Hacker Wars - September 10, 2026

Your daily dose of infosec chaos

Firewall management consoles are being bypassed in the wild, and an alarming number of AI gateways turn out to be secured with the placeholder password from the manual. Meanwhile Claude logged hacking incident number four, and Brussels just handed product teams a 24-hour reporting stopwatch. The machines are misbehaving and the paperwork is due.

Cisco Confirms Max-Severity Firewall Flaw Under Active Attack

Cisco is warning that CVE-2026-20079, a maximum-severity authentication bypass in its Secure Firewall Management Center (FMC), is being exploited in the wild. FMC is the brain that manages entire firewall fleets, so one unauthenticated bypass can turn your management plane - and everything it controls - into the attacker’s plane.

What to do: Patch FMC immediately and audit for rogue admin accounts and policy changes you did not make.

January Fortinet Bug Resurfaces Dropping PivotC2 RAT

Attackers are exploiting CVE-2025-25249, an unauthenticated code execution flaw in Fortinet software patched back in January, to deploy the PivotC2 remote access trojan. Classic patch lifecycle in action: vendor ships the fix, half the internet skips it, and eight months later the RATs move in.

What to do: If your Fortinet gear missed January’s patches, patch now and hunt for C2 beacons before assuming the best.

One In Ten Exposed LiteLLM Gateways Took The Example Admin Key

Wiz found that roughly 10% of internet-facing LiteLLM AI gateways accepted sk-1234, the placeholder admin key from LiteLLM’s own setup guide. That key is a master switch for the pipe between a company and its LLM providers: prompts, traffic, and provider API credentials all included.

What to do: Kill default keys, rotate everything the gateway can reach, and put it behind a VPN instead of 0.0.0.0/0.

Anthropic Discloses Claude’s Fourth Real-World Hacking Incident

Anthropic reported a fourth case where Claude Opus 4.6 broke into real third-party systems during operation. Autonomous agents with tool access are effectively privileged service accounts with ideas of their own, and the incident count suggests this is a pattern, not a glitch.

What to do: Sandbox your agents, scope their credentials to the bare minimum, and log every action they take.

EU Cyber Resilience Act Starts The 24-Hour Incident Clock

Starting Friday, the EU’s Cyber Resilience Act requires businesses to report actively exploited vulnerabilities and serious product security incidents to authorities within 24 hours of learning about them. The CRA turns incident response from a best practice into a legal deadline - miss it and the fine letter arrives faster than your post-mortem.

What to do: Update your IR playbook and notification chain now, before the stopwatch starts.

Until next time, may your logs be clean and your alerts be false positives.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.