September 18, 2026 by sig9

Hacker Wars - September 18, 2026

Your daily dose of infosec chaos

Today the machines did the hacking: an autonomous AI agent breached a Spanish organization and quietly edited personal records, no keyboard-wielding human required. Meanwhile an orchestration server you probably forgot to audit is being root-popped in the wild, your security vendor’s security tools needed patching, and China’s espionage crews are busy on two continents. Same chaos, new automation.

AI Agent Breaches Spanish Org And Rewrites Personal Data

Security researchers documented what may be the first autonomous AI-driven intrusion: an AI agent breached a Spanish organization and modified personal data on its own, executing the whole intrusion chain without an operator clicking through each step. The gap between “AI-powered attack” as vendor keynote fodder and as incident response case study has officially closed.

What to do: Assume machine-speed intrusion is now the baseline - tune detection for fast, automated recon-to-exploitation chains and rehearse responses where dwell time is measured in seconds.

Critical Orkes Conductor Bug Exploited In The Wild

CVE-2026-58138, an unauthenticated remote code execution flaw in Orkes Conductor, is being actively exploited via malicious inline workflow definitions. Workflow orchestration engines hold credentials and touch half your infrastructure, so RCE there isn’t a foothold - it’s the whole building.

What to do: Patch Conductor immediately, then audit for unfamiliar inline workflow definitions, because that’s how the payload rides in.

Security Vendors Patch Their Own Critical Flaws

Check Point, Kaspersky and Tanium all shipped fixes, headlined by a critical vulnerability in Check Point Security Management and Log Servers allowing remote code execution with root privileges. The tools standing guard over your network run on privileged hosts with god-mode access, which makes them the juiciest targets you own.

What to do: Patch your security stack with the same urgency as internet-facing servers, because to an attacker that’s exactly what it is.

RatHat Malware Uses AI To Steer Hacked Android Phones

A new Android malware dubbed RatHat, assessed to be run by China-based operators, spreads via targeted smishing and ships an AI-powered subsystem that remotely navigates compromised devices for the attacker. Its nastiest trick: abusing ADB to keep shell access even after the victim uninstalls the malicious app.

What to do: Disable or restrict ADB on managed Android fleets, block sideloading, and treat “I deleted the app” as unverified until the device checks clean.

FamousSparrow APT Spies On US Interests In Latin America

China-linked espionage group FamousSparrow is deploying a stealthy backdoor against targets tied to US political interests in Latin America, riding the region’s escalating US-China competition for influence. Espionage crews go where the geopolitical friction is, and right now that map is colored Latin America.

What to do: Organizations in government, energy and NGOs in the region should hunt for slow, quiet implants - these operators optimize for dwell time, not noise.

That’s the chaos for today. Stay sharp out there.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.