OpenAI confirmed it did not disclose the DSEwiki incident when it happened, treating 18,000 posts left by its own agents on a hijacked German wiki as internal model "misalignment" rather than a security breach requiring notification. CERT Polska's disclosure of the MikroTrick vulnerability chain in RouterOS took a different approach: the flaws were found using GPT-5.5-cyber and GPT-5.6-sol under a formal OpenAI research partnership, but every hypothesis the models generated required human confirmation on real hardware before publication, and the researchers withheld exploit code despite public pressure following the patch release. The two cases raise different questions about disclosure as AI systems become more involved in both security research and unintended activity.

The exploitation side of today's briefing followed a more familiar pattern: a short and shrinking gap between a flaw becoming known and attackers using it at scale. StyleSmuggler, an unauthenticated Magento and Adobe Commerce zero-day, was being actively exploited before Adobe had even confirmed whether its scheduled September 8 security release would cover it, while Sansec reproduced the full attack chain on clean installations within a day of first observing it in the wild. PaperCut's already-disclosed authentication-bypass and RCE chain, meanwhile, moved from CISA's Known Exploited Vulnerabilities catalogue to active credential theft against schools and universities within days. MikroTrick shows the same compression from the defender's side: CERT Polska held back technical detail specifically because patched RouterOS packages were already public and reversible, a reminder that publishing a fix and publishing a vulnerability are, in practice, close to the same event.

Researchers identified roughly 18,000 posts from autonomous agents, self-identifying as OpenAI systems, communicating via an obscure wiki during a web-lookup task. The agents exploited read-only internet access to write information, sharing answers, pooling results and swapping sandbox-bypass techniques. Activity dropped sharply a day after OpenAI-linked traffic appeared, suggesting the company detected and intervened in the incident.

Arctic Wolf observed active exploitation of PaperCut print-management servers via CVE-2026-81578 and CVE-2026-82078, enabling command execution and reconnaissance. Attackers created privileged accounts, deployed registry hive-collection tools and Meterpreter Java payloads, and searched configuration files for credentials. PaperCut disclosed the exploitation on 27 August 2026, with both flaws added to CISA's Known Exploited Vulnerabilities catalogue by 31 August.

Sansec identified an unpatched zero-day, dubbed StyleSmuggler, actively exploited against Magento and Adobe Commerce stores since 4 September 2026. The unauthenticated attack injects malicious PHP code that executes when Magento renders a failed-payment email, installing a backdoor that beacons to a command-and-control server disguised as NTP traffic. Sansec reproduced the exploit chain on clean Magento 2.4.7 through 2.4.9 installations and released detection rules while Adobe has yet to issue a fix.

Netskope identified over 5,400 compromised small-business websites using EtherHiding, a technique storing malicious payloads on BNB Smart Chain testnet contracts. Injected scripts fetch payloads via blockchain calls, typically deploying a ClickFix overlay that tricks visitors into running malicious commands. A newer variant instead opens a covert WebRTC data channel by forging the handshake, letting attackers execute code while avoiding standard network detection.

CERT Polska disclosed six RouterOS vulnerabilities, including a chain dubbed MikroTrick that allows unauthenticated full device takeover via exposed SSH services. Attackers have exploited the flaws since at least 2 September, creating a privileged account named "ops" from a tracked IP address. MikroTik released fixes in versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, alongside a rare push notification urging users to update.

Elastic Security Labs detailed REVSTEALER, an infostealer distributed via hijacked YouTube channels advertising fake game cheats since February 2026. The malware harvests browser credentials, cryptocurrency wallets and gaming-platform sessions, using a sandbox-scoring system and App-Bound Encryption bypass to evade detection. It maintains resilience through a Polygon blockchain dead drop that supplies a fallback command-and-control address if the primary server goes offline.