Security Digest - September 23, 2026

Daily security intelligence briefing for infrastructure and endpoint management teams. Consolidated from authoritative research, vendor advisories, and community discussions.

• Generated (UTC): 2026-09-23 18:06:45 +00:00
• Lookback window: 7 days

🚀 Top Research & Advisories

• NightmareEclipse’s latest zero-day leaves Microsoft Defender stuck in the past - (Reddit r/cybersecurity) submitted by /u/NISMO1968 [link] [comments]

  Action: Review security controls and policy updates.

💻 AppSec

• [Tool] fad-checker – Air-gapped, multi-ecosystem dependency auditor made for real code audits (NO Maven required) - (Reddit r/cybersecurity) Monitor developer tool vulnerabilities and supply chain risks. Review Office update channel health and security baseline compliance.

• How One Kubernetes YAML Can Hand Over a GCP Organization - (BleepingComputer) Monitor developer tool vulnerabilities and supply chain risks.

• Scripting depth vs. hands-on tooling when pivoting into AppSec & DevSecOps - (Reddit r/cybersecurity) Monitor developer tool vulnerabilities and supply chain risks.

• Visual Studio Code v1.139 brings remote Dev Containers - (Neowin) Monitor developer tool vulnerabilities and supply chain risks.

🛡 Security Ops

• NIS2 in France: ANSSI’s ReCyF framework has 20 objectives and ~150 requirements. For SMEs, which ones break first? - (Reddit r/cybersecurity) Review CA/MFA settings for tightening opportunities.

• Rogue external MFA providers can steal passwords during logins - (BleepingComputer) Review CA/MFA settings for tightening opportunities.

🛠 Infrastructure & Endpoint Control

• [Tool] fad-checker – Air-gapped, multi-ecosystem dependency auditor made for real code audits (NO Maven required) - (Reddit r/cybersecurity) Monitor developer tool vulnerabilities and supply chain risks. Review Office update channel health and security baseline compliance.

• Adobe Premiere finally lands on Android, but has steep RAM requirements - (Neowin) Confirm Adobe exposure; push updated deployment.

• CVE-2026-84397 - (CVE.org) Confirm Adobe exposure; push updated deployment.

• Get Windows 11 Pro for just $9.97 - (Neowin) Validate workstation security baseline and update compliance.

• Google Chrome 154 patches 108 security vulnerabilities - (Neowin) Validate Chrome coverage; update managed package if needed.

• Microsoft adds a new admin tool for Windows 11 app and policy configurations - (Neowin) Validate workstation security baseline and update compliance.

• Microsoft Clipchamp gets AI-powered video upscaling to 4K on Windows 11 PCs - (Neowin) Validate workstation security baseline and update compliance.

• Quick tip: How to make Windows 11 apps always open maximized - (Neowin) Validate workstation security baseline and update compliance.

• Ransomware threat clean up help - (Reddit r/cybersecurity) Review security controls and policy updates.

• Report: Windows 11 KB5124010 crashing games like Battlefield 6 within minutes - (Neowin) Validate workstation security baseline and update compliance.

• Windows 11 KB5124010 does not contain new WinRE feature after all - (Neowin) Validate workstation security baseline and update compliance.

🩹 Patch Tuesday & Update Experience

• Report: Windows 11 KB5124010 crashing games like Battlefield 6 within minutes - (Neowin) Windows 11's latest KB5124010 update is seemingly turning Battlefield 6 and some other games into a crash fest within just minutes or even seconds of launching. Read more…

🔍 Quick Links (Watch Items)

• Get Windows 11 Pro for just $9.97 - (Neowin)
• How do you detect malicious packages after your scanner clears them? - (Reddit r/cybersecurity)
• Check Point (Avanan) or IRONSCALES - recent experience? - (Reddit r/cybersecurity)
• GitLab Email Feature Vulnerability Lets Attackers Push Code Into Private Repositories - (CybersecurityNews)
• Why aren’t more teams using active deception? It’s literally zero false positives. - (Reddit r/cybersecurity)
• Google Chrome 154 patches 108 security vulnerabilities - (Neowin)
• Outerlimit Raises $16M to Build Zero Trust Security Layer for Autonomous AI Agents - (CybersecurityNews)
• New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts - (CybersecurityNews)
• NIS2 in France: ANSSI’s ReCyF framework has 20 objectives and ~150 requirements. For SMEs, which ones break first? - (Reddit r/cybersecurity)
• Covert Air-Gap Exfiltration via Smartphone Class-D Audio Amplifiers (Zero Permissions Required) - TEMPEST PoC - (Reddit r/cybersecurity)